Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper improves upon the previous backdoor defense method ANP, by replacing the binary neuron pruning in ANP with a more flexible soft weight masking method. Experimental results show performance improvements over ANP. 
strengths_and_weaknesses: Strengths:
1. All three technical improvements made over ANP are intuitively correct. And the results validate their effectiveness. 
2. The paper is well-written and easy to follow. 

Weakness:
1. The technique novelty is limited. 
The proposed method is a minor modification over ANP. The main difference is that it replaces hard-threshold binary masking in ANP with a more flexible soft weight masking/reweighting. Comparing Eq 3.2 (ie ANP) with Eq 4.2 (ie the preliminary proposed method), we can see the difference is only in the range of the mask: ANP require the mask to be binary while AWM (the proposed method) allows it to be continuous values in range [0,1]. Although AWM further used two more modification (sparsity on recovered backdoor pattern \delta and sparsity on the mask m), ablation study results in Table 3 show they don't bring considerable improvements: the gain is mainly from the use of softmasks. I would say the proposed method works as people would expect, but only as a minor modification over ANP. Also, the sparsity regularization on recovered backdoor pattern (Eq 4.2) is also hardly a novel contribution. It has been used in Neural Cleanse [1] and many follow-up works such as [2]. 

[1] Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. S&P, 2019. 
[2] Better Trigger Inversion Optimization in Backdoor Scanning. CVPR, 2022.

2. The reported results on the baseline method IBAU is too low.
In table 1, the authors reported IBAU has over 30% attack success rate (ASR) against Trojan-WM when 100 clean samples are available. However, in the original IBAU paper, in their Table 5, under the same setting, the ASR is as low as 4%. Can you please explain why there is such large gap, or point out what difference in the setting I have overlooked? Thanks!

3. This paper highlights its performance under one-shot setting. It is indeed advantage if the backdoor defense method requires less clean samples to fix the poisoned model. However, why do we need to peruse the extreme case of one-shot (ie only one clean sample is available for defense)? I think it practical for the defender to have a small amount (eg some hundreds) of clean data. 
questions: Please see above.
limitations: Please see above
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper tries to improve the recent proposal of ANP in the small training data range, by using an "optimization" based procedure to find a soft-mask, in order to remove the backdoor trigger pattern.

The approach is well motivated, and well formulated (4.1--4.4)

Experiments show the effectiveness of the method, especially in the one-shot case
strengths_and_weaknesses: Strengths: Well motivated approach. The presentation is very clear and strong experiment results are shown

Weakness: I'm not sure whether this has been studied, but if the adversary is aware of the optimization procedure for removing the backdoor pattern, would he be able to leverage that to counter the defense? 
questions: Are there possibilities for adaptive attacks if the adversary knows the optimization procedure for removing the backdoor pattern? Is this a sensible question to ask?
limitations: No limitation identified
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper try to address two main drawbacks of adversarial neuron pruning (ANP), that is, ANP 1) largely depends on the size of the training set and 2) performs badly when it fails to identify sensitive neurons. On this basis, the authors propose three strategies, namely soft weight masking (SWM), adversarial trigger recovery (ATR) and sparsity regularization (SR). The proposed methods outperform ANP especially when the available dataset is small and the network size is small.
strengths_and_weaknesses: Strengths

a. The paper is clearly written and easy to follow, and the motivation is reasonable.

b. The proposed methods outperform ANP in limited resources cases, especially in one-shot setting.

Weaknesses:

a. The evaluation is insufficient. 

b. Although AWM seems better than ANP, the generalization to different attacks is considered not as good as ANP. This is because the authors assume the trigger is universal (ATR) and sparse (SR), which do not cover dynamic triggers [36, 37] and triggers that are spread over the whole image [33].

questions: a. As the authors claim that the proposed methods help when the network size is small, they should test their methods on more typical lightweight architectures such as ShuffleNet [A], SqueezeNet [B] and MobileNet [C]. The results only on VGG is unconvincing.

b. The defense effect against stronger attacks (e.g., clean label attack [D], blended attack [E]) and under various poisoning rate (especially 1%) should be tested. 

c. I wonder if the proposed defense work against all-to-all attacks in one-shot setting?

[A] Zhang, X., Zhou, X., Lin, M. and Sun, J., 2018. Shufflenet: An extremely efficient convolutional neural network for mobile devices. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 6848-6856).

[B] Iandola, F.N., Han, S., Moskewicz, M.W., Ashraf, K., Dally, W.J. and Keutzer, K., 2016. SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and< 0.5 MB model size. arXiv preprint arXiv:1602.07360.

[C] Howard, A.G., Zhu, M., Chen, B., Kalenichenko, D., Wang, W., Weyand, T., Andreetto, M. and Adam, H., MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications.

[D] Turner, A., Tsipras, D. and Madry, A., 2019. Label-Consistent Backdoor Attacks.

[E] Chen, X., Liu, C., Li, B., Lu, K. and Song, D., Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.
limitations: No. One of the limitations of the proposed methods is that it assumes the trigger is universal and sparse, which do not cover dynamic triggers [36, 37] and triggers that are spread over the whole image [33].
review_title: null

Meta-review: metareview: The paper presents a method for defending deep neural networks against backdoor attacks, i.e., attacks that inject “triggered” samples into the training set. The method can be seen as an improvement on Adversarial Neuron Pruning (ANP) that uses (i) soft weight masking (SWM), (ii) adversarial trigger recovery (ATR) and (iii)  sparsity regularization (SR). The main focus of the paper is in the low-data regime, especially in the one-shot setting and when the network size is small. 

The authors have clarified the novelty of the approach wrt to ANP and have provided additional experiments addressing some of the reviewers' concerns. In view of this, some of the reviewers raised their scores. However, there are still concerns regarding the novelty of the method and the difficulty of setting hyperparameters. The empirical results seem solid, however. 

confidence: Less certain
Decision: Accept