Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This paper shows that self-supervised, contrastive learning can give a feature extractor that scatters training data points with backdoor triggers in the feature space. With this observation, the authors propose a novel defense method based on contrastive learning and decouple end-to-end training to defend against backdoor attacks. They first train a feature extractor using self-supervised contrastive learning that turns the poisoned data points into outliers in the feature space. Then they train a cascade classifier that ignores the poisoned data points by leveraging the fact that a neural network tends to capture frequent patterns. Experiments are conducted and the results verify the effectiveness of the defense.
main_review: The paper proposes a novel defense method named DBD based on contrastive learning (SimCLR) and conduct extensive experiments to show that DBD is effective against  different types of attacks, including BadNets, Blended, WaNet, and Label-Consistent attacks.

However, the author did not compare DBD with some recently works such as "Spectral signatures in backdoor attacks" in NIPS 2018 and "Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering" in AAAI 2019, which both are based on data removal. It is unclear how differently DBD removes the poisoned data as compared with the existing works.

While the authors claim that their major contribution was to decouple the end-to-end training process, I suspect the proposed approach works only with SimCLR. What is the necessary conditions that makes a feature extractor scatter poisoned data points in the feature space? Can you point out other feature extractors having the same properties as SimCLR? Does DBD works with these extractors too?

The effect of the final fine-tuning step is unclear. How does DBD perform without this phase?

I also suggest the authors to move the section about the resistance to adaptive attacks in Appendix into the main paper as the adaptive attacks are becoming a more serious threats today. Please explain your adaptive attack settings more clearly (for example, what trigger size you used and how you tuned the hyper-parameters).

It would also be good if the author discuss how an attack may work around the proposed defense, and how to further defend such workarounds.

Edit after rebuttal:

The reviewer thank the authors for their response. Most of my concerns have been addressed. In particular, the DBD seems to be effective against the adaptive attacks with a large trigger size. The experiments also show that DBD works with other self-supervised learning methods. Also, comparison with the baseline methods such as Spectral Signatures have been made. Due to the above, I raise my score.

summary_of_the_review: Overall, the paper proposes a novel defense to the backdoor attacks that could benefit the field. However, the current experiments are not convincing enough because some critical baselines are missing. There is no discussion on how general the proposed defense work when different training techniques are used in different phases. And there is no discussion on how a backdoor attack may work around the proposed defense, and how to further defend such workarounds like many other security papers did. Therefore, I give a weak reject.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: Summary: authors propose a modification to the training procedure to prevent backdoor attacks. Instead of performing supervised training, they suggest first training the model in a self-supervised way, then in a supervised way on fully connected layers. Later they propose to remove low-credible samples and fine-tune the whole model on the remaining samples with labels.  They claim that this procedure eliminates the backdoored inputs that have incorrect labels.
main_review: Strengths: I enjoyed reading the paper as it has a good structure, strong sets of experiments and baselines. Instead of searching for the triggers as NC and other papers are trying to do, this paper proposes to address the label discrepancy introduced by backdoor samples.

Weaknesses: 
1. The proposed method modifies an underlying training procedure multiplying training time, which I think is significant for practitioners. Addressing this issue is essential to support the practicality of the method.
2. The primary assumption of the paper is that learning in semi-supervised learning is safe. However, Carlini [1] 's recent work demonstrates the attacker's effectiveness under the same threat model, i.e., when the attacker is only allowed to poison data. If the poisoning is efficient, then the proposed defense exposes the model to a different attack.

[1] Carlini, N. (2021). Poisoning the Unlabeled Dataset of Semi-Supervised Learning. USENIX Security'21
summary_of_the_review: Overall, I believe the method is useful, however the above questions are important to be addressed.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper uses self-supervised learning to get benign representation and then uses a noisy label algorithm (SCE) to optimize the prediction model. The empirical performance shows the effectiveness of the proposed method. 
main_review: Strengths:
* The proposed method is quite intuitive and easy to be extended to the more advanced methods.
* The experiment part shows the effectiveness of the proposed method.

Weakness:
* The paper lacks a theoretical analysis of the proposed method. I understand that this paper mainly focused on empirical performance, but * it is quite surprising that the proposed methods perform well on label-consistent attacks. This is because that proposed method decouples the label corruption and feature corruption. When label corruption no longer exists, what is the advantage of the proposed method?
* For the second step label noise learning, there are also many choices instead of just using the symmetric cross-entropy method. Investigating more noisy-label algorithms might be interesting.
* The two-step method makes the algorithm not in an end-to-end fashion. It would be interesting to investigate the possibility to make an end-to-end algorithm.
* I do not think excluding the detection-based method is fair since those methods are strong baselines especially for the badnet and blending attack. Also, since the main contribution of the paper is the empirical performance, it is necessary to compare with different kinds of baselines.
summary_of_the_review: I think the proposed method is natural and simple, which makes the paper easy to be extended to different settings. I recommend weak acceptance since the experiment part did not fully convince me.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a decoupling-based backdoor defense (DBD) on poisoning-based backdoor attacks where an adversary can modify the dataset only. Specifically, DBD combines a self-supervised feature extractor and a supervised noise-free classifier, with an additional semi-supervised learning fine-tuning step. The core idea is to decouple the feature extractor and the final prediction. The authors evaluate the effectiveness of DBD on three datasets, three backdoor attack models, and four defense baselines.

main_review: This paper proposes decoupling-based backdoor defense (DBD) on poisoning-based backdoor attacks. Specifically, the authors first give a broad view of why backdoor works by visualizing the poisoned and benign data in the embedding space. They found that the supervised learning paradigm tends to cause poisoned data close to its target label rather than the ground truth label. To mitigate this, the DBD first uses a self-supervised learning to learn a purified feature extractor. It splits the training dataset into two disjoint parts by comparing the fully connected layers' training loss. Later, it uses the high-credible and low-credible samples to fine-tune the whole model in a semi-supervised manner. Experiments are performed on three datasets, three backdoor attack models, and four defense baselines. The authors also consider multiple potential scenarios in practice, such as trigger patterns, adaptive backdoor attacks.

The idea of this paper is simple but effective, and the authors' efforts in the experiments are highly appreciated. Details comments are as follows.

The primary concern of this paper is the extra computation cost of the proposed DBD pipeline. Considering training a self-supervised and semi-supervised model costs way more computational resources than a supervised learning model. Would it be possible to use a public pre-trained feature extractor to replace the self-supervised feature extractor? The authors are welcomed to discuss this.

In Section 5.2, the authors list the results on "No defense" to show the backdoor defenses' impact on the original model's accuracy and the effectiveness of the backdoor mitigation. It is not clear how the model works without a defense. Suppose the authors train the original model in a supervised learning manner. In that case, directly using a self-supervised learning paradigm should also be included to illustrate each step's contribution.

In the fine-tuning step, the sensitivity of lambda should also be discussed, since it controls the ratios of unlablelled data.

In Figure 1(a), the poisoned samples' embedding seems far from the target label (label 3) and closer to other un-targeted labels (label 1, 7, and 9). It would be great if the authors could give explanations.

summary_of_the_review: I like this paper and would support an accept.
review_title: null

Meta-review: Inspired by the observtion that the poisoned samples tend to cluster together in the feature space of the attacked DNN model, which is mostly due to the end-to-end supervised training paradigm, the authors propose a novel defense method based on contrastive learning and decouple end-to-end training to defend against backdoor attacks.
The issues, including training time, difference from certain previous studies, ablation study, and so on, raised by the reviewers have been properly addressed and the reviewers are satisfied with the responses from the authors.
According to the consistent positive opinions from the reviewrs, this manuscript is recommended to accept.
Decision: Accept (Poster)