DEFENDING BACKDOOR ATTACKS VIA ROBUSTNESS AGAINST NOISY LABEL
Authors: Boyang Liu
Zhuangdi Zhu
Yijiang Pang
Pang-Ning Tan
Jiayu Zhou
Venue: Submitted to ICLR 2023 (2023)
Keywords: Backdoor Attack
Deep Learning
Data Poisoning
Noisy Label

Abstract: Many deep neural networks are vulnerable to backdoor poisoning attacks, in which an adversary strategically injects a backdoor trigger into a small fraction of the training data. The trigger can later be applied during inference to manipulate prediction labels. While the data label could be changed to arbitrary values by an adversary, the extent of corruption injected into the feature values is strictly limited to keep the backdoor attack in disguise, which leads to a resemblance between the backdoor attack and a milder attack that involves only noisy labels.
This paper investigates an intriguing question: \textit{Can we leverage algorithms that defend against noisy label corruptions to defend against general backdoor attacks?} We first discuss the limitations of directly using current noisy-label defense algorithms to defend against backdoor attacks. We then propose a meta-algorithm for both supervised and semi-supervised settings that transforms an existing noisy label defense algorithm into one that protects against backdoor attacks. Extensive experiments on different settings show that, by introducing a lightweight alteration for minimax optimization to the existing noisy-label defense algorithms, the robustness against backdoor attacks can be substantially improved, while the initial form of those algorithms would fail in the presence of a backdoor attack.

Under review as a conference paper at ICLR 2023
DEFENDING BACKDOOR ATTACKS VIA ROBUSTNESS AGAINST NOISY LABEL
Anonymous authors Paper under double-blind review
ABSTRACT
Many deep neural networks are vulnerable to backdoor poisoning attacks, in which an adversary strategically injects a backdoor trigger into small fraction of the training data. The trigger can later be applied during inference to manipulate prediction labels. While the data label could be changed to arbitrary values by an adversary. the extent of corruption injected into the feature values is strictly limited to keep the backdoor attack in disguise, which leads to a resemblance between the backdoor attack and milder attack that involves only noisy labels. This paper investigates an intriguing question: Can we leverage algorithms that defend against noisy label corruptions discuss the limitations of directly using current noisy-label defense algorithms to defend against backdoor attacks. We then propose meta-algorithm for both super- vised and semi-supervised settings that transforms an existing noisy label defense algorithm into one that protects against backdoor attacks. Extensive experiments on different settings show that, by introducing a lightweight alteration for minimax optimization to the existing noisy-label defense algorithms, the robustness against backdoor attacks can be substantially improved, while the initial form of those algorithms would fail in the presence of a backdoor attack.
defend against general backdoor attacks? We first
INTRODUCTION
Deep neural networks (DNN) have achieved significant success in a variety of applications such as image classification (Krizhevsky et al. 20122) autonomous driving (Major et al. 2019), and natural language processing (Devlin et al. 2018), due to their powerful generalization ability. However, DNN can be highly susceptible to even small perturbations of training data, which has raised considerable concerns about their trustworthiness (Liu et al. 2020). One representative perturbation approach is backdoor attack, which undermines the DNN performance by modifying small fraction of the training samples with specific triggers injected into their input features, whose ground-truth labels altered accordingly to be the uttacker-sseciffee ones. It is unlikely such backdoor attacks will be detected by monitoring the model training performance since the trained model can still perform well the benign validation samples. Consequently, during testing phase, if the data is augmented with the trigger, it would be mistakenly classified as the attacker-specffied label. Subtle yet effective, backdoor attacks can pose serious threats the practical application of DNNs.
Another typical type of data poisoning attack is noisy label attacks (Han et al. 2018 Patrini et al. 2017 & Wu 2019; Jiang et al., 2017), in which the labels of small fraction of data are altered deliberately to compromise the model Tearning, while the input features of the training data remain untouched. Backdoor attacks share a close connection to noisy label attacks, in that during backdoor attack, the feature can only be altered insignificantly to put the trigger in disguise, which makes the corrupted feature (e.g. images with the trigger) highly similar to the uncorrupted ones. Prior efforts have been made to effectively address noisy label attacks. For instance, there are algorithms that can tolerate a large fraction of label corruption, with up to 45% noisy labels (Han et al.) 2018 Jiang et al. 2018). .. However, to the best of our knowledge, most algorithms defending against backdoor attacks cannot deal with high corruption ratio even the features of corrupted data are only slightly aim to answer one key question: Can
perturbed. Observing the limitation of prior sfate-oflle of-te-of-the-art, the-art, one train a deep neural network that is robust against a large number of backdoor attacks? Moreover, given the resemblance between noisy label attacks and backdoor attacks, we also investigate another

---

Under review as a conference paper at ICLR 2023
intriguing question: Can one leverage algorithms initially designed for handling noisy label attacks to defend against backdoor attacks more effectively?
The contributions of this paper are multi-fold. First, provide novel and principled perspective to decouple the challenges of defending backdoor attacks into two components: one induced by the corrupted input features, and the other induced by the corrupted labels, based on which we can draw a theoretical connection between the noisy-label attacks and backdoor data attacks. Second, we propose a meta-algorithm address both challenges by novel minimax optimization. Specifically, the proposed approach takes noisy-label defense algorithm as its input and outputs a reinforced version of the algorithm that is robust against backdoor poisoning attacks, even if the initial form of the algorithm fails to provide such protection. Moreover, we also propose a robust meta- meta-algorithm in semi-superee supervise setting based on our theorem, leveraging more data information to boost the robustness of the algorithm. Extensive experiments show that the proposed meta-algorithm improves the robustness of DNN models against various backdoor attacks on variety of benchmark datasets with up to 45% corruption ratio, while most previous study on backdoor attack only provide robustness against small corruption ratio. Furthermore, we propose a systematic, meta-framework to solve backdoor attacks, which can effectively join existing knowledge in noisy label attack defenses and provides more insights to future development of defense algorithms.
RELATED WORK
Robust Deep Learning Against Adversarial Attack. Although DNNs have shown high general- ization performance on various tasks, it has been observed that trained DNN model would yield different results even by perturbing the image in an invisible manner (Goodfellow et al., 2014 Yuan et al. 2019). Prior efforts have been made to tackle this issue, among which one natural defense strategy is to change the empirical loss minimization into a minimax objective. By solving the minimax problem. the model is guaranteed a better worst-case generalization performance (Duchi & Namkoong/ 2021). Since exactly solving the inner maximization problem can be computationally prohibitive, different strategies have been proposed to approximate the inner maximization opti- mization, including heuristic alternative optimization, linear programming Wong & Kolter (2018), semi-definite programming Raghunathan et al. (2018), etc. Besides minimax optimization, another approach to improve model robustness is imposing a Lipschitz constraint on the network. Work along this line includes randomized smoothing Cohen et al.) (2019); (Salman et al. (2019), spectral normal- Amoothing/Cohhn
ization Miyato et al. (2)18a), and adversarial Lipschitz regularization TTrjek (2019). Although there are algorithms that are robust against adversarial samples, they are not designed to confront backdoor attacks, in which clean training data is usually inaccessible. There are also studies that investigated the connection between adversarial robustness and robustness against backdoor attack (Weber et al.. 2020). However, to our best knowledge, there is no literature studying the relationship between label flipping attack and backdoor attack.
Robust Deep Learning Against Noisy Labels. Many recent studies have investigated the robustness of classification tasks with noisy labels. For example. Kumar et al. (2010) proposed the Self-Paced Learning (SPL) approach, which assigns higher weights examples with smaller loss. A similar idea was used in Curriculum Learning (Bengio et al.) 2009), in which a model is trained on easier examples before moving to the harder ones. Other methods inspired by SPL include learning the data weights (Jiang et al. (018)) and collaborative learning (Han et al. [0118] Yu et al.) 2019). An alternative approach defending noisy label attacks is label correction PPttrnn al.] 2017 Li et al.
2017, Yi & Wu 2019), which attempts to revise the original labels of the data to recover clean labels from corrupted ones. However, since we do not have the knowledge of which data points have been corrupted, it is nontrivial to obtain provable guarantees for label corrections, unless strong assumptions have been made on the corruption type.
Data Poisoning Backdoor Attack and its Defense. Robust learning against backdoor aftacks has been widely studied recently. Gu et al. (0177) showed that even a small patch of perturbation can compromise the generalization performance when data is augmented with backdoor trigger. Other types of attacks include the blend attacks (Chen et al. 2017), clean label attacks (Turner et al., 2018 Shafahi al.] (2018). latent backdoor attacks (Yao et al. 2019), etc. While there are various types of backdoor attacks, some attack requires that the adversary not only has access to the data but also has limited control the training and inference process. Those attacks include trojan attacks and
2

---

Under review as a conference paper at ICLR 2023
blind backdoor attacks (Pang et al. 2020). We refer readers to Pang et al. (2020) for a comprehensive survey on different types of backdoor attacks. Various defense mechanisms have been proposed to defend against backdoor attacks. One approach is to remove the corrupted data by using anomaly detection (Tran et al. 2018 Chen et al. 2018). Alternatively, model inspection (Wang et al. 2019) aims inspect and modify the compromised model make it robust against the trigger. In addition, there are other methods to tackle the backdoor attacks, such as randomized smoothing (Cohen et al.
2019. Weber al. 2020), and the median of means (Levine & Feizi 2020), However, they are either inefficient or cannot defend against backdoor attacks with large ratio of corrupted data. Some of the above methods also hinge on having a clean set of validation data, which is impractical since
is unlikely we can guarantee the existence of clean validation data given that the validation data is usually subset of the training data. To the best of our knowledge, there is no existing backdoor defense algorithm that is motivated from the label corruption perspective.
PRELIMINARIES
Learning with Noisy Labels There are two representative approaches for defending against noisy- labels: 1) Filtering- -iriiigg approach is one of the most effective strategies for defending against noisy labels, which works by selecting or weighting the training samples based on indicators such as sample losses (Jiang et al., 2017 Han et al. 2018 Jiang et al. (2020) gradient norms of the loss-layer (Liu ct al. I). For instance, Jiang et al. (2017 proposed to assign higher probabilities to samples with lower losses be selected for model training. 2) Consistency-based approach modifies data labels during model training. Specifically, the Bootstrap approach (Reed et al.) (014) encourages model predictions be consistent between iterations, by modifying the labels a linear combination of the observed labels and previous predictions.
Although the initial forms of these approaches can be vulnerable to backdoor attacks, we propose meta-algorithe that empowers them to effectively counter against backdoor attacks. In this paper. we examine two filtering-
noisy label algorithms, namely, Self-Paced Learning (SPL) Jiang et al. 2017); Kumar et al. (210)) and Provable Robust Learning (PRL) Liu et al. (221)) and one consistency-ben based algorithm, the Bootstrap Reed et al. (2014). to investigate the efficacy of the proposed meta algorithm. We briefly summarize the main idea of the above algorithms in Table E in Appendix section. The empirical results in Section strongly suggest that our meta framework can readily benefit the existing robust nobsy-label algorithms.
Problem Setting of Backdoor Attacks We follow the standard setting for backdoor attacks and assume that there is an adversary that tries to perform the backdoor attack. Firstly, the adversary can choose up to e fraction of clean labels Y E IR=xy and modify them to arbitrary valid numbers to form the corrupted labels Y, E IR [in]] [xq, Let Y, represent the remaining untouched labels. The final training labels can be denoted as Y, Y,, Y, Accordingly, the corresponding original feature are denoted as X = [X, E R xd X,
E R (n- [d)]) The adversary can design trigger t E Rd to form the corrupted feature set X₁ E R [me] xd such that for any b; in Xb, O; in X., it satisfies b. 02 + t. Finally, the training features are denoted as X. = [X, E R [nc] xd X, E IR(" [=<] Assuming T = ft, t.... t] E R [ therefore X. + T = x Before analyzing the algorithm, we make following assumptions about the adversary attack:
Assumption 1 (Bounded Corruption Ratio). The overall corruption ratio and the corruption ratio in each class is bounded. Specifically,
T(y: +c c(y= Sc= CC=0.EYEAA.
E ((X.N.))EXXXYY
Assumption 2 (Small Trigger). The backdoor trigger satisfies ||tllp S T, which subtly alters the data within a small radius-7 ball without changing its ground-truth label.
We also assume that there exists at least one black-box robust algorithm A which can defend noisy label attacks long the nobsy-label ratio is bounded by Note that the assumption of noisy label algorithm is mild, since a variety of existing algorithm can handle noisy labels attacks with a large corruption rate (e.g. 45%) (Jiang al. 2017 Han et al., 2018 Reed et al. 2014 Liu al. 2021). I). 'Some backdoor attack algorithms design instance-specific trigger. In this paper, only focus on the static trigger case and leave the instance-specific trigger case for our future study.
3

---

Under review as a conference paper at ICLR 2023
4 METHODOLOGY
Given an c-backdoor attacked dataset (X Y.), a clean distribution p" == (X, Y), and a loss function L, our goal is to learn network function that minimizes the generalization er- ror under the corrupted distribution, i.e. ((z,)))''' [[(f(x + x)] and clean distribution, i.e. E( [z(f()),)) y)]. Next, we elaborate our meta-approach for defending against backdoor at- tacks in order to achieve our goal.
4.1 A BLACK-BOX ROBUST ALGORITHM AGAINST NOISY LABELS
The ultimate goal for defending against backdoor attacks is to learn a network function f to minimize its risk given some corrupted input features:
m J(f) == ((,,))>'' [C([(z + t),
However, Equation is not directly optimizable for two reasons: 1) we only have access to the corrupted imputs and the corrupted labels Y and 2) the trigger t is unknown. As such, we consider an surrogate objective that optimizes the worst-case of Equation]]
miny max jell
+c)
Since the trigger satisfies ||tl/p S T. it is easy to see that Equation minimizes an upper-bound of the ground-truth loss, in that: E L( t),y) S
max h Exxxx [C( + c), To this end, directly optimizing the surrogate objec- tive in Equation 2 is still intractable, since we do not have access clean X and Y, which prevent us from using adversarial training to solve the minimax objective. To tackle this challenge, we will first assume that the clean label Y is available, and then relax this assumption by using learning algorithms that are robust against noisy labels. Specifically, by assuming that &w = L. o has Lipschitz constant L w.r.t. x, we further obtain a new upper bound (see Appendix for derivation):
E Exexyey [[(f(x c). 1
"Exxx yeY p c, + ETL,
(3)
which draws a principled connection between the risks from corrupted data and clean data:
min max 1 Σ 1olp xEX
[C[[(x [ c),,)] s min max I
Σ yEX
[C[[(x + [ +c). +))x))
(4)
where the first term on the RHS of Equation 4 involves optimization on the corrupted features X and clean labels Y. while the second term the RHS requires minimizing the Lipschitz constant L w.r.t. x. Recall that minimizing the maximum gradient norm is equivalent to minimizing the Lipschitz constant [Terjčk] 2019). Therefore, optimizing the first term naturally regulates the maximum change of the loss function within a small ball, which hence constrains the magnitude of the gradient and has negligible effects on the Lipschitz regularization. The relationship between Lipschitz regularization and adversarial training has been well discussed in the literature (Terjék 2019 Miyato et al. 2018b). We defer this discussion the Appendix section.
Equation indicates that if the target labels are not corrupted and the learned function has a small Lipschitz constant, learning with corrupted features is feasible achieve low risk. Up now, the remaining challenge of optimizing the surrogate objective in Equation 4 is the inaccessible clean label set Y. Fortunately, a variety of algorithms are at hand for handling noisy labels dur- ing learning (Jiang et al., 2017; Liu et al.] 2021: Kumar et al.) 2010). which we can directly ap- ply to our minimax optimization scheme. Specifically, for the outer minimization, one can have:
cc. and we can perform the noisy-label update for the above optimization objective. For instance, given the mini-batch M., M, with batch size m, we use SPL to perform the update, we can get the top (1 e e)m data with small risk L(f(x + c), to perform one-step gradient descent. we use the PRL to perform the update, assuming L is the eross-entropy loss, the top (1 - e)m data with small loss-layer gradient norm f] + c) y can be used to perform one-step gradient descent. If we apply the bootstrap method, we can add a bootstrap regularization update the above objective.
miny- ExEx-yev-
4

---

Under review as a conference paper at ICLR 2023
Meanwhile, it is non-trivial to directly solve the inner maximization, since adversarial learning с Equation | still faces the threat of noisy labels. To tackle this issue, we can leverage the same robust noisy label algorithm. Specifically,
first approximate the inner optimization
using the first-order Tyler expansion: c* = arg jell , Exxxyex L(f(x + c),y) R
n.
arg jr c² V "x==xxxxexx y). The preceding optimization is linear program- n ming problem. With the lxc norm ball constraint on the perturbation, the optimization problem can be efficiently solved by the fast gradient sign method (FGSM). Given minibatch M2 with batchsize m, we have the following closed-form solution:
c Clipe
II.X m
.xEM,.yeM, sign (Vx (fx(((()))))
(5)
To relax the prerequisite of having a clean label set y Equation 5 we will use a noisy-label algorithm to perform the update. For instance, if we
loss- loss-filtering based algorithm (e.g. SPL), then for each mini-batch batch, only the top (1 - c)m data with small C y) would be included the update. If adopt gradient-based filtering algorithm (e.g. PRL). given that L the cross-entropy loss, then only the top (1 e e)m data with small (I](x) - yll will be included. The outside clipping ensures that the feature value of the corrupted image in the valid range. Based on the above discussion, we now introduce our meta-algorithm in Algorithm [ that is robust against backdoor attacks, given an arbitrary noisy-label robust algorithm A its input. We also provided illustration in Figure D of the Appendix.
Algorithm 1: Meta Algorithm for Robust Learning Against Backdoor Attacks
input: Corrupted training data X Y", perturbation limit: т, learning with noisy label algorithm A (e.g. PRL. SPL. Bootstrap).
return trained neural network:
while epoch S. max_ sax_epoch do
for sampled minibatch M., M,,M, in X Y" do
#lnner maximization step
initialize с as 0 vector.
optimize max (Mf + c), M3) w.t.. to by using robust algorithm A for one step
optimize miny [M, + c), M,) w.r.t f by using robust algorithm A for one step
end end
4.2 THEORETICAL JUSTIFICATION
Our ultimate goal is to learn w that achieves a low expected risk Ex.y &w + y) To study the generalization performance on the ground truth distribution pæ, we first define the following risks: R,np 1 _xxxXyey (x +t,), R, Ex.y<pr (x tty). Romp = - yeY Pw (x- y) Next, we focus on the gap between R, and R.mp.
Theorem 1. Let Remp Re, T, defined as above. Assume that the prior distribution of the net- work parameter w NN(0, a), and the posterior distribution of parameter N(w, o) which is learned from the training data. Let k be the number of parameters, be the sample size, and
[w 1++ 2x
1 log
+ 1 +log +2 +3k)
If the objective function ow = Lo f is Lo -Lpsschitz smooth, then with probability at least 1-8, can have:
n-1
R, < Remp + (2T + ET) +r.
(6)
We hereby present the skeleton of the proof and defer more details to the Appendix. First, we decompose the error into two terms: 1) the generalization gap the triggered data, and 2) the difference of performance loss between the trigger t and worst case perturbation c: R2 - R = (R, R. + (R. RemP). The first component can be bounded by I, which is derived by following the uniform convergence Paye framework (Foret et al.) 2020). For the second term, the gap is introduced by two sources. The first source is the difference between and t,, and the second
5

---

Under review as a conference paper at ICLR 2023
is from the difference between X and X Since the objective is Lg Lipschitz, and ||t cll S 2T according to our constraint to the adversary. it is easy to upper bound the error as LT Meanwhile, there is e-fraction of difference between X and X which is bounded by ||t|| < and leads to the other difference term LEgE.
Theorem I presents upper-bound of the gap R2 -R.-R R.mp, The first term in Equation 6 can be minimized by using noisy label algorithm. The second term, which the error induced by the adversarial trigger, jointly constrained by the Lipschitz constant Lg, perturbation limit т, and the corruption ratio 6. We can regularize the La whereas the T and are controlled by the unknown adversary. Note that existing literature has also shown that adversarial training plays a similar role as Lipschitz regularization. The last term, the normal generalization error on the clean data, is difficult to minimize directly. The bound in Theorem Temphasizes the importance of involving both the noisy label algorithm and the adversarial training. The noisy label algorithm can reduce the Remp while the adversarial training regularize the Lipschitz constant L..
4.3 SEMI-SUPERVISED ALGORITHM
In backdoor attacks, most attacking algorithms require modifying the label to successfully deploy the attacks. If we could leverage the knowledge from unlabeled data (i.e. via semi-supervised learning), the model performance will likely improve. In this section, we extend Theorem [ semi-supervised learning setting and show that utilizing more data can benefit the model robustness. Our motivation is from the following property of Lipschitz functions. If h is composition of two functions, Recall in Eq. 6 the Lipschitz constant L depends on the loss function Ø, which can be decomposed into the representation function h X + Z, linear prediction layer q following proposition:
and (h- = fo g), then [|b]|ısp S |lff
Y, and cross entropy layer CE x + R. We then have the
With the assumptions in Theorem 7 let the network be composition of representation extraction is and linear classifier q. Let maa be the maximum singular value of the last layer linear prediction weight matrix (i.e. fine-tuning layer). If the representation extraction is La Lipschitz, then with probability at least 1-8, we have:
Proposition 1.
R₂ S Remp + Li.Tma V2(27 +T.
The proof is provided in the Appendix. The advantage of decomposing the Lipschitz constant of the objective function into the Lipschitz constants of the representation and prediction functions is that controlling Ln does not require access to the labels. This suggests that we can leverage the unlabeled data to control L, and let the supervised learning part to control mmaz- Let the representation of the last layer be Z = I(X), we have LA defined as [/(x,) - [I S Ln |X| X2l1, VX1, X2. Then, our goal is leverage more data to improve La, and fine-tune the last linear layer to control the Tmax with labeled data.
In this work, we use the SimCLR learn the representation function h. SimCLR first defines random transformation set T (i.c. cropping, color jittering, flipping. rotation, i.e.), and then samples two random transformations, Ti and T2, generate two views (x() and T2(X) for each image. Then, the model is trained to maximize their cosine similarity. Note that the transformations of SimCLR usually make images after transformation T(X) to be semantically close to X. Therefore we assume that there exists some distance metric d (i.e. Wasserstein distance) so that the distance between the original image and the transformed one small (i.e. d(X, T((X)) S .T, ~ T).
Then, by triangle inequality, we have (X), (x))) S r. Thus, SimCLR actually samples two images which are closed in some distance metric, and then maximizes the cosine similarity, which equivalent to minimizing the normalized f2 distance. This process can be viewed as enforcing a Lipschitz regularization for the representation learning, since SimCLR minimizes the normalized lz distance in representation space for two random images that are close in Wasserstein distance. The remaining part that needs to be controlled is the maximum singular value of the last linear layer, which can be enforced by using spectral normalization Miyato et al. (2018a). Motivated by this, in Alg. we propose semi-supervised robust algorithm to defend against backdoor attacks.

---

Under review as a conference paper at ICLR 2023
Algorithm 2: Semi-Supervised Algorithm for Robust Learning Against Backdoor Attacks
Corrupted training data X", Y", Clean Augmented Dataset Xaug- perturbation limit: T, learning with noisy label algorithm A (c.g. PRL, SPL, Bootstrap). return trained neural network;
input:
Use SimCLR on , Xang] to learn the representation function h, then fine-tune the linear layer with spectral normalization using noisy label algorithm as following
while epoch &. max max_epoch do
for sampled minibatch Mg, M. in X do
min [(fi (h (M))) M2) w.r.t ftin by using robust algorithm A for one step
spectral normalization to truncate the largest singular value of last linear layer.
end end
Bockdoor Attack Defense Accuracy.
Dunsset
A1
BootSrap
Beossrap
PRL
PRL
SPL
SPL
Standard
Tine
CaraRIo
Putch
Accuracy
66.64
51,25
309
194
3
253
2.75
81.71
17.50
0.33
5890
12.52
77.60
2.10
3.00
20.00
35.00
24.10
2.13
5.34
3.34
6.25
with Patch Attack,
Clean Ausunac
Ciran1
0.35
0.15
0.25
0.45
63.98
66.77
60.31
51.23
+: 181
+ 7.16
5.17
1:37
86.86
85.25
85.22
1:94
2:133
2 0.12
0.19
0.58
61.00
K2.02
61.75
2,53
+ 025
1: 0.5
0.20
0.2
K2.06
75.57
73663
17.50
0.75
0.16
1.03
1.66
58.00 2
80.25
75.10
78.22
12.55
0:43
0.56
09.52
60.23
17.35
50.00
# 2:38
2.76
48
69
77.70
58.88
14:00
2.76
3.78
3.46
55
55.20
54.73
1.88
+ 0.26
2 006
0.37
90.34
76.75
79
79
0.15
0:27
0.37
0.16
90.40
80.32
72.01
24.01
- 0.34
: 0:31
0.26
0.15
Poison Accraay
Ciaa1l
Blend Atack
0.35
47.84
56,98
65,15
0.94
0.72
200
1,36
2.17
20003
10.01
6.77
6.41
5.28
52.36
74.77
50.79
2.00
2.29
0.10
34:38
66.87
70.74
75.40
0.34
0.35
0.36
0.28
with Blend Attack.
Clean Accurac
Ciadd0
0.15 66.14 0.8
0.35 5300 +: 13.26
0.25 58,91 5.70
0.45 38.03 + 15.42 84.36 0.58
$4.95 0.30
85.54
84.72
0.58
0.58
51.44
50.03
50.89
60.35
+ 0.39
+ 0.5
0.88
0.5
71.51
66.21
71,43
55.78
118-:200 2.09
1.35
1.40
1:20
80.05
77382
57.17
74.34
9.00
0.26
1.01
67.86
00.52
49.48
26.251
8 2.19
226
2.58
2.28
05.08
60.15
46.74
0.52
2.39
3.11
0.71
85 06.28-2
54.72
55.06
$4.00
0.25
0.34
0.17
0.39
78.28
79.32
76.70
59.53
0.15
0.17
0.26
0.34
81.23
81
76.03
62.53
0.26
0.19
0:37
0.29
Table 1: Performance on CIFARI0 10. is the corruption rate.
4.4 How TO CHOOSE THE NOISY LABEL ALGORITHM
One key question regarding our framework is how to choose the noisy label algorithm. In practice, we found PRL gives consistent robustness against both badnet and blending attacks on different settings. This might be because PRL is designed for agnostic corrupted supervision, which is suitable for variety of noisy label attack types.
From a theoretical view, analyzing how different noisy label algorithms minimize the first term of RHS in Eq. deppends on the noisy label algorithm used. Here we present a high-level analysis for PRI.. PRL guarantees convergence the e-approximated stationary point, where is the corrupted ratio. Formally, we have the following proposition:
Proposition 2. Given the assumptions used in Theorem 1 assume the objective function ow = L f Li-Lichchitz smooth and satisfying the PL condition VV 2 μ(ów 2w') Then, with the assumption of bounded operator norm of gradient before loss layer, we have with probability at least 1-8, by applying PRL-AT, we have:
R₂ S S455 + 2o)2))
The proof is in the Appendix. In general, considering ó is a deep neural network, the first term is more difficult analyze without further assumptions (i.e. PL condition). Nevertheless, empirical study shows that many noisy label algorithms can effectively minimize the first term, noisy lahel loss, even though some of them have thcoretical guarantees while do not. This motivates us to treat these algorithms as black-box algorithms.
5 EXPERIMENT
We perform experiments on 10, CIFARI00, and STL10 benchmark data to validate our approach. We use ResNet-32 He et al. 2016) as the backbone network structure for the experiments. We also use AdamW (Loshchilov & Hutter 2017) with initial learning rate as 3e-4 as the optimizer for all methods. The batchsize is 128 for all methods. The evaluation metric is the top-1 accuracy for both clean testing data and testing data with backdoor trigger.
7

---

Under review as a conference paper at ICLR 2023
Table 2: Accuracy on CIFARIO in semi-supervised setting. <s the corruption rate.
Backdoor Attack Defense Accuracy,
CIFARIO CIEARI00
STL10 -> CIFARIO
Dataset
e
Standard
PRI-AT
PRI-SSmCT.R
PRI-SimCTR-SN
PRI-SimCLR PRI-SImCTR-SN
0.15
26.66 0.07
64.43
8.37
83.72 0.04
82.99 0.05
80.73 1: 0.06
82.96 0.05
Patch Attack,
0.25 5.67 0,02
26,91 #0.05
80.78 0.12
78.07 0.08
77.92 0.23
Poison Accuracy
0.35
5.20 0.13
55.53 0.60
36.12 = 0.06
77.90
26.91 + 0.14
45.99 +
0,45 5.28
0.24
0.33 46.46
16.97 + 1.04
1: 0.31
45,40 +: 0.25
45.39 :: 0.31
0.15 67.16 + 0.09
64.44
0.21
83.65 +: 0.03
83.08 + 0.05
80.79 + 0.05
83.01 0.04
Patch Attack,
0.25 67.34 + 0.07
60.92
= 0.27
81,54
0.42
80.95 0.13
78.14 1: 0.09
78.05 0.31
Clean Accuracy
0.35
655.44 + 0.17
55.62 0.47
79.17
0.41
0.22
71.87 0.16
63.99 0.25
0.45
63.70 + 0.13
46.48 0.34
73.97
1.02
72.93
45.36 +: 0.22
45.41 + 0.29
0.15 6.55 0.05
64.22 = 0.26
82.83
0.43
81.96
79.82 0.08
83.82 0.08
Blend Attack.
0,25
5,44 + 0,07
59.88 0.98
81.22 + 0.59
80.21 0.11
77.34 0.15
82.33 + 0.18
Poison Accuracy
0,35
4.56 + 0.14
$2.66 = 2.02
78.18 = 1.71
77.47 0.22
72.70 0.19
80.31 + 0.23
0.45 4.82
0.27
35.62 = 0.92
69.81
2.19
71.45 0.39
47.36 + 0.23
76.03 0.29
0.15 69.46 + 0.04
63.60
0.29
83.43 - 0.65
82.62
80.64
84,50 0.08
Blend Attack,
0.25 68.02
+ 0.05
54.54
0.31
81.80 0.36
80.76
78.09 0.13
81.09 0.16
Clean Accuracy
0.35 66.64
1 0.08
54.54
0.41
78.70 0.80
0.23
71.92 0.18
82.99 0.24
0.45 65.34 + 0.12
40.25
1.13
71.13 = 1.37
72.51 0
47.93 + 0.23
75.23 + 0.26
For backdoor attacks, we use simple badnet attack (Gu et al. 2017) and Gaussian blending at- tack (Chen et al.] (207)), since these two attacks do not require any information about the model or trainin procedure (Pang et al. 2020). Examples of the poisoned samples can be found in the Appendix. We deploy the multi-target backdoor attack in this paper and provided the discussion about single-target attack and clean label attack in the appendíx. Our data poisoning approach is as follows: we first systematically flip the label to perform a label-fipping attack. We then add triggers to the features associated with the attacked samples. Without adding the trigger, the problem would have reduced the noisy label problem.
We use the following two evaluation metrics: (1) top-1 clean accuracy, which is calculated from the clean test examples without any triggers and (2) top-1 poison accuracy, which is calculated by comparing the predicted class of the poisoned test examples against their ground truth clean labels. The first metric evaluates how well the model performs on benign (uncorrupted) data while the second metric assesses how well the model performs on the corrupted data. We vary the training data poisoning rate as 115,, 25% 35,, 45%] to investigate how the algorithms perform for different corruption ratios. All the methods are trained for 100 epochs, Furthermore, we assume there is no clean validation data available. Thus, it is difficult to perform early stopping or decide which epoch result to use. We report the average accuracy across the last 10 epochs for each method.
We study three noisy label algorithms by comparing the performance of the original and reinforced methods. Specifically, we choose SPL,, PRL, and Bootstrap our original noisy label algorithm and denote their corresponding reinforced algorithm with adversarial training as SPL-AT, PRL-AT, BoT We also compare our method against adversarial training only (AT), which uses adversarial training without a noisy label algorithm. To measure the success of the attack, we also include the Standard training (i.e. no defense) results.
We also evaluate the performance of other backdoor defense algorithms. Note that large fraction of them are either designed for single target attacks (Liu et al., 2018) or require clean data (Liu) ct al. 2018 Wang et al. 2019 Li al. 202T). In this paper, we compare our framework against the following two baselines: (1) spectral signature (Tran et al. 2018): which filters the data by examining the score of projecting to singular vector, and (2) pru-ing (Liu et al.. 2018), which prunes the model by deleting non-activated neurons. Note this method uses 5% clean training data.
How well do existing robust noisy label algorithms defend against backdoor attacks? To answer this, we evaluate the performance of PRI., SPI., and Bootstrap on the CIFARIO and CIFARIOR 100 datasets. The results of CIFARIO
given in Table and the results of CIFAR 100 given in the Tables 5 in Appendix due to the limited space. Observe that the existing algorithms perform well on the benign testing data (i.e. high clean accuracy) but poorly on the corrupted data (i.e. low poison accuracy) especially when the corruption ratio is high. This suggests the ability of backdoor attacks to compromise the defense mechanism of existing robust noisy label algorithms.
How adversarial training improves noisy label algorithms? To investigate whether adversarial training enhance the robustness of existing noisy label algorithms against backdoor attacks,
8

---

Under review as a conference paper at ICLR 2023
Table 3: Sensitivity analysis of and 7. Average top-1 accuracy across three random seeds. The first number is the clean accuracy while the second number is the poisoned accuracy. The hyperparameter e is fixed be 0.5 while the ground truth is varied. The sensitivity analysis for the adversarial budget r is conducted by fix both estimated c and ground-truth as 0.25
c
PRL-AT (patch)
PRL-AT (blend)
r
PRL-AT (patch)
PRL-AT (blend)
0.15
68. 14/68.00
67.97/68.45
0.01
73.34/3.00
73.15/22.13 13
0.25
71.78/71.74
17.78771.87
0.05
78.87/78.52
77.28/77.14
0.35
74.26/74.15
74.17/74.32
0.1
76.03/75.24
65.23/65.02
0.45
69.91/27.02
64.78/54.19
0.5
46.82/46.41
50.82/50.21
evaluate the performance of our proposed reinforced algorithms, SPL-AT, PRL-AT and Bootstrap-AT, on both the clean and corrupted test examples. The results shown in Tables] | and suggest that the performance of the reinforced noisy label algorithms on the triggered data is largely boosted, with significant improvement in the poison accuracy. The improvement is observed for all three noisy label algorithms, which indicates the effecctivnness of the proposed method on improving the robustness of the existing algorithms against backdoor attacks. Also, compared to adversarial training only (AT), adding noisy labels does indeed improve the performance, particularly, when comparing PRL-AT to AT. We also found that compared to consistency- based noisy-label algorithm (i.e., Bootstrap), the filtering based algorithms (i.e., SPL and PRL) are more easier to be boosted by adversarial training. The potential reason behind this could be that the filtering- based methods are more efficient compared to consistency-baat baaed algorithms Han et al. (2018;; Jiang et al. (017): Liu et al. (202I). Finally, we observe that PRL-AT has higher poisoned accuracy compared to spectral signature and fine- fine-pruning under most settings while its clean accuracy is still high, which indicates the advantage of PRL-AT. For high corruption ratio, the robustness of spectral signature and fine-pruning significantly decreases while PRL-AT still gives reasonable poison accuracy.
Semi-supervised learning. We evaluate our algorithm on backdoored CIFAR 10 data with CIFARI00 or STL10 (unlabeled part) as augmented data. For the semi-supervised setting, we only use 20% backdoored data as labeled training data (i.e. in backdoored CIFARIO, when 7500 clean labeled images, 2500 backdoored images, and clean augmented data without label). To investigate the advantage of decoupling the Lipschitz constant of the objective function and to determine whether semi-supervised learning helps improve robustness, we compare standard training, PRI-SimCLR (i.e. algorithm 2
0.2, we have
with PRL the noisy label algorithm without spectral
normalization), PRL-SimCLR-SN (i.e. algorithm 2 with PRL as the noisy label algorithm) and PRL-AT. The results are given in Table 2 We see that PRL-AT provides consistent robustness against both patch and blending backdoor attacks. When utilizing more data, both PRL-SimCLR and PRI.-SiMCLRRSS can achieve improved performance for the blending attack. For the patch attack, PRI-SSmCLR and PRL-SimCLR-STI show robustness when the corruption ratio is small. For large corruption ratio, PRL-SimCLR fails to achieve its robustness against patch attack while PRL-SimCLR-SN still maintains good performance, which indicates the necessity of adding spectral normalization to regularize the maximum singular value of the last layer.
Ablation study for and Since the degree of corruption is often unknown, we hereby investigate how well our algorithm performs without knowing the true corruption ratio. Specifically, we provide the worst-case result by setting e = 0.5 for our algorithm regardless of the ground truth e. We choose this as it would be impossible to learn a reasonable classifier when the corruption ratio is more than 0.5. We evaluate the performance of PRL-AT on CIFARIO for both badnet and blending attacks. The results in Table 3 suggest that our algorithm is still robust despite using the overes-vveest e when compared to the standard training results in Table [ budget since neither do we know the ground-truth in practice. We see that increasing T makes the model more robust while when T is too large, the clean accuracy significantly drops. This suggests a large adversarial training budget is preferred to defend against backdoor attacks, which is consistent with reported findings (Gao et al.] (2021). Besides and t, in appendix we present additional ablation studies of the maximizaimnziionnn and minimizaiiiii...nn...
We also vary the adversarial training
6 CONCLUSION
In this paper, we investigate the connection between noisy label attack and backdoor data poisoning attack. We show that although existing robust noisy label algorithms cannot effectively defend against backdoor data poisoning attacks, adding adversarial training on the existing algorithm could largely improve its robustness against backdoor attacks. Both theoretical and empirical analysis have validated the effectiveness of our proposed meta algorithm.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Yoshua Bengio, Jéröme Louradour, Ronan Collobert, and Jason Weston. Curriculum learning. In Proceedings of the 26th anmual international conference on machine learning, pp. 41 41-48, 2009.
Bryant Chen, Wilka Carvalho, Nathalic Baracaldo, Heiko Ludwig. Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering, arXiv preprint arXiv: 1.307228,, 2018.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv: 04800,, 2018.
Ming-Wei
John C Duchi and Hongseok Namkoong. Learning models with uniform performance via distribu- tionally robust optimization. The Annals of Statistics, 49(3):1378-1406, 2021.
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-awar minimization for efficiently improving generalization. arXiv preprint arXiv:2010.01412, 2020.
Yinghua Gao, Dongxian Wu, Jingfeng Zhang, Shu-Tao Xia, Gang Niu, and Masashi Sugiyama. Does adversarial robustness really imply backdoor vulnerability? 2021.
Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. What doesn't t kill you makes you robust (er): Adversarial training against poisons and backdoors. arXiv preprint arXiv: 102. 202.0022..00 13624, 2021.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 1121::14 2014.
Tianyu Gu, Brendan Dolan-Gavite and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.0673 2017.
Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. Co-teaching: Robust training of deep neural networks with extremely noisy labels. In Advances in neural information processing systems, pp. 8527-8537, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pullern recognition, pp. 770-778, 2016.
Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. Mentornet: Learning data-driven curriculum for very deep neural networks on corrupted labels. arXiv preprint 2017.
Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. Mentornet: Learning data- driven curriculum for very deep neural networks on corrupted labels. In International Conference on Machine Learning. pp. 2304-2313, 2018.
Lu Jiang, Di Huang, Mason Liu, and Weilong Yang. Beyond synthetic noise: Deep learning on controlled noisy labels. In International Conference on Machine Learning, pp. 4804 4815. PMLR. 2020.
Alex Krizhevsky, llya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep con- volutional neural networks. Advances in neural information processing systems, 15:1097-1105, 2012.
M Pawan Kumar, Benjamin Packer, and Daphne Koller. Self-paced learning for latent variable models. In Advances in neural information processing systems, pp. 1189-1197, 2010.
10

---

Under review as a conference paper at ICLR 2023
Alexander Levine and Soheil Feizi. Deep partition aggregation: Provable defense against general poisoning attacks. arXiv preprint arXiv:2006.14768, 2020.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distil- lation: Erasing backdoor triggers from deep neural networks. arXiv preprint arXiv:2101.05930 2021.
Yuncheng Li, Jianchao Yang, Yale Song, Liangliang Cao, Jiebo Luo, and Li-Jia Li. Learning from noisy labels with distillation. In Proceedings of the IEEE International Conference on Computer Vision, pp. 1910-1918, 2017.
Boyang Liu, Mengying Sun, Ding Wang, Pang-Ning Tan, and Jiayu Zhou. Learning deep neural networks under agnostic corrupted supervision. arXiv preprint arXiv:2102.0673 2021.
Kang Liu, Brendan Dolan-Gavite and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273-294. Springer, 2018.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack deep neural networks. In European Conference Computer Vision, pp. 182-199. Springer, 2020.
llya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 2017.
Bence Major, Daniel Fontijne, Amin Ansari, Ravi Teja Sukhavasi, Radhika Gowaikar, Michael Hamilton, Sean Lee, Slawomir Grzechnik, and Sundar Subramanian. Vchicle detection with automotive radar using deep learning on range-azimuth-oopple tensors. In Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0-0, 2019.
David A McAllester. Pac-bayesian model averaging. In Proceedings of the twelfth annual conference Computational learning theory, pp. 164-170, 1999.
Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. arXiv preprint arXiv: /80200500 2018:
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: regularization method for supervised and semi-supervised learning. JEEE transactions on pattern analysis and machine intelligence, 1179):1979-1993 2018b.
Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. Trojanzoo: Everything you wanted to know about neural backdoors (but were afraid to ask). arXiv preprint arXiv:2012.09302, 2020.
Giorgio Patrini, Alessandro Rozza, Aditya Krishna Menon, Richard Nock, and Lizhen Qu Making deep neural networks robust to label noise: A loss correction approach. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp- 1944-1952, 2017.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Semidefinite relaxations for certifying robustness to adversarial examples. arXiv preprint 1rXiv:1811.01057. 2018
Scott Reed, Honglak Lee, Dragomir Anguelov, Christian Szegedy, Dumitru Erhan, and Andrew Rabinovich. Training deep neural networks on noisy labels with bootstrapping. arXiv preprint arXiv: 141.,594 2014.
Hadi Salman, Greg Yang, Jerry Li, Pengchuan Zhang, Huan Zhang, llya Razenshteyn, and Sebastien Bubeck. Provably robust deep learning via adversarially trained smoothed classifiers. arXiv preprint arXiv: 04584. 2019.
Ali Shafahi, W Ronny Huang. Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks neural networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp. 6106-61 16, 2018.
11

---

Under review as a conference paper at ICLR 2023
Dávid Terjék. Adversarial lipschitz regularization. In International Conference Learning Repre- sentations, 2019.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. arXiv preprint arXiv:1811.00636 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Maurice Weber, Xiaojun Xu, Bojan Karlas, Ce Zhang, and Bo Li. Rab: Provable robustness against backdoor attacks. arXiv preprint arXiv:2003.08900 2020.
Cheng-Hsio -sin Weng. Yan-Ting Lee, and Shan Shan-Hung Brandon Wu. On the trade-off between adversarial and backdoor robustness. Advances in Neural Information Processing Systems, 18:11193--1999 2020.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference Machine Learning, pp. 2018.
PMLR,
Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2041-2055, 2019.
Kun Yi and Jianxin Wu. Probabilistic end-to-end noise correction for learning with noisy labels. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 7017-7025, 2019.
Xingrui Yu, Bo Han, Jiangchao Yao, Gang Niu, Ivor Tsang, and Masashi Sugiyama. How does disagreement help generalization against label corruption? In International Conference on Machine Learning, pp.
PMLR, 2019.
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. JEEE transactions on neural networks and learning systems, 30(9):2805-287) 2019.
12

---

Under review as a conference paper at ICLR 2023
A APPENDIX
In this section, we provided proof of theorem and more discussion.
A.1 PROOF OF INEQUALITY IN BQ. (3)
In this section we provide a formal proof of the inequality in Eqt. (3) in the main paper:
Σ
c)
1
Óx,(; + + CrL.
n xEX
XEXYEY
Proof. let G denote the initially clean sample set (i.e. (X, Y)), and B the corrupted sample set (i.e. the training set corrupted with trigger whereas the labels are untouched). Let R. denote the clean sample set which is replaced by the adversary (i.e. R. is the subset of g, and is replaced by B, i.e.
g' = G RUB B = (X', Y)), and let on denote the function L f.
One can decompose the inner part of our mini-max objective in Equation 2 as follows,
1
Σ
= Σ
(x, +c,y)
1 n2 ER
Σ
ow ow + c.y)
xEX.EEY
VEg'
1
Σ
(x + (.y)
di (x: + c.y)
+
S X5 + t +
Σ iEB
n
n
iER
iEB
1
(x +c,y)+
(x + +c,))
+xxxx+++tt))
n
xEX-yEY
iER
iEB
(
1
Σ
(x +c,y) +
(x + +c,y)
du + + +cyyy
n
xEX
iER
iEB
1
Σ
P +xx+ +T|||||
Σ
(x + c.y) cTL,
n
yEX
YEY
This concludes the proof.
A.2 PROOF OF THEOREM AND COROLLARY
Theorem 2. Let Remp, Remp R, defined as above. Assume the prior distribution of the network parameter w is (0, and the posterior distribution of parameter is (Ww, о) is the posterior parameter distribution, where w learned according to training data. Let le to be the number of parameters, to be the sample size, assume the objective function ow L o f is liplichhii smooth, then, with probability least 1-8, we have:
1 log
ko*
w
3
+
log + 2 log(6n + 3k)
R, < Remp (2T
7
Proof. we first decompose the gap as following
R₂- Remp -R; -R. R.mp) (R
-R. Romm) < (R: R: 1(R R!mP))
13

---

Under review as a conference paper at ICLR 2023
We bound the second part first.
Re
| R
1 -|
Σ
[o(x+tyy) cyy]+
Σ ,(x+tyy) Σ
o(x+
11 xEX,
xEX,,yEY,
XEXo,EE,
1
$ s-
Σ
10(x +t,y) o(x c.y) n xEX..YEY.
E d(x+t,y)
E
o(x c,yll
n
yEY,
xEX,NEEY
$ 4 cl + +bbpll c|l + Ls max xx.Xi
$ (1 L) ccl +cL.ol cll c |||
Lollt - cl + +chplttll
T,22 + <
< (2T + eT)
Now, we bound the second term. Note the second term is a typical gap term between empirical loss and generalization loss, and there many approaches to bound this term like VC dimension. Since we aimed to focus the deep neural network, we follow the PAC-Bayes framework McAllester (1999) analyze the generalization bound. Specifically, we use results from Foret al. 2020)) which gives
log
log 3 1og(6n-+33))
under the assumption of gaussian prior and posterior. The
proof for this can be found in the appendix of Foret et al. (2020) (i.e. equation 13 on the paper).
As for the corollary[] [T the proof is straightforward. By decomposing the Lipschitz constant of the loss function to the Lipschitz constant of representation network, last linear layer, and cross-entropy loss, respectively. Since the cross-entropy loss gradient is |!ý - yl|, where y is one-hot vector and is a probability vector. Thus, the maximum gradient (i.e. Lipschitz constant) is v2. As for the linear layer, according to the definition of the operator norm, the Lipschitz constant is exactly the maximum singular value of that linear layer. This concludes the proof.
A.3 PROOF OF PROPOSITION 2
We first introduct the property of PRL in the following corollary:
Corollary 1 (Convergence of PRL clean objective (Liu et al. 2021
Assuming the maximum
clean gradient before loss layer has bounded operator norm: W op I C, applying PRL to any e-fraction supervision corrupted data, yields minee E
((e//) for large enough
T, where is the dimension of the supervision.
Details can found in Liu et al. (20TT) According to above corollary, let wPrL is the solution get by PRL algorithm, we can have V "wrre Remp OEe) (i.e. assume q is small). With Polyak-
Lojasiewiez (PL. condition with some constant f such that /V(()]l 2 p(f(x) fr) holds, we
S IV VwrRI Remple O(c). For nighty-overparameteriin deep neural network, the global optima Rempt is usually 0. Thus, we can conclude that with PL condition, using PRL as the noisy label algorithm in our framework can guarantee Remp can minimized to the order O(c).
have (<Remp R. ppmp
A.4 NOISY LABEL ALGORITHM
The details of PRL, SPL, and Bootstrap is showed in table We would like to highlight that many other potential noisy label algorithms be applied to framework and it is important to further investigate them. We leave a more comprehensive exploration noisy label algorithms as future work.
14

---

Under review as a conference paper at ICLR 2023
Mini-batch
PRL
Keep data with small loss-layer gradient norm and perform back- propaaaopattiion
SPL
Keep data with small loss and perform back-propagation
Bootstrap
change the label by using Utrue
Offtrue
(1 Ox Opred and perform back-propagation
Table 4: Overview of noisy-label defending algorithms, which achieve robustness against up to 45% of pairwise flipping label noises.
A.5 EXPERIMENT RESULTS FOR CIFAR 100
The experiment results for CIFAR 100 is in Table 5 CIFARIO 10 experiment result.
As we can see, the pattern is consistent with the
Backdoor Attack Defenee Aemrrayy
Dainect
AT'
BusaStrap
Ausestap-AT
PRI
PRLAY
SPL-AT
Standard
Fine-Puning
SpecSig
23.70
5:23
46.74
47.11
+
with Patch Altick.
Poison Accuncy
0.45
21:34
13:61
17.16
0.74
10.00
2,85
3.02
1
0.12
10.49
31.21
4609
40.14
0:30
2083
17.53
23.98
1003
9:32
29,76
43.81
39.66
1.11
7:26
1.766
2841
20.43
1.09
10.11
1
0.60
1.04
11.21
13000 25:0=
32.35
0.12
0.04
33.82
29.07
1633
0.43
0.18
0.15
34.08
0
0.40
52.39
+ 0.38
47.76
+ 014
50,50
0.41
47.21
0.56
46.38
+
041
42.38
0.73
52.42
+
0.59
43.42
0.12
44:33
+ 0.16
with Patch Attckk.
Clean Accuncy
0.25
23.03
29.50
31.72
0:75
1.75
48.41
50.54
0.25
0.42
46.0
40.38
0.18
052
47.49
44.21
1
0.21
0.91
43.89
0:35
99.98
1
1,00
0.80
20.55
35
50.53
48.75
133---0555 0.55
0.71
41.11
0.03
29.23
39.64
1: 0.25
1: 0.39
with Blend Attack.
Poison Anauney
CIPAR100
0,35
0.45
0.15 33:05
0.25
27.30
20.79 4.97
30.5
0.45
0.4.2
0.54
2.19
0:99
1.17
1,05
+ 0.07
+ 1006
1. 0.08
1 0.28
13.61
46.65
31.58
41
+ 1.07
+ 1.26
033
0.99
2.68
2.10
L.51
LA45
1 0:43
= 1.17
= 0.17
0.21
22
34.51
41.78
46.01
00.00-0
0.50
0.76
1.60
1.98
614
2.00
2.95
3.99
0.17
0.56
0.49
1.12
25.71
41.57
33.54
18
= 1.21
2.31
1 1.76
0.74
2.09
0.22
1.12
1.08
: 0.11
1 0.20
+ 0.16
0.20
19.09
8:80
8:13
6.12
: 002
+ 0.05
0.32
0.65
35.64
27.13
33.61
18.35
0 0.1.7
0.93
1.036
0.0.4
C1ARR00
Blend Atrak.
33,65
34.22 0.58
51.12
52.65
0.19
44.75
47.77
0.36
48.61
0.38
42.87
46,92
0.47
46.01
0,40
42.40
0.70
$0.98
52.60
0.59
41.11=000
43.30
0.11 45.54 1: 0.16
0.34
Accminy
26.14
22.03
49380
34.78
40.85
40:46
24.71
38
1,40
32.13
19:40
Table 5: Performance on CIFAR 100. c is the corruption rate.
A.6 DISCUSSION ABOUT CLEAN LABEL ATTACK AND SINGLE TARGET BACKDOOR ATTACK
In this section, provide further discussion about clean label attack and single target backdoor attack. Thus, we will discuss these two types of attack separately.
A.6.1 CLEAN LABEL ATTACKS
One interesting question Can our framework defend against clean label (CI.) attack? In short, yes. By reviewing our bound in [ we have:
R₂ S Remp + (2T +.
The impact of clean label attack that now the first term Remp becomes the clean empirical loss without noisy label. Thus, if we can control the lipschitz constant, then the classifier should be robust to backdoor attack. This makes sense since a classifier with small lipschitz constant should not change prediction results given small perturbations (i.e. adding trigger). Thus, thcorem suggests that using adversarial training is enough to defend against clean label backdoor attack. This conclusion seems to be contradict with the previous study in (Weng al. 2020). However, there further recent study shows that adversarial training does improve the robustness against the backdoor attack as long as we give enough adversarial training budget (Gao et al. 2021 [ et al. (021). To the best of our knowledge, the CL attack cannot be applied to multi multi-target backdoor attack in our experiment setting. We therefore tried adversarial training (AT) on single target CL attack, and adversarial training achieves 88/84 clean/poison accuracy with 500 poisoned image in CIFARIO 10, which consistent with previous study (Gao et al.] 2021]] Geiping et al., 202T). We provide the following explanation. The naive CL method in the original CL paper (Tumer et. al. 2017) directly adds a trigger to the target class. Such approach may easily fail since the model can easily classify the clean image without using trigger. Adding adversarial attack on the original image makes the classification harder and therefore the learned model tends to pick up the trigger, leading to more effective attacks. More details can be found in section 4 of the original CL paper. In our framework, we train the network using adversarial training, which will make the model robust to the adversarial attack, thus reducing the proposed CL. attack to the naive CL. attack.
15

---

Under review as a conference paper at ICLR 2023
A.6.2 SINGLE TARGET ATTACK
Now, we discuss the single target attack, which is one of the most popular backdoor attack mechanisms. Unlike our experiment setting, single target attacks choose one target class and add small amounts of poisoned data to attack the model. Previous studies also show that adversarial training alone can achieve robustness against single target backdoor attacks (Gao et al., 202T; Geiping et al. (02T). Thus, it is also interesting to investigate whether our framework can defend the single-target attacks. We also start by reviewing our bound below:
R. S R.m + (2T +T.
+
(8)
One of the most important differences between the single-targe attack and multi-target attacks is that the corruption ratio e of the single target is much smaller than the aulli-target attacks. For example, in our setting, the corruption ratio varies from 0.15 to 0.45 while for most typical single target backdoor attack, the number of injected corrupted images are very small (i.e. less than 500, which is approximately 0.01 corruption ratio in CIFARIO), Thus, it is necessary to investigate how affects the first two terms. As we can see, due to the backdoor attack setting, the Lipschitz constant would be extremely large since similar images have different labels (i.e. same image before/after injecting the trigger). Thus, although e is small, the second term could still be large due to the large Lipschitz constant. The key difference between multi-targe target attack and single-targ target attack is the first term. In the single-target attacks with small 6, we claim that using noisy label algorithm is not as important using it in multi-target attack settings. This is because most noisy-label attacks, only flipping an extremely small amount of the data label cannot decrease the model performance significantly. According our best knowledge, almost all robust learning against noisy label algorithms studies the scenario when the corrupted rate of the label is at least 0.15. Thus, the first term will be still small without using any noisy label algorithm due to small which explained why only using adversarial training with enough budget can defend against the single target backdoor attack (Gao et al. 2021 Geiping et al. 2021).
observed that in
A.7 ABLATION STUDY OF INNER MAXIMIZATION AND OUTER MINIMIZATION
In this section, we aim to explore more about the proposed framework. Since our algorithm use the noisy-label solver for both inner and outer optimization. A interesting question to ask is that whether both inner and outer noisy-label solver plays an important role in defense the backdoor attack. Thus, we have two variants. One is we only use noisy label algorithm to update the model for outer minimization and another one we only use the noisy label algorithm to update the model for inner maximization. The results can be found at table O and table 7 in the appendix. As we could see in these two tables, using noisy label algorithm to perform the inner maximization is more important compared to using noisy label algorithm to perform out minimization.
Backdoor Attack Defense Accuracy.
Datasel
BootStrap inner
Boutstrup outer
PRL inner
PRL-outer
SPL-inner
SPL-outer
0.15
3.15
0.6l
3.20 : 0.63
80.78
+ 0.31
2.84
: 0.23
65.50
16.22
3.09 = 0.33
CIFAR10 with Patch Attack,
0.25
2.74
0.10
2.73 + 0.09
79:07
0.20
2.50
4: 0.10
18.95 9.91
2.58 0.19
Poison Accuracy
0.35
2.70
+ 0.24
2.67 0.15
76.06
+ 0.37
2.39
+ 0.26
13:45
+ 5.40
2.38 2: 0.14
0.45
2.32
0.08
+
2.63
2.24 1
12.10 4.46
2.23 0.26
0.15
82.58
= 0.33
82.45 +
80.86
+ 0.31
83.09
0.12
76.48 + 3.03
83.02 + 0.49
CIFAR10 with Patch Attack,
0,25
82,14
0.28
81.87
0.23
79.10
+ 0.17
83.13
+ 0.21
69.33 + 2.57
83,30 + 0.13
Clean Accuracy
0.35
81.71
1 0.46
81.55
0.54
1. 0.54
76.08
1 0.34
82.83
1 0.38
59.76 1. 3.59
83.05
1 0.38
0.45
0616 81.53
81.00 0.47
0.37 69.96
82.78
+ 0.18
0.53 49.31
82.84
0.27
0.15
29.85
10.65
40.79
13.27
0.15
46.29 1. 18.09
6.14
48.21
14,90
CIFAR10 10 with Blend Attack,
0.25
14.81
+ 10.42
27.57 + 10.93
78.44
+ 0.19
27.34
+ 18.42
54,46 + 10.45
21.18 + 11.85
Poison Accuracy
0.35
6.52
3,80
17.41 1. 10.13
71.93
1: 2.69
11.25
1: 5.92
46.12 1. 13.77
14.58
1: 7.12
0.45
11.58
14.94
9.01 1 4.66
2.74 64.98
5.90 + 2.28
5.85 42,30
5.16
1.64
0.15
81.54
81.18
4. 0.75
0.18
82.51 0.36
82.35 0.22
CIFAR 10 with Blend Attack,
0.25
80.99
1.12
80.37 0.94
78.23
1: 0.46
82.35
0.65
66.64 J. 2.31
82, + 0.37
Clean Accuracy
0.35
81.04
0.81
79.54
1.32
71.62
2.65
82.55 0.47
$7.44 + 1.78
81.81 + 1.00
0.45
81.06
0.25
78.93
0.84
62.34 + 2.51
82.15 0.48
48.82
0.94
81.81 + 1.06
Table 6: Ablation study on CIFAR 10. is the corruption rate.
16

---

Under review as a conference paper at ICLR 2023
Backdoor Attack Defense Accuracy.
Dataset
BootStrap-imner
Beotstrap-outer
PRL-inner
PRL-outer
SPL-inner
SPL-outer
2.65
41.66
8.37
44.32 -
43.05
0.39
6.36
CIFAR100 with Patch Attack,
0.25
44.41 + 1.55
43.65
0.88
44.71 + 0.40
41.13 - 5.82
35.69 + 1.05
41.81
3.89
Poison Accuracy
0.35
40.02 0.19
38.72 0.60
40.19 + 0.39
38.75
+ 0.60
24.98
6.34
38.97
1.10
0.45
31.12
0.40
29.46
0.33
31.49
1 1.04
29.74
1: 0.35
20.13
1: 1.80
30.19
0.31
48.01
0.21
48.41
43.29
0.21
0.36
CIFARIO0 with Patch Attack,
0.25
45.27
1. 0.82
44.68
1: 0.27
44.83
1 0.38
45.58
1 0.39
36.21
1. 0.80
45.14
0.64
Clean Accuracy
0.35
40.49
0.23
38.98
0.47
40,40 + 0.41
39.46
+: 0.30
29.58
1.49
39.89
0.50
0.45
31.32
0.48
29.81
0.34
31.49
1.02
30.39
1 0.27
20.70
1.51
0.55 30.77
46.72
0.23
42.15
0.70
CIFARIOD with Blend Attack,
0.25
41.64 1: 1.54
40.60 1: 0.98
43.43 1 0.59
40.02 1: 1.44
34.10
1.60
39,30
3.16
Poison Accuracy
25.36
2.65
0.45
22.98 + 1,18
23.37
0.92
24.60 + 2.19
22.16
3.73
19.57 + 1.64
24.17
2.70
0.15
48.05
0.33
47.83 0.29
47.24 1: 0.65
48.43 1: 0.44
42.94 4: 0.55
48.37
0.68
CIPAR 100 with Blend Attack,
0,25
44.85 + 0.52
44.59 + 0.31
44.17 + 0.36
45.19
0.26
36
1.20
45.06
0.18
Clean Accuracy 0.45
40.80
30.23
1.25
0.69
35.32 # 1.77
34.13 1 1.13
27.33 + 1.37
39.06 + 0.5
24.22 + 1.66
38.62
1.30
Table 7: Ablation study on CIFAR100. e is the corruption rate.
(a) clean data
(b) two samples are added with small trigger and flipped label
(c) Inner maximization by noisy label algorithm
(d) Reduce the backdoor attack label flipping attack
Figure 1: Illustration of our meta algorithm. By combining the minimax objective and noisy label algorithm, we could reduce backdoor attack problem to label flipping attack. The left most is the clean original data. The second shows corrupted samples. The third figure shows the inner maximization step while the last figure shows the outer minimization step.
A.8 DISCUSSION ABOUT LIPSCHITZ REGULARIZATION AND ADVERSARIAL TRAINING
As seen from the above theorem that small Lipschitz constant could bring robustness against backdoor attack. In this section, we elaborate why we claim adversarial training helps Lipschitz regularization. The definition of Lipschitz function is [x) f(y)l < L[[x-y] y. Since the Lipschitz constant shows in the upper bound of the error, we would like to get the minimum Lipschitz constant to tighten the bound. Follow (Terjék 2019), the minimum Lipschitz constant can be written as:
(f(r),
||/|
sup x.yexaayy
dx (x(xx,)) v)
Rewrite y as x + c, we get:
dy (f(x) dx (x +r)
||
sup x.
Minimizing the above objective respect to function f reduces to the adversarial learning:
dy f(x))))((xtt))
inf llfllr. inf sup
dx (x(xxx+c)
x
we treat the denominator as a constant, then this is exactly the same as our minimax objective. More details can be found in (Terjek 2019
17

---

Under review as a conference paper at ICLR 2023
0-
0-
5
10
10
15
15
20
25
25
30
30
30
10
20
30 (b) badnet attack
20
(a) clean example
(c) blend attack
Figure 2: Example of clean and various poisoned samples patch attack: trigger is a 3 x whick-white checkerboard and it is added to the right bottom corner of the image. blending attack: trigger is a fixed Gaussian noise which has the same dimension as the image. The corrupted image generated by x (1 x)x; at. In experiment, we set the a as 0.1.
A.9 SUPPLEMENTARY EXPERIMENT RESULTS
We provided the experiment hyperparameters, and supplementary results for the experiment. We provided the code the supplementary materials.
A.9.1 EXPERIMENT HYPERPARAMETERS
We list the details of experiment in this section. All the methods use Resnet-32 the backbone network. AdamW is used as the optimizer for all methods. The perturbation limit r is set to be 0.05 for all methods requiring т. All methods are repeated for three different random seeds to calculate the standard deviation. For the SimCLR, we train the network by 500 epochs.
The trigger for badnet attack and blending attack can be found in figure 2
A.9.2 EXPERIMENT ON MNIST
Our experiments showed interesting results on MNIST. In MNIST, we found adversarial training itself
sometimes gives robustness to the backdoor attack. We hypothesize that this because that learning from MNIST is potentially an easier task than that from CIFAR. Here, we show the performance of adversarial training and PRL-AT on MNIST. The results can be found at Table
Backduor Attack Defense Accuracy.
Dalaset
AT
BoctStrap
Booistap-Al
PRL
PRI-AI
SPL
SPL-AT
0.15
0.30
B00 0.01
3.17
97.96
0.21
98.44
59.34
33.30
85.61
12.56
MNIST with Patch Atack, Poison Accuracy
0.25
0.26
à: 0.17
0.04 d: 0.02
0.17 :: 0.10
89.91
1: 7.53
97.04
4: 1.07
25.25
:: 1.38
30,70
6.62
0.10
0.14
77.91
10.41
0.45
0.11
: 0.01
0.04
:: 0.02
0.42 à: 0.34
43.42 :: 11.66
76.42
d: 8.65
12.85
:: 1.90
10.97
2.16
0.15
98.17
4: 0.69
99.49
0.05
95.48
1.56
98.08
0.26
98.44
4: 0.05
93.23 d: 4.72
97.74 0.37
MNIST with Patch Atrack,
0,25
98.59
+: 0.22
99.48
0.07
98.83
: 0.19
97 46
0.07
97.11
+ 1.06
86.98
:: 0.72
81.89
1.76
Clean Accuracy
94.48
4.87
98.45
0.32
0.46
97.86
73.09
77.49
0.45
98.27
1: 0.43
99.42
0.02
96-44
: 1.36
75.69
1: 0.99
92.32
+ 4.25
60.58 =: 1.90
57.20
0.37
0.15
63.42
+: 35.24
0.04 :: 0.01
96.66 +: 2.58
96.81
+ 1.30
96.74 :: 1.03
97.43 4: 0.13
96.16
0.19
MNIST with Blend Attack,
0.25
70.43
+ 28.61
0.04 = 000
97.83
: 0.1
77.68
: 201.4
97.30
- 0.66
6,43
1.27
83,86
2.74
Polson Accuracy
58.32
40.59
97.94
0.57
78.79
17.74
97.59
69.69
0.45
97.66 + 1.04
0.03 = 0.03
9%
2: 0.58
27.18 - 19.53
95.17
+ 1.83
4,49 =: 1.08
3.14 64.78
0.15
64.78 +: 33.81
44
0.02
99.29
0881
97.93
0.25
96.18
1.44
97.
0.22
95.93
0.20
MNIST with Blend Attack,
0.25
74.00
: 25.25
99.46
0.05
97.44
= 0.99
97.30
0.63
97.10
0.74
77.75
- 0.74
83.34
2811
Clean Accuracy
0.35
58
62
40.18
99.44
0.02
97.43
094
25
1.84
97.39
0.19
72.41 - 3,80
67.92 8.38
0.45
96.78
4: 1.42
99.42
0.06
97.89
: 0.61
76.47
8.66
95.07
+ 1.59
63.63 4. 4.47
63.82 4.12
Table 8: Performance on MNIST. e is the corruption rate.
18

---

Under review as a conference paper at ICLR 2023
(a) clean data for binary feature value and continuous feature value
(b) label flipping attack on both binary feature value and continuous feature value
Figure 3: Example of label flipping attacks both binary feature values and continuous feature values.
As seen for the MNIST, especially for the blend attack, the poison accuracy for adversarial training does show good performance with large standard deviation. This is because that some random seeds work while some random seeds failed. We hypothesize that this is because MNIST dataset has almost binary feature values. When adding small Gaussian noise feature z, the label flipping attack cannot change the decision boundary much. That is why the noisy label algorithm seems not important the noisy label algorithm in CIFAR dataset. We plot two dimensional toy example in figure 3 to illustrate label flipping attack on continuous features and binary features. As seen in the figure, for the binary-valued features, the label flipping attack is not easy to change the decision boundary too much, while can easily change the decision boundary in the continuous feature value scenario. However, this is very rough conjecture for the reason why MNIST, adversarial training sometimes works. We leave the investigation of this phenomenon in the future work.
19


Reviews:
[{"review_id": "lXoQKqfEtd", "reviewer": "Reviewer_APgi", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper explores defense strategies against backdoor poison attacks from a new perspective. Due to the similarity between noisy labels in dirty-label backdoor attack and noisy label corruptions problem. Also due to the boundedness of backdoor attack on feature perturbation. The authors expect to transfer the method of noisy label learning to defense against backdoor attacks. In this regard, the paper analyzes the rationality of method transfer theoretically, and proposes a meta-algorithm for method transfer. The experimental results show that the algorithm is effective in defending against backdoor attacks.", "summary_of_the_review": "The idea of this paper is interesting and the theoretical derivation is complete. The exploration of new perspectives on problem solving is exciting. However, the specific implementation of AT + Noisy Label Learning does not seem to be stable and cannot completely defeat the traditional backdoor attack defense. The paper only considers the test accuracy, and lacks some analysis and verification of the success rate of targeted backdoor attacks.", "strength_and_weaknesses": "Strength.\n1) It is interesting to solve the backdoor attack from the perspective of noisy label learning.\n\n2) The paper establishes the connection between noisy label learning and defense from a theoretical level, and finally converts it to a max-min optimization problem. It seems reasonable to design an algorithm on this basis.\n\n3) The paper is well written.\n\nWeaknesses.\n1) The experimental results show that the method proposed in the paper has some improvement over traditional defense methods, but it seems to be less stable. The use of AT enhances the generalization performance to poison, but it seems that the damage to clean accuracy is also significant.\n\n2) The paper claims that the framework's strength is in handling backdoor attacks with high corruption ratios, such as 45%. But from Table 1, 45% of Patch Attacks have destroyed the accuracy of \"Standard\", which has violated the original intention of backdoor attack and cannot be called backdoor attack. So it seems pointless to discuss defense on this basis.\n\n3) The paper mentions that the framework is also able to handle clean-label backdoor attack. From a concrete standpoint, I'm curious where the robustness against attacks comes from when noisy label learning doesn't make sense. Just from AT? This doesn't sound great. In fact, it doesn't make any sense to talk about test accuracy for some targeted backdoor attacks that attack specific objects. An increase in test accuracy does not mean the attack will fail. Hopefully the paper will have some related discussions.\n\n4) Only the evaluation on CIFAR and MNIST may be weak.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "RowZuYIdnG4", "reviewer": "Reviewer_4HFg", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors proposed a meta-algorithm to achieve robustness against backdoor attacks by combining existing noisy label algorithms and adversarial training. They also showed that their method is capable of reaching high robustness through experiments.", "summary_of_the_review": "The authors first examined the connection between noisy label attacks and backdoor attacks. Then, they proposed a meta-algorithm that leverages existing noisy labeling algorithms and uses an adversarial training scheme to achieve robustness against backdoor attacks. They proposed a 2-stage learning experiments that first cleans labels by using SPL, PRL and Bootstrap which are used for learning against noisy labels and then performs adversarial training algorithms.\n\nThis paper lacks novelty. The proposed techniques in each stage are existing ones. And the experiments seem to focus on the situations where the portion of poisoned data is large, which, as far as I know, is not common in real-world scenarios. The authors should further justify the above to make their contributions more concrete.\n\nMore detailed suggestions:\n\n1. It is expected that there should be a performance gap between PRL and PRL-AT, as the latter learns \"more\" through adversarial training. For the purposes of this paper, we suggest the authors to compare their work with benchmarks trained against backdoor attacks, not just with those learning with noisy labels.\n\n2. In Table 1, although the proposed method performs well, there seems to be a trade-off between poison and clean accuracy.  The authors should have in-depth discussion on this matter, such as how it will impact downstream tasks.", "strength_and_weaknesses": "S1: The proposed two-stage learning is intuitive and effective.\nS2: The authors discussed their assumptions well.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "BD_GhPSZIv", "reviewer": "Reviewer_u1Jp", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new method to deal with backdoor attacks problems. Existing backdoor attack algorithms could not deal with high corruption ratio well, the proposed method, however, leverage on the noisy label defense algorithm to develop a robust version of backdoor defense. By applying adversarial learning on selected noisy label algorithms, it is justified to use minimax optimization to tackle backdoor attacks with perturbation limit provided. Extensive experiments show that the algorithm work well on different perturbation limit on a series of benchmark datasets. ", "summary_of_the_review": "The authors are suggested to address the weaknesses mentioned in the previous sections. ", "strength_and_weaknesses": "Strengths\n1. This paper proposes a method to solve the backdoor attacks by using a method that deals with noisy label attacks. \n2. Comprehensive experiments are conducted to show that the proposed method is performing better than baselines consistently on a series of benchmark datasets.\n\n\nWeaknesses\n1. What does the \"#Inner Maximization Steps\" in algorithm 1 refer to? If the maximum and minimum steps are processed sequentially. \n2. Novelty: the proposed method seems just combining the existing noisy label algorithm with minimax adversarial learning. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "A3gevhYES2D", "reviewer": "Reviewer_2m5J", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper attempts to introduce robust algorithms against label noise into backdoor defense. In particular, the authors propose a meta-algorithm that can transform an existing noisy label defense into one that defends against backdoor attacks. The experimental results demonstrate the effectiveness of the proposed method.", "summary_of_the_review": "This paper studies an interesting question of whether we can introduce robust algorithms against label noise into backdoor defense. Unfortunately, the reviewer has concerns about the uncommonly used threat model. ", "strength_and_weaknesses": "**Strength**\nThe topic is quite interesting. Since robust algorithms against label noise have been developed for a long while, the connection between label noise and backdoor attacks can help the development of the latter.\n\n**Weakness**\n1. I have concerns about the threat model in this paper. \n- If I understand correctly, the author randomly label the triggered data (images with trigger pattern) as any other labels (similar to uniform label noise). This is more related to label flipping attacks than backdoor attacks since this attack only results in performance degradation rather than target control, i.e., with only limited threat compared to commonly used backdoor attacks.\n- Since the author claim to “ leverage algorithms that defend against noisy label corruptions to defend against **general** backdoor attacks”, they are expected to conduct experiments on the commonly used setting, i.e., single-target attack.\n- The threat model in this paper requires a large poison ratio (>15%), which means the adversary has access to many training data. Is this realistic?\n\n2. This paper overclaims its contribution. While the threat model in this paper is an uncommon one (see discussion above), the majority of cited studies on backdoor attacks apply another threat model instead. This will mislead the readers to believe that this paper defends against the cited backdoor attacks. \n\n3. The technical novelty of this paper is limited. The proposed method seems to be a trivial combination of adversarial training and a robust algorithm against label noise.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject