Defending Backdoor Data Poisoning Attacks by Using Noisy Label Defense Algorithm
Authors: Boyang Liu
Zhuangdi Zhu
Pang-Ning Tan
Jiayu Zhou
Venue: ICLR 2022 Submitted (2022)
Keywords: Backdoor Attack
Data Poisoning
Noisy Label

Abstract: Training deep neural networks with data corruption is a challenging problem. One example of such corruption is the backdoor data poisoning attack, in which an adversary strategically injects a backdoor trigger to a small fraction of the training data to subtly compromise the training process. Consequently, the trained deep neural network would misclassify testing examples that have been corrupted by the same trigger. While the label of the data could be changed to arbitrary values by an adversary, the extent of corruption injected to the feature values are strictly limited in order to keep the backdoor attack in disguise, which leads to a resemblance between the backdoor attack and a milder attack that involves only noisy labels. In this paper, we investigate an intriguing question: Can we leverage algorithms that defend against noisy labels corruptions to defend against general backdoor attacks? We first discuss the limitations of directly using the noisy-label defense algorithms to defend against backdoor attacks. Next, we propose a meta-algorithm that transforms an existing noisy label defense algorithm to one that protects against backdoor attacks. Extensive experiments on different types of backdoor attacks show that, by introducing a lightweight alteration for minimax optimization to the existing noisy-label defense algorithms, the robustness against backdoor attacks can be substantially improved, while the intial form of those algorithms would fail in presence of a backdoor attacks.

Under review as a conference paper at ICLR 2022
DEFENDING BACKDOOR DATA POISONING ATTACKS USING NOISY LABEL DEFENSE ALGORITHM
Anonymous authors Paper under double-blind review
ABSTRACT
Training deep neural networks with data corruption is a challenging problem. One example of such corruption is the backdoor data poisoning attack, in which an ad- versary strategically injects backdoor trigger to small fraction of the training data to subtly compromise the training process. Consequently, the trained deep neural network would misclassify testing examples that have been corrupted by the same trigger. While the label of the data could be changed to arbitrary values by an adversary, the extent of corruption injected the feature values are strictly limited in order to keep the backdoor attack in disguise, which leads to a resem- blance between the backdoor attack and a milder attack that involves only noisy labels. In this paper, we investigate an intriguing question: Can we leverage al- gorithms that defend against noisy labels corruptions to defend against general backdoor attacks? We first discuss the limitations of directly using the noisy- label defense algorithms to defend against backdoor attacks. Next, we propose a meta-algorithm that transforms an existing noisy label defense algorithm to that protects against backdoor attacks. Extensive experiments on different types of backdoor attacks show that, by introducing lightweight alteration for mini- max optimization to the existing nobsy-label defense algorithms, the robustness against backdoor attacks can be substantially improved, while the intial form of those algorithms would fail in presence of a backdoor attacks.
INTRODUCTION
Deep neural networks (DNN) have achieved significant success in variety of applications such as image classification (Krizhevsky et al. 2012), autonomous driving (Major et al. 2019), and natural language processing (Devlin et al. 2018). due to its powerful generalization ability. In the mean- time, DNN can be highly susceptible even small perturbations of training data, which has raised considerable concerns about its trustworthiness (Liu et al.) 2020). One representative perturbation approach is backdoor attack, which undermines the DNN performance by modifying small fraction of the training samples with specific triggers injected into their input features, whose ground-trute labels are altered accordingly to be the sttacker-specificd ones. It is unlikely to detect backdoor attacks by monitoring the model training performance, since the trained model can still perform well on the benign validation samples. Consequently, during testing phase, if the data is augmented with the trigger, would be classified as the attacker-speeified label. Subtle yet effective, backdoor attacks can pose serious threats to the practical application of DNNs.
Another typical type of data poisoning attack is noisy label attacks (Han al. 2018 Patrini al. 2017 Yi & Wu 2019 Jiang et al., 2017). in which the labels of a small fraction of data are al- compromise the model learning, while the input features of the training data remain untouched. Backdoor attacks share close connection to noisy label attacks, in that during backdoor attack, the feature can only be altered insignificantly to put the trigger in disguise, which makes the corrupted feature (e.g. images with the trigger) highly similar to the uncorrupted ones. Prior efforts have been made to effectively address noisy label attacks. For instance, there are algo- rithms that can tolerate large fraction of label corruption, with up to 45% noisy labels (Han al.) 2018 Jiang et al. 2018). However, to the best of our knowledge, most algorithms defending against backdoor attacks cannot deal with high corruption ratio even if the features of corrupted data only slightly perturbed. Observing the limitation of prior arts, we aim to answer one key question: Can one train deep neural network that is robust against large number of backdoor attacks?
tered deliberately

---

Under review as a conference paper at ICLR 2022
Moreover, given the resemblance between noisy label attacks and backdoor attacks, also investi- gate another intriguing question: Can one leverage algorithms initially designed for handling noisy label attacks to defend against backdoor attacks more effectively?
The contributions of this paper are multi-fold. First, we provide a novel and principled perspective to decouple the challenges of defending backdoor attacks into two components: the corrupted input features, and the other induced by the corrupted labels, based on which we can draw theoretical connection between the noisy-label attacks and backdoor data attacks. Second, we propose a meta-algorithm which addresses both challenges by a novel minimax optimization. Specifically, the proposed approach takes any noisy-label defense algorithm as the input and outputs a reinforced version of the algorithm that is robust against backdoor poisoning attacks, while the initial form of the algorithm fails to provide such defense. Extensive experiments show that the proposed meta-algorithm improves the robustness of DNN models against various backdoor attacks on variety of benchmark datasets with up to 45% corruption ratio. Furthermore, we propose a systematic, meta-framework to solve backdoor attacks, which can effectively join existing force in noisy label attack defenses and provides more insights to future development of defense algorithms.
induced by
RELATED WORK
2.1 ROBUST DREP LEARNING AGAINST ADVERSARIAL ATTACK
Although DNNs have shown high generalization performance on various tasks, it has been observed that a trained DNN model would yield different results even by perturbing the image in an invis- ible manner (Goodfellow et al.) 2014 Yuan al.) 2019). Prior efforts have been made to tackle this issue, among which one natural defense strategy is to change the empirical loss minimiza- tion into a minimax objective. By solving the minimax problem, the model guaranteed better worst-case generalization performance (Duchi & Namkoong. 2021). Since exactly solving the inner maximization problem can be computationally prohibitive, different strategies have been proposed to approximate the inner maximization optimization, including heuristic alternative optimization, linear programming WWng & Kolter (2018), semi-definite programming Raghunathan et al. 2018)), etc. Besides minimax optimization, another approach to improve model robustness is imposing Lipschitz constraint on the network. Work along this line includes randomized smoothing Cohen et (2099); (Slman et al. 2019), spectral normalization MMyato al. (20T8a), and adversarial Lip- schitz regularization Terjēk (2019). Although there are algorithms that are robust against adversarial samples, they are not designed to confront backdoor attacks, in which clean training data is usually inaccessible. There are also studies that investigated the connection between adversarial robustness and robustness against backdoor attack (Weber et al. 2020). However, to our best knowledge, there is no literature studying the relationship between label flipping attack and backdoor attack.
(S
2.2 ROBUST DEEP LEARNING AGAINST LABEL NOISE
Many recent studies have investigated the robustness of classification tasks with noisy labels. For example, Kumar et al. (2010) proposed the Self-Paced Learning (SPL) approach, which assigns higher weights to examples with a smaller loss. A similar idea was used in Curriculum Learning (Bengio et al.) 2009), in which a model learns on easier examples before moving to the harder ones. Other methods inspired by SPL include learning the data weights (Jiang et al. 2018) and collaborative learning (Han et al. 2018 Yu et al. 2019). An alternative approach to defending noisy label attacks is label correction (Patrini al. 2017 [ al. 2217] Yi & Wu 2019), )), which attempts to revise the original labels of the data to recover clean labels from corrupted ones. However, since we do not have the knowledge of which data points have been corrupted, it is nontrivial to obtain provable guarantees for label corrections, unless strong assumptions have been made on the corruption type.
2.3 DATA POISONING BACKDOOR ATTACK AND ITS DEFENSE
Robust learning against backdoor attacks has been widely studied recently. Gu et al. (2017) showed that even a small patch of perturbation can compromise the generalization performance when data is augmented with a backdoor trigger. Other types of attacks include the blend attacks (Chen et al. 2017). clean label attacks (Turner et al. 2018 Shafahi al. 2018), latent backdoor attacks (Yao ct al. 2019), etc. While there are various types of backdoor attacks, some attack requires that the adversary not only has access to the data but also can has limited control on the training and inference
2

---

Under review as a conference paper at ICLR 2022
process. Those attacks include Trojan attacks and blind backdoor attacks Pang et al. 2020 We refer readers to Pang et al. (2020) for a comprehensive survey on different types of backdoor attacks.
Various defense methods have been proposed to defend against backdoor attacks. One defense category is to remove the corrupted data by using anomaly detection (Tran et al., 2018 Chen et al, 2018). Another category of work is the model inspection (Wang al. 2019), which aims to inspect and modify the backdoored model to make robust against the trigger. There are also other methods
of tackling the backdoor attacks, such as randomized smoothing (Cohen al.) 2019 Weber al. 2020), and the median of means (Levine & Feizi, 2020). However, they are either inefficient or cannot defend against backdoor attacks with large ratio of corrupted data. Some of the above methods also binge on a clean set of validation data, while in practice, it is unlikely to guarantee the existence of clean validation data, since validation data usually a subset of training data. To the best of our knowledge, there is no existing backdoor defense algorithm that is motivated from the label corruption perspective.
3 PRELIMINARIES
3.1 LEARNING WITH NOISY LABELS
In this section, we review some representative approaches for defending noisy-labels. Although the initial forms of these approaches can be vulnerable to backdoor attacks, we show later in the next section that our proposed meta-algorithm attacks. Specifically, we look into two types of nosiy-label defending approaches: tntering-basedd approaches and consistency- basedd approaches.
empower them to effectively confront backdoor
The filteiigg-bseed approach is one of the most effective strategies for defending noisy labels, which works by selecting or weighting the training samples based indicators such sample losses (Jiang et al.] 2017 Han et al.] 2018 Jiang et al., 2020) or gradient norms of the loss-layer (Liu et al. 2222]) For instance, Jiang al. (017)) 7) proposed assign higher probabilities to samples with lower losses to be selected for model training. Consistency-based approach modifies data labels during model training. Specifically, the Bootstrap approach (Reed et al.) (0144) encourages model predictions to be consistent between iterations, by modifying the labels as a linear combination of the observed labels and previous predictions.
In this paper, we leverage two filtering- based noisy label algorithms, i.e. the Self-Paced Learning (SPL) (Tang et al., 2017, Kumar et al., 2010) and Provable Robust Learning (PRL) (Liu et al, 2021). and one consistency-based algorithm, i.e. the Bootstrap (Reed et al. 2014), to investigate the efficacy of the proposed meta algorithm. Strong empirical results in Section 5 on those input algorithms suggest that our meta framework is readily to benefit other robust noisy- algorithms. We briefly summarize the main idea of the above algorithms in table
PRL (Filtering-based)
SPI. (Filtering- hased))
Bootstrap (Modifying Label)
Mini-batch
Keep data with small loss-layer gradicnt norm
Keep data with small loss
ytrue afferue (1 a)
Table 1: Overview of nabsy-label defending algorithms, which achieve robustness against up 45% of pairwise flipping label noises.
3.2 PROBLEM SETTING OF BACKDOOR ATTACKS
In this paper, we follow a standard setting for backdoor attacks and assume that there is an adversary that tries perform the backdoor attack. Firstly, the adversary can choose up fraction of clean labels Y E nxx and modify them to arbitrary valid numbers to form the corrupted labels Y, E R x4, Let Y, represent the remaining untouched labels, then the final training labels
can be denoted Y. Y,, 6, Y,J- Accordingly, the corresponding original feature are denoted as X [X,, E R [[me|xdd xx X, E [in-[ne])xd]] The adversary can design trigger t E Rd to form the
corrupted feature set X R [neexxd such that for any b; in X,, o, in X., it satisfies b; o, + t.
3

---

Under review as a conference paper at ICLR 2022
Finally, the training feature will be X. X, R [ne]xd also denote T [t, t, t.... t| IR [ so that X, =T=
X, E Rn (ne])d) Without ambiguity
Before analyzing the algorithm, we make following assumptions about the adversary attack: Assumption (Bounded Corruption Ratio). The overall corruption ratio and the corruption ratio in each class is bounded. Specifically,
I(ys = = + $c= c(y=
(Small Trigger). Any backdoor trigger satisfies ||t||p S T, which subtly allers the data within small radius-7 ball without changing its ground-truth label.
Assumption 2
We also assume that there exists at least one black-box robust algorithm A which can defend any noisy label attacks so long as the noisy-label ratio bounded by 6. Note that the above assumption is mild, since variety of existing algorithm handle noisy labels attacks with large corruption rate (e.g. 45%) (Jiang et al. 2017
Han et al. 2018 Reed et al. 2014
Liu et al. 2021).
4
METHODOLOGY
Given an e-backdoor attacked dataset (X Y clean distribution p" == (X, Y), and a loss func- tion L, we aim to answer the following questions: 1) can we learn a network function that min- imizes the generalization error under the corrupted distribution, i.e. (s..))>-- [C(f(x + (t. v)]? 2) can the learned f also minimize the generalization error under the ground-truth, clean distri- bution, i.e. B(z,)))<p'' [z(f(z), y)]? Next, we elaborate our meta-approach for defending against backdoor attacks, which answers the above two questions aftirmatively.
4.1 A BLACK-BOX ROBUST ALGORITHM AGAINST NOISY LABELS
The ultimate goal for defending against backdoor attacks is to learn network function minimize its risk given corrupted feature inputs:
min J(J) == (u.))>> [e((x + t),
However, Equation is not directly optimizable due to two-fold challenges: 1) the corrupted inputs X with an unknown trigger t, and 2) the corrupted labels Y That is, neither the clean inputs or ground-truth labels are available. As such, turn approachable objective that optimizes the worst-case of Equation]]
min / ST xEX.EEY
1
Σ [C(f(x+
Since the trigger satisfies ||t||p S T, it is easy to see that Equation minimizes an upper-bound of the ground-truth loss, in that:
Σ XEX
c(f(x (ff(x+t),))
max I XEX.
Σ ((f((+c)),v)
To this end, directly optimizing the surrogate objective in Equation i still intractable, since we do have access to clean X and Y. which are involved in the inner maximization loop. To tackle this challenge,
will first assume that the clean label Y is available, and then relax this prerequisite by using any learning algorithms that are robust against noisy labels. Specifically, assume that ow = Co f has Lipschitz constant L W.E. we further obtain new upper bound (see Appendix for derivation details):
Σ XEX,
1
Σ XEX YEY
(x + (cx) LTT.
'Some backdoor attack algorithms design instance-specific trigger. In this paper, only focus on the static trigger and leave the instance-speeific trigger for future study.
4

---

Under review as a conference paper at ICLR 2022
which draws principled connection between the risks when using corrupted data and clean data:
min max Σ [x(f(x c), |e xEX.yEX
min max IelpsT
Σ cc) (4) XEX yEX
where the first term on the RHS of Equation involves optimization on the corrupted features X and clean labels Y. while the second term on the RHS requires minimizing the Lipschitz constant w.El x. Recall that minimizing the maximum gradient norm is equivalent to minimizing the Lips- chitz constant (Terjék] 2019). Therefore, optimizing the first term naturally regulates the maximum change of the loss function within a small ball, which hence constrains the magnitude of the gradient and has negligible effects the Lipschitz regularization. The relationship between Lipschitz regu- larization and adversarial training has also been well discussed by literatures (Terjék] 2019 Miyato We defer more discussion along this line Appendix.
al.
2018b).
Equation indicates that the target labels are not corrupted, and the learned function has a small Lipschitz constant, learning with corrupted features is feasible achieve low risks. Up to now, the remaining challenge of optimizing the surrogate objective in Equation iis the inaccessible clean label set Y. Fortunately, variety of algorithms are hand for handling noisy labels during learning (Jiang et al. 2017: Liu et al. 2021; Kumar et al. 2010), which we can directly apply to our minimax optimization scheme. Specifically, for the outer minimization, one can have:
Liu
min n JEY-
Σ
[x + c),y)),
For the outer minimization, we can perform the noisy-label update for the above optimization ob- jective. For instance, Given the mini-batch M,, M, with batch size if we use SPL to perform the update, we can get the top (1 c)m data with small risk L(f(( + y) to perform one-step gradient descent. If we use the PRL to perform the update, assume L is the cross-entropy loss, one can get the top (1 - )m data with small loss-layer gradient norm (x -y y to perform one-step gradient descent. If we use the bootstrap, we can directly add a bootstrap regularization to update the above objective.
In the meantime, it is non-trivial to directly solve the inner maximization, since adversarial learning e in Equation 4 still faces the threat of noisy labels. To tackle this issue, we can leverage the same robust noisy label algorithm. Specifically, first approximate the inner optimization using the first-order Tyler expansion:
1 c¹ arg max- = ST 7 xEX.yEY
Σ
1 L(f(x + c).y) arg max = Σ ((f(x),)) + V 1r xEX.EEY
arg max c² cVV ST
Σ xEX.EEY
((f(x),))
Above optimization is linear programming problem. With the Loo norm ball constraint on the perturbation, the above update can be reduced the fast gradient sign method (FGSM), Given minibatch Mg, M, with batchsize m, we can have the closed-fome solution as the following:
{ [I. E.EE sign (vxC (f(x))))
è = è=Clipe
(5)
To relax the prerequisite of a clean label set in Equation 5 we will use a noisy-label algorithm to perform the update. For instance, if use a loss-filtering based algorithm (e.g. SPI.), then for each mini-batch, only the top (1 c)m data with small L (x(). y) would be included in the update. If we adopt gradient- based filtering algorithm (e.g. PRL), given that the cross-entropy loss, then only top (1 e) data with small [x -y will be included. The outside clipping ensures that the feature value the corrupted image is in the valid range. Based on the above building blocks, we now introduce algorithm in Algorithm [ meta defense scheme that are robust against backdoor attacks, given arbitrary nobsy-label robust algorithm A as an input. The algorithm is illustrated in Figure
5

---

Under review as a conference paper at ICLR 2022
Algorithm/ 1: Meta algorithm for Robust Learning Against Backdoor Attacks
input:
Corrupted training data X", Y", perturbation limit: 7, learning with noisy label algorithm A (e.g.
PRL. SPL, Bootstrap).
return trained neural network;
while epoch max_epoch do
for sampled minibatch Mz, My in X Y do
#inner maximization step
initialize с vector.
optimize the objective max|jelss L(f(M, c). M2) was c by using robust algorithm A
optimize the objective miny [Mf + c), My) wottf by using robust algorithm. A
end
end
(a) clean data
(b) two samples are added with small trigger and flipped label
(c) Inner maximization by noisy label algorithm
(d) Reduce the back- door attack to label flip- ping attack
Figure 1: Illustration of our meta algorithm. By combining the minimax objective and noisy label algorithm, could reduce the backdoor attack problem to the label flipping attack. The left most the clean original data and the second one is corrupted data. The third figure shows the inner maximization step while the last figure shows the outer minimization step.
4.2
THEORETICAL JUSTIFICATION
Our ultimate goal is to learn that achieves a small risk Ex,y ew (x + t, To study the generalization performance on the ground-truth distribution p#, we first define the following risks: R. T1 -
-xxxXxvE (x+xxt,)), R4 = Ex.y (x Remp ExEx yeY d 1
y, and Remp
Exex yEY @ yeY (x+,yy). Next, we focus the gap between R, and Remp.
71
Theorem 1. Let Remp, Remp, Rr, c, defined above. Assume that the prior distribution of the network parameter is (0, a),, and the posterior distribution of parameter is ((w, o) which learned from the training data. Let be the number of parameters, and n be the sample size. If the objective function :w L f is Lo Lopsscitt smooth, then with probability at least 1-Ō, one can derive:
k
[
|w 2
log +
+ 21o (6n + 3k)
R. Remp (27 (2( +TT) +
We hereby present the skeleton of the proof and defer more details to Appendix. First, we decompose the error into components: the generalization gap the triggered data, and the difference of performance loss between the trigger t and worst case perturbation c: Rr -Remp = (Re Renpp) (R. emmp).
f log
14
1 kaa
log F log(6n 433))
The first components is
which is derived by following
the BAC-Bayes framework (Foret et al. sources. The first source is the difference between and t, and the second is from the difference between X and X Since the objective is Lg Lipschitz, and |t |t-cc c|l S 2r according to our constraint the adversary, it is easy upper bound the error 27 I.g. In the meantime, there is e-fraction of
2020). For the second term, the gap is introduced by two

---

Under review as a conference paper at ICLR 2022
difference between X and X which is bounded by ||t||| and leads to the other difference term LgCT.
Theorem 1 presents upper-bound of the gap R2 Remp The first term in Equation 6 can be minimized by using a noisy label algorithm. The second term, which is the error induced by the adversarial trigger, is jointly constrained by the Lipschitz constant Lg, perturbation limit т, and the corruption ratio c. We can regularize the Lg whereas the т and c are controlled by the unknown adversary. Note that existing literature has also shown that adversarial training plays resemblant role as the Lipschitz regularization. The last term, i.e. the normal generalization error on the clean data, difficult minimize directly. The bound in Theorem emmphssiess the importance of involving both the noisy label algorithm and the adversarial training. The noisy label algorithm can reduce the Re while the adversarial training minimizes the Lipschitz constant L.g. to optimize the second term.
EXPERIMENT
In this section, perform the empirical study. In our experiment, we perform experiment CIFAR1O and CIFAR100 benchmark data. We use ResNet-32 (He et al.] (016) as the backbone network structure for all experiment baseline. The initial learning rate of all methods are set to be 3e-4, and we use AdamW (Loshchilov & Hutter 2017) as the optimizer for all methods. The evaluation metric is the top-1 accuracy for both clean testing data and testing data with backdoor trigger.
For the backdoor data poisoning attack, we use simple badnet attack (Gu al. 2017) and gaussian blending attack (Chen et al., (017) since these two attacks do not require any information about the model or training procedure (Pang et al., 2020).
badnet patch attack: trigger is a 3 x black-white checkerboard and it is added to the right bottom corner of the image.
blending attack: trigger fixed Gaussian noise which has the same dimension as the image. The corrupted image generated by x = (1 a)x; + at. In our experiment, we set the a as 0.1.
The poisoned sample can be found Appendix. We deploy the multi-target backdoor attack in this paper. Our poisoning approach is as following: we first systematically flip the label to perform the label-fipping attack Then, for those being attacked samples, add the triggers their feature. Without adding the trigger, the problem would reduce to the noisy label problem.
and we the following two evaluation metric.
top-1 clean accuracy: the top-1 accuracy calculated on trigger-less testing data top-1 I poison accuracy: the top-1 accuracy calculated by the model prediction on poisoned testing data and ground truth clean label.
The first metric describes how model performs on benign data while the second metric de- scribes how model performs on triggered data. We varies our training data poisoning rate as [15%, 25%, 35%, 45%] to investigate how our algorithm performs against different corruption ra- tio. All methods are trained 100 epochs, Also, in this paper, we assume there no clean validation data available. Thus, it is difficult to perform early stopping or decide which epoch result should be used. Thus, we report the averaged accuracy across last 10 epochs for every methods.
We investigate three noisy label algorithms by comparing the performance of the original method and reinforced method. Specifically, we choose SPL,, PRL, and Bootstrap as our original noisy label algorithm and the corresponding reinforced algorithm with adversarial training SPL-AT, PRL-AT, Bootstrap-AT. We also compared our method against adversarial training only (AT), which only uses the adversarial training without using any noisy label algorithm. To show the success of the attack, we also includes the standard training results.
5.1 HOw ROBUST LEARNING AGAINST NOISY LABEL PERFORMS ON BACKDOOR DATA
In this section, we aim to answer the first question: how does noisy label defense algorithm performs
against backdoor attack?
7

---

Under review as a conference paper at ICLR 2022
To answer above question, We evaluate PRL. SPL, and Bootstrap CIFARIO and CIFAR100 dataset. The results can be found in table 2 and table 3 As we can see in the table, the standard training performs well on the benign testing data (i.e. high clean accuracy) while its performance on triggered data is very bad (i.e. low poison accuracy), which indicates the effectiveness of the backdoor attack.
As for the three noisy label algorithm, we found that although Bootstrap, SPL,, and PRL all performs well for the benign testing data, they all fail when defending the backdoor attack data especially with large corruption rate, which illustrates that noisy label algorithm cannot defend the backdoor attack especially when corruption ratio is large.
5.2 How ADVERSARIAL TRAINING IMPROVES THE NOISY LABEL ALGORIIHH
To investigate whether adversarial training could improve the robustness of existing noisy label al- gorithm against backdoor attack, we performed experiment on SPI,AT, PRI-ATT and Bootstrap-AT to see how they performs on both clean test data and triggered test data. The results can be found in table @anddaan table 3 As we can see that by adding the adversarial training, the performance on trig- gered data is largely improved (i.e. the poison accuracy significantly improves). Also, we noticed that this improvement pattern is hold for all three noisy label algorithm, which indicates the effee- tiveness of the proposed method improving robustness against backdoor attack. Also, compared to adversarial training only (AT), adding noisy label does improve the performance. Especially for the PRL algorithm, see the PRL-AT achieves better performance than AT. Also, we found that compared to consistency based noisy label algorithm, filtering based algorithm are more easier to be boosted by adversarial training. The potential reason behind this could be that filtering based method is more efficient against noisy label algorithm Han et al. (0018); Jiang et al. (0017); Liu
al. (202T).
Backdoor Attack Defense Accuracy.
Dataset
BootStrap
Bootstrap-AT AT
PRI.AT
ST
Standard
CIFAR1O
0.15 66.64 1 5,28
2,09
: 0.13
3,05 0.47
81.71:0.35
80.15
+ 0.42
34.60
1
1.57
77.60
1: 3.81
2.10 0.10
0.25 63.98 + 7.16
2.01
= 0.23
2.75 +
45.94
25.19
78.14
+ 0.48
10.87
+ 2.13
22.17
= 10.51
2.13 0.15
with Patch Attack,
Poison Accuracy
0.35
60.19
1.35
1.8
0.15
2.66
-:
17.63
75.04
+
11.74
2.01
0.09
0.45
51.25
1 1.81
1.94
1 0.12
2.53
0.20
17.50
1: 1.66
58.90
1: 12.52
12.32
1: 1.20
14.00
1 5.35
1.88 1. 0.04
CIFARIO
0.15 66.77
5.17
85.22
4 0.48
82.62
0.26
82.06
+: 0.16
80.25
0.43 77.35
+ 2.76
77.70
1:70033.00
85,40
+ 0.37
with Patch Attack,
0.25 63.98 1. 7.16
85,25
1: 0.19
81.90
1: 0.25
78.57
1: 1.03
78.22
1 0.56
69.52
1 2.38
68.49
1 2.76
85,20
1 0.26
Clean Accuracy
0.35
60.31
1.37
84.86
1: 0.13
81.75
0.25
73.63
1: 0.75
75.10
1: 0.31
60.23
1
3.14
58.88
3.46
84.73
0.13
0.45
51.25 + 1.81
0.12
2.53
0.20
17.50 + 1.66
58.90
: 12.52
50.82
+ 148
14.00
1:000:00 5.35
1.88
0.04
0.15 65.15 0.94
2.17
0.17
24.98
+ 10.01
6.41 3.91
79.71 + 0.33
11.60
1: 6.56
74.77
+ 3.53
2.29
+: 0.10
CI
with Blend Attack.
0.25 56.98 0.72
2.10
33.33
+ 20.03
6.77
+ 2.81
76.99 + 0.37
11.60
8,59
$2.36
- 10.57
2.03
0.18
Poison Accuracy
0.35
47.84
1.49
1.86
0.07
13.13
9.42
5.28
73.17
1 0.96
12.71
1 9.33
50.79
7.92
1.97
- 0.07
0.45 34,66 + 1.49
1.83
6.12 + 2.86
8.13 + 4.50
49.88 + 8:43
8.69
- 4.41
35.06
- 4.00
0.06 1.88
0.15 66, 14 1: 0.98
85.54
1: 0.58
81.44
1: 0.58
77.51 +: 1.20
$0.06 4 0.34
76.25
1: 2.78
75.65
3.11
85.28
1: 0.34
CI
with Blend Attack.
0.25 58.91 5,70
84.95
4
80.89
0.65
71.45
+ 1.40
77.82
+ 0.26
67
+ 2.58
65.08
- 0.82
85.06
- 0.39
0.35 50.07 = 13.26
84.72
= 0.58
80.63
+ 0.57
66.22
+ 1.15
74.34
+ 1.01
60.52
+ 2.26
60.16
= 2.39
84.72
= 0.28
Clean Accuracy
0.45 38.03 = 15.42 84.36
4 0.38
80.35
1: 0.39
55.78
+: 2.09
ST.17
+ 9.02 49.48
+ 2.19
46.74
0.71
84.07
+ 0.17
Table 2: Performance on CIFAR is the corruption rate.
5.3 ABLATION STUDY
In this section, we aim to explore more about the proposed framework. Since our algorithm use the noisy-label solver for both inner and outer optimization. A interesting question to ask is that whether both inner and outer nobsy-label solver plays an important role in defense the backdoor attack. Thus, we have two variants. One is we only use noisy label algorithm to update the model for outer minimization and another one is we only use the noisy label algorithm to update the model for inner maximization. The results can be found at table and table As we could see in these two tables, using noisy label algorithm to perform the inner maximization is more important compared to using noisy label algorithm to perform out minimization.
6 CONCLUSION
In this paper, we investigate the connection between label flipping attack and backdoor data poison- ing attack. We show that although robust algorithm against label flipping attack cannot defend the
8

---

Under review as a conference paper at ICLR 2022
Backdoor Atlack Defense Accuracy.
Dataset
A1
BeotStrap
Boosstra-AT
PRL
PRL-AI
SPL
SPL-AT
Standard
0.15 23.70 = 1.39 5.25 + 0.81
44.74 = 4,05
15.15
9.17
47.11 +0.5
24.87
5.27 5.27
42.24 + 0.76 5.28 = 0,30
CIFARIOO
0.25
44.09
1.10
17.53
0.41
with Patch Attack,
0.35 17.16 = 1.09
2.85
+ 0.12
40.14
+ 0.20
20.83
+ 10.03
39.76
0.72
7.37
0.59
28.41
1 1.72
3.24
1.04
Poison Accurney
0.45 13.61
0.74
10.60
+ 10:49
31,21
0.30
23.98
+ 9.32
29.76
1.11
7.26
0.76
20.43
10.51
11.21
CIFAR 100
0.15 34.08 = 0.40 52.39
0.38
47.76
+ 0.14
50.50
+ 0.41
47.21
+ 0.56
46.38
0.1
42.38
1
0.73
52.42
1: 0.59
0.25 31.72 0.75
50.54
0,25
44.82
0.52
47.49
+ 0.91
43.89
+
0.35
39,98
0.80
35
1,44
50.53
0.55
with Patch Attack,
0.35 29.50 = 1.73 48.41
0.42
40.38
+ 0.18
44.21
+ 0.21
39.80
+ 0.67
34.11
1.10
28.52
+
1.70
48.75
0.71
Clean Accuracy
0.45
5.00
31.48
6.06
0.15 33.65 :: 0.54
2.19 1: 0.28
46.65
1: 0.33
2.10
1 0.43
4601 1 0.50
6.14
1.12
41.57
1
0.74
2.09
0.20
CIFAR100
with Blend Attack.
0.25 30,95 0:42
1.17 +
41.84
0.59
0.21
41.78
0.76
2.95
0.56
33
1.76
1,12
0.20
0.35 27.30 = 0.45
1,05 + 0.06
31.88
= 1,26
1.11
0.17
34.51 + 1.00
2.00
0.49
25.71
+
2.31
1.08 = 0.16
Poison Accuracy
0.45
+:
23.61
2.68
0.17
18.62
0.15 34,22 = 0.58
52.66
- 0.19
47.77
0.36
48.61
0.18
4692
0.47
46.01
0.40
42.40
0.70
52.60
0.59
CIFAR100
with Blend Allack.
0.25 33.65 0.55
51.12
0.37
44.75
- 0.45
45.23
0.34
42,87
40.47
1.47
35.71
+ 1.10
50,98
0.43
Clean Accurncy
0.35 14 1: 0.48
49.80
0.24
40.85
0.37
40.46
1. 0.17
36.30
1.24
35.70
1668
28
56
1
2.05
49.65
0.49
0.45 22.03 0.49 48.46
0.53
34.78
+ 1.39
34.98
+ 0.83
24.71
1.37
29,91
1.40
21
82
1.21
48.07
0.52
Table 3: Performance on CIFAR is the corruption rate.
Backdoor Atiack Defense Accuracy.
Dataset
RootStrap-inner
Rootstrap-outer
PRI-iinerr
PRI-outer
SPI--inner
SPL-outer
0.15
3,15 0.61
3.20 1 0.63
80.78 0.31
2.84 1 0.23
65,50 1. 16.22
3,09
0.35
CIFAR 10 with Patch Attack,
0.25
2.74 + 0.10
2.73 + 0.09
79:07 + 0.20
2.50
1: 0.10
18,95 1 9.91
2.58 4: 0.19
Poison Accuracy
0.35
2,70
+ 0.24
2.67 + 0.15
76.06
0.37
2.39
+ 0.26
13.45
5.40
2.38 0.14
0.45
2.32 + 0.08
2.51 + 0.11
67.87
+ 2.63
2.24 1 0.10
12,10 :: 4.46
2.23 4: 0.26
0,15
82,58
0.33
82.45 0.22
80.86
+ 0.31
83.09
76,48 + 3.03
83.02 + 0.49
CIFAR10 with Patch Attack,
0.25
82.14
0.28
81.87 0.23
79.10 + 0.17
83.13 0.21
69.33 + 2.57
83,30 + 0.13
Clean Accurncy
0.35
81.71
0.46
0.55
76.08
0.34
82.83 0.38
59.76 3:59
83.05
0.38
0.45
81.53 = 0.16
81.00
- 0.47
69.96 + 0.37
82.78 + 0.18
49,31 + 0.53
82.84 + 0.27
0.15
29.85 + 10.65
40.79 + 13:27
80.38 + 0.15
46.29 + 18.09
72.89 + 6.14
48,21 + 14.90
CIFAR10 with Blend Attack,
0.25
14.81
10.42
27.57 + 10.93
78.44
0.19
27.34 + 18.42
54,46 + 10:45
21.18
11.85
Poison Accuracy
0.35
6.52
3,80
17.41 + 10.13
71.93
2.69
11.25
+ 5,92
46.12 + 13.77
14.58 + 7.12
0.45
11.58
14.94
9.01 1. 4.66
2.74 64.98
5,90 1 2.28
42.30 1: 5.85
5.16 1.64
0.15
81.54
= 0.25
81.18
0.75
80.73 + 0.18
X2.51
0.36
76.11 +: 3.32
82.35 + 0.22
CIFAR10 with Blend Attack,
$0.99
80.37
0.94
82.35
2.31
$2.15
Clean Accuracy
0.35
81.04
0.81
79.54
+: 1.32
71.62
+ 2.65
82.55 + 0.47
57.44 + 1.78
81.81 + 1.00
0.45
81.06
0.25
78.93
0.84
62.34
2.51
82.15
1. 0.48
48.82 0.94
81.81
1 1.06
Table 4: Ablation study on CIFAR e is the corruption rate.
Backdoor Attack Defense Accuracy.
Dalaset
BuotStrap-ing
Beolstrap-ond
PRL -inee
PRL-outer
SPL inner
SPL-outer
0.15
43.76 = 2.65
41.66 = 8.37
47.34 + 0.44
44.32
+: 5.45
43.05
+ 0.39
43.41 = 6.36
CIFAR100 with Atlack,
1.55
0.88
41.13
35.69
3,89
Poison Accuracy
0.35
40.02 1 0.19
38.72
1 0.60
40.19
1 0.39
38.75
1 0.60
24.98
1 6.34
38.97
1. 1.10
31.12
0.40
29.46
0.33
31.49
+
0.35
20.13
+ 1.80
30.19
0.31
0.15
48.01
1 0.28
47.91
1 0.21
47.43 1 0.43
48.41
1 0.40
43.29
1 0.21
48.12
0.36
CIFARLOD with Patch Attack.
0.27
45.58
36.21
0.64
Clean Accuracy
0.35
40.49
1 0.23
38.98
1 0.47
40.40 1 0.41
39.46
1 0.30
29.58
1: 1.49
39.89
1: 0.50
31.32
0.48
+
30.39
+: 0.27
20.70
1.51
0.55
0.15
46.72
0.23
46.56 1: 0.26
46.59 1: 0.43
46.83
1: 1.00
42.15
0.68
46.80
0.70
CIFARI00 100 with Blend Attack,
0.25
41.64
1.54
40.60 0.98
43.43 1: 0.59
40.02
1: 1.44
34.
1.60
39.30
3,16
Poison Accuracy
0.35
31.18
+ 2.83
30.91 + 2.02
35.84 + 1.71
28
86
- 2.82
26.36
2.65
28.94
3.49
1.18 22.98
24.60
3.73
1.64
2.70
48.05
0.33
47.83 0.29
47.24 +:
044
42.94
0.55
48.37
0.68
CIFAR100 with Blend Attack,
0.25
44.85 + 0.52
44,59 0.31
44.17 + 0.36
45.19
0.26
36.18
- 1.20
45.06
0.18
Clean Accurncy 0.35
40.80
+: 0.56
40.08 1 0.41
38.23 + 0.80
41
84
0.51
30.23
+ 1.5
41.18
0.69
35.32
1.77
34.13 1.13
27.33
39.06
0.45
24.22
1.66
38.62
1.30
Table 5: Ablation study on CIFAR100. e is the corruption rate.
backdoor data poisoning attack, adding the adversarial training existing algorithm could largely improve the robustness against backdoor attack.Bolt theoretical and empirical analysis show the effectiveness of proposed meta algorithm.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Yoshua Bengio, Jérôme Louradour, Ronan Collobert, and Jason Weston. Curriculum learning. In Proceedings of the 26th annual international conference on machine learning, pp- 41-48, 2009.
Bryant Chen, Wilka Carvalho, Nathalic Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering, arXiv preprint 1rXv::811.03722 2018.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. 2017.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint vrXiv:1810.0880) 2018.
John C Duchi and Hongseok Namkoong. Learning models with uniform performance via distribu- tionally robust optimization. The Annals of Statistics, 49(3):1378-1406, 2021.
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness- aware minimiza-
tion for efficiently improving generalization. arXiv preprint 1rXi::2010.01412, 2020.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572. 2014.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprinl arXiv:1708.067: 2017.
Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. Co-teaching: Robust training of deep neural networks with extremely noisy labels. In Advances in neural information processing systems, pp. 8527-8537, 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. Mentornet: Learning data-driven curriculum for very deep neural networks on corrupted labels. arXiv preprint arXiv:1712.05055,, 2017.
Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. Mentornet: Learning data- driven curriculum for very deep neural networks on corrupted labels. In International Conference on Machine Learning, pp. 2304-2313 2018.
Lu Jiang, Di Huang, Mason Liu, and Weilong Yang. Beyond synthetic noise: trolled noisy labels. In International Conference Machine Learning, pp. 4804-4815. PMLR, 2020.
Deep learning on con-
Alex Krizhevsky. Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep con- volutional neural networks. Advances in neural information processing systems, 25:1097-1105, 2012.
M Pawan Kumar, Benjamin Packer, and Daphne Koller. Self-paced learning for latent variable models. In Advances in neural information processing systems, pp. 1189-1197, 2010.
Alexander Levine and Soheil Feizi. Deep partition aggregation: Provable defense against general poisoning attacks. arXiv preprint arXiv:2006. 14768, 2020.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distil- lation: Erasing backdoor triggers from deep neural networks. arXiv preprint arXiv:2101.05930, 2021.
10

---

Under review as a conference paper at ICLR 2022
Yuncheng Li, Jianchao Yang, Yale Song, Liangliang Cao, Jiebo Luo, and Li-Jia Li. Learning from noisy labels with distillation. In Proceedings of the IEEE International Conference on Computer Vision, pp. 1910-1918, 2017.
Boyang Liu, Mengying Sun, Ding Wang, Pang-Ning Tan, and Jiayu Zhou. Learning deep neural networks under agnostic corrupted supervision. arXiv preprint arXiv:2102.0677 2021.
Kang Liu, Brendan Dolan-Gavitt and Siddharth Garg. Fine-pruning: Defending against back- dooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273-294. Springer, 2018.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conference on Computer Vision, pp. 182-199. Springer, 2020.
Iyya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv: 1.05 2017.
Bence Major, Daniel Fontijne. Amin Ansari, Ravi Teja Sukhavasi. Radhika Gowaikar, Michael Hamilton, Sean Lee, Slawomir Grzechnik, and Sundar Subramanian. Vehicle detection with automotive radar using deep learning on amne-azimuth-dopples tensors. In Proceedings of the IEEE/CVF International Conference on Computer Vision Workshops, pp. 0-0, 2019.
David McAllester. Pac-bayesian model averaging. In Proceedings of the twelfth annual confer- on Computational learning theory, pp. 164-170, 1999.
Takeru Miyato, Toshiki Kataoka, Masanori Koyama, and Yuichi Yoshida. Spectral normalization for generative adversarial networks. arXiv preprini arXiv: 1e0i.00027... 2018a.
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii Virtual adversarial training: a regularization method for supervised and semi-supervised learning. IEEE transactions on pattern analysis and machine intelligence, 11(8):1979-199 1993, 2018b.
Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shouling Ji, Peng Cheng, and Ting Wang. Trojanzoo: Everything you ever wanted to know about neural backdoors (but were afraid to ask). arXiv preprint arXiv:2012.09302, 2020.
Giorgio Patrini, Alessandro Rozza, Aditya Krishna Menon, Richard Nock, and Lizhen Qu Making deep neural networks robust to label noise: A loss correction approach. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 1944-1952, 2017.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Semidefinite relaxations for certifying ro- bustness to adversarial examples. arXiv preprint arXiv:1811.01057. 2018.
Scott Reed, Honglak Lee, Dragomir Anguelov, Christian Szegedy, Dumitru Erhan, and Andrew Rabinovich. Training deep neural networks on noisy labels with bootstrapping. arXiv preprint arXiv: 1412,656, 2014.
Hadi Salman, Greg Yang. Jemy Li. Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, and Sebastien Bubeck. Provably robust deep learning via adversarially trained smoothed classifiers. arXiv preprint 10tf::1900004884, 2019.
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras. and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp- 6106-6116 16, 2018.
Dávid Terjék. Adversarial lipschitz lipschitz regularization. In International Conference on Learning Repre- sentations, 2019.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures backdoor attacks. arXiv preprint
2018
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018
11

---

Under review as a conference paper at ICLR 2022
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Maurice Weber, Xiaojun Xu, Bojan Karlas, Ce Zhang, and Bo Li. Rab: Provable robustness against backdoor attacks. arXiv preprini arXiv:2003. 08904, 2020.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 0085552866999 PMLR, 2018.
Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks deep neural networks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communica- fions Security, pp. 2041-2055, 2019.
Kun Yi and Jianxin Wu. Probabilistic end-to-end noise correction for learning with noisy labels. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 7017- 7025, 2019.
Xingrui Yu, Bo Han, Jiangehao Yao, Gang Niu, Ivor Tsang, and Masashi Sugiyama. How does dis- agreement help generalization against label corruption? In International Conference Machine Learning, pp. 7164-7173, PMLR, 2019.
Xiaoyong Yuan, Pan He, Qile Zhu, and Xiaolin Li. Adversarial examples: Attacks and defenses for deep learning. IEEE transactions neural networks and learning systems, 30(9):2805-2824, 2019.
12

---

Under review as a conference paper at ICLR 2022
7
APPENDIX
In this section, we provided proof of theorem and more discussion.
7.1 PROOF EQUATION 3
1 Σ +
Σ xEX yEY
Φ +c,y) +
xEX,YEY
let G denote the initially clean sample set (i.e. (X, Y)), and B the corrupted sample (i.e. the training set corrupted with trigger whereas the labels are untouched). Let R denote the clean sample which is replaced by the adversary (i.e. R is the subset of G, and replaced by B, i.e.
g' = G RUE (X", Y)), and let &u denote the function Lo
One can decompose the inner part of our mini-max objective in Equation
2 as the following,
Σ
[C(f(x + c),y)
Σ
1 (x +c,y)+
Σ
(x + c.y)
n ER
xEX
VEG' 18
1
Σ
(x + c,y)+
dw [ + c.y)
+
Σ
o (x, + +tt
Σ ow + ct
n
n
7
IB
iER
1
Σ
(x +Gy)
Der Per + +c,y)
di +c
n
n
72
XEX yEY
VER
VEB
1
Σ
PNe (x +gy)
(
Σ
Dno (x; + +c,y)
Dw + +xxx
XEX yEX
EER
iEB
1
Σ
(x +c,) + +T||[|| v Σ
(x + ccy) tTL,
n
xEX
XEX WEY
7.2 PROOF OF THEOREM
Theorem. Let Remp, Remp, R, is defined above. Assume the prior distribution of the network parameter w (0, and the posterior distribution of parameter is N(w, σ) is the posterior parameter distribution, where is learned according training data. Let k to be the number of parameters, n to be the sample size, assume the objective function &w L a is La- lipschitz smooth, then, with probability at least 1-5, we have:
I k
1 (1
+ log + log(6n + 3k)
ko
R₂ < REmp + L2T +
Proof: first decompose the gap following
R₂- Remp -R; -R.m R.mp)
(Remp
-R. R.mp)
(R: R: 1(R R.mP))
13

---

Under review as a conference paper at ICLR 2022
We bound the second part first.
R,
Ro 1 R R
Σ
-(xx
Σ
o(x+t,y) E
o(x +xx
xEX,.yEY,
xEXu,YEY,
xEX,,EE,
$
Σ
10(x + +,y) 6(x + c, XEX.,VEY.
E
((x+t,y)
E
c(x+c,y)]
xEY.
XEXx,VEY.
2 (1 - L)
cll + & / - c|| + Ls max ||x0 - xbll
Xui
I (1- - e)
ell + cl| + e T |||
L - cl + cbolltil
< L EL |+||
S (2T + ET)
Now, bound the second term. Note the second term is typical gap term between empirical loss and generalization loss, and there are many approaches to bound this term like VC dimension. Since aimed to focus the deep neural network, we follow the PAC-Bayes framework McAllester (199)) to analyze the generalization bound. Specifically, we use results from Foret et al. (2020),
+ log
+lg # (og(6n++33k)
which gives posterior. The proof for this can be found in the appendix of Foret et al. (2020) (i.e. equation 13 on the paper).
kot
under the assumption of gaussian prior and
n-
7.3 DISCUSSION ABOUT LIPSCHITZ REGULARIZATION AND ADVERSARIAL TRAINING
As could from the above theorem that small lipschitz constant could bring robustness against backdoor attack. this section, we provided the reason why we claim adversarial training
helps lipschitz regularization. The definition of lipschitz function is [x f(y)l] < L||x yll, yx,y. y. Since the lipschitz constant showes in the upper bound of the error, we would like to get the minimum lipschitz constant to tighten the bound. Follow (Terjék] 2019), the minimum lipschitz constant can be expressed as:
dy(fxx),
||lll
sup x.VEX
dx(x,))
rewrite y as x + e, we would get
dy (f()))
|
sup x.c47 (2,xtc)
dx(xxx+1)
Minimize above objective respect to function reduces to the adversarial learning.
((x)
inf || inf f x,040xx;0<dxxe (2,0+c)
sup
dx(x,x+
we treat the denominator as a constant, then this exactly the same as our minimax objective. More details can be found in 2019).
7.4
SUPPLEMENTARY EXPERIMENT RESULTS
We provided the experiment hyperparameters, and supplementary results for the experiment.
7.4.1 EXPERIMENT HYPERPARAMETERS
We list the details of experiment in this section. All the methods resnet-32 the backbone network. A used as the opimitzer for all methods. The perturbation limit 7 is set to be 0.05 for all methods requiring 7. All methods repeated for three different random seeds to calculate the standard deviation.
The trigger for badnet attack and blending attack can be found in figure 2
14

---

Under review as a conference paper at ICLR 2022
0
5-
5-
5
10
10
15
15
15
20
20
20
25
25
25
30
30
0
10
20
20
30
(a) clean example
(b) badnet attack
(c) blend attack
Figure 2: Example of clean and various poisoned samples
7.4.2 EXPERIMENT ON MNIST
We found interesting results on MNIST. In MNIST, we found adversarial training itself sometimes gives robustness the backdoor attack. We hypothesis that this is because the MNIST is potentially a easier task than CIFAR. In here, we show the performance of adversarial training and PRL-AT on MNIST, The results can be found table
Backdoor Attack Defense Accuracy.
Dalaset
BrotStrap
Bootstrap
PRI..TT
SPL
SPL..AT
0,15
0.30 4 0.07
0,04 +: 0.01
3.17 +
97.96
2 0.21
98.44
+ 0.05
59.24
= 35.30
85.61 + 12.56
MNIST with Patch Allack,
0.25
0.26 1: 0.17
0.04 1: 0.02
0.17 1 0.10
89.91
1: 7.53
97.04
1. 1.07
25.25
1.38
30.70 1: 6.62
Poison Accuracy
0.35
0.10
0.02
0.08
+ 0.06
0.14 0.01
77.91
10.41
97.71
1: 0.18
13.54 0.76
26.03 4: 5.27
0,45
0.11 + 0.01
0.04 + 0.02
0,42 - 0.34
43.42
= 11.66
76.42
+: 8.65
12.85 + 1.90
10.97 = 2.16
0,15
98.17 + 0.69
99.49
0.05
95.48
: 1,56
98.08 + 0.26
98.44 + 0.05
93.23
+: 4.72
97.74 +: 0.37
MNIST with Patch Allack,
0.25
98.59
+: 0.22
99.48
0.07
98.83
0.19
97.46
:: 0.07
97.11
+: 1.06
86.98
0.72
85,89 :: 1.76
Clean Accuracy
0.35
94.48
4.87
99.48
0.04
98.45
0.32
97.40
1: 0.46
97,86
11 0.11
73.09
4.34
77.49
1: 0.96
0,45
98.27 = 0.43
99.42
0.02
96.44
= 1.36
75.69 + 0.99
92.32 + 4.25
60.58 + 1.90
57,20 - 0.37
0.15
63.42 1. 35.24
0.04 1: 0.01
9666 1: 2.58
96.81 1: 1.30
96. 74.74.11 1: 1.03
97.43 1: 0.13
96.16 1: 0.19
MNIST Blend Attack,
0.25
70.43
28.61
0.04
0.01
91.83
77.68
20.34
97.20
+ 0.66
+ 1.27
83.86 + 2.74
Polson Accuracy
0,35
58.32 + 40.59
0.05
0.03
91,94
= 0.57
78.79
17.74
97.59
+ 0.12
11.05 + 2.70
69.69 = 6.59
0.45
97.66 + 1.04
0.03
0.03
0.58 98.16
27.18
19.53
95.17
+ 1.83
4.49 + 1.08
64.78 + 3.14
0,15
64.78 + 33.81
99.44 = 0.02
98.29 + 0.81
97.93 + 0.25
96.18 + 1.44
97.30 0.22
95.93 + 0.20
MNIST Blend Attack,
0.25
99.46
97.30
97.10
83.34
Clean Accuracy
0,35
58.62 + 40.18
99.44
0.02
91.43 0.94
96.25
+ 1.84
97.39 + 0.19
72.41 3.80
67.92 8.38
0.45
96.78 = 1.42
99.22
0.06
97.89 + 0.61
76.47 + 8.66
95.07 + 1.59
63.63 4.47
63.82 = 4.12
(a) clean data for binary feature value and continuous feature value (b) label flipping attack on both binary feature value and continuous feature value
Figure 3: Example of label flipping attack on both binary feature value and continuous feature value
As we can see for the MNIST, especially for the blend attack, the poison accuracy for adversarial training does show good performance with a large standard deviation. This is because that some random seeds works while some random seed failed. We hypothesis that this is because MNIST
15

---

Under review as a conference paper at ICLR 2022
clean/poison accuracy
0.15
0.25
0.35
0.45
patch (PRL-AT)
80.25/80.15
78.22/78.14
75.10/75.04
58.90/58.90
patch(SpectraSSign)
80.32/35.90
80.40/29.02
72.01/51.59
24.01/24.10
patch(Fine Prunnnn
80.34/56.67
79.50/60.85
79.10/56.84
78.73/44.21
blend (PRI-AT)
67.97/68.48
71,28/71.87
74.12/74.32
61.78/54.19
blend (SpectralSign)
83,60/70.74
81.23/75.40
76,63/66.87
62,53/41.32
Blend((Fine-Punnngg
79,53/34.38
79.32/13.94
78.28/23.71
76.70/16.36
Table 7: Comparison of averaged performance across three random seed with other baselines on
CIFAR1O. The numbers are clean accuracy/poison accuracy. Note fine-pruning used 5% clean data
dataset has almost binary feature value. When adding small gaussian noise on feature x, the label flipping attack cannot change the decision boundary much. That is why the noisy label algorithm seems is not as important as the noisy label algorithm in CIFAR dataset. We plot two dimensional toy example in figure to illustrate label flipping attack on continuous features and binary features. As we can see in the figure that for the binary value feature, the label flipping attack is not easy to change the decision boundary too much while it can easily change the decision boundary in the continuous feature value scenario. However, this is very rough conjecture for the reason why in MNIST, adversarial training sometimes works. We leave the investigation of this phenomenon in the future work.
7.5 COMPARISON AGAINST OTHER BACKDOOR DEFENSE ALGORITHM
In this section, we show further results against other backdoor defense algorithms. There are many existing backdoor defense algorithms. However, we found that large fraction of those algorithms are either designed for single target attack (Liu et al. 2018) or requires clean data (Liu et al. 2018 Wang et al., 2019 Li et al. 2021). To investigate how our framework performs compared with the previous study, We compare against the following two baselines in a similar setting:
spectral signature (Tran al. 2018 ; filtering data by examining the score of projecting to singular vector.
fine-pruning (Liu et al. this method uses 5% clean training data.
2018): prune the model by deleting non-activated neurons. Note
The results are in the table 7 As we can see, PRL-AT has higher poisoned accuracy against Spectral Signature and Fine-Pruning on most settings while the clean accuracy is still high, which indicates the effectiveness of our algorithm. With high corruption ratio, we find that the robustness of spectral signature and fine-pruning significantly decreases while PRL-AT still gives reasonable poison accu- racy. Our theorem provides a principled way to design new defense algorithms by leveraging more knowledge from noisy label attacks. In this comparison, we only use PRL the noisy label algo- rithm, and potentially, by using a more powerful noisy label algorithm (i.e. combination of multiple methods), it is possible to get higher poisoning accuracy.
7.6 SENSITIVITY ANALYSIS OF THE E
One interesting question to ask is how our algorithm performs without knowing the corruption ratio. In this section, we provided the worst-case result, in which we fix e = 0.5 to perform the noisy label algorithm. When the ground truth corruption ratio is higher than a half, learn any meaningful classier. We test the PRL-AT in the CIFAR10 on both badnet and blending attacks. The results are table As we can see, our algorithm provides robustness even use highly- overestimated estimated compared with the standard training results in table 2 which suggests our algorithm is not sensitive to the hyperparameter e.
impossible to
7.7 DISCUSSION ABOUT NOISY LABEL ALGORITHM
One key question to ask for our framework is how to choose the noisy label algorithm. In terms of practice, we found PRL gives consistent robustness against both badnet and blending attacks on
16

---

Under review as a conference paper at ICLR 2022
corruption ratio
PRL-AT (patch)
PRL-AT (blend)
0.15
68.14/68.00
67.97/68.48
0.25
71.78/71.74
71.28/71887
0.35
74.26/74.15
74.17/74.32
0.45
69.91/27.02
64.78/54.19
Table 8: PRL-AT top averaged accuracy across three random seeds. The first number is the clean accuracy while the second number is the poisoned accuracy. The is fixed to be 0.5.
different settings. This might be because that PRL designed for agnostic corrupted supervision, which is suitable for variety of types of label noise attacks.
From a theoretical perspective, analyzing how different noisy label algorithm can minimize the first term of RHS in equation [ depends on which noisy label algorithm to use. Here we give rough analyze PRL. PRL guarantees converging to the e-approximated stationary point, where e the corrupted ratio. Formally, we have the following corollary:
Corollary (Convergence of PRL to clean objective (Liu et al. 202
Assuming the maximum
clean gradient before loss layer has bounded operator norm: e-fraction supervision corrupted data, yields (il T, where q is the dimension of the supervision.
S C, applying PRL any
E ([l (w,
((ev)) for large enough
More details be found the in Liu et al. solution get by PRI. algorithm, we can have
2021 According to above corollary, let WPRL the Rempp = (e) (i.e. assume is small). With
WPRL
constant ja such that 1 [Vf(')I 2 p(f(z) - f*)
Polyak-Lojasiewicz (PL) condition with
1
holds, we have (R - -Rempy S
2 WeRe RempI || O(c). For highly-overparameteiiel
deep neural network, the global optima Rempx is usually 0. Thus, we can conclude that with PI. condition, using PRL as the noisy label algorithm in framework can guarantee Remp can be
1 Oe)). This yields the following proposition:
minimized to the order
Proposition 1. Let T, eter w is (0,, a), and the posterior distribution of parameter is N N(w,o a) is the posterior parameter distribution, where is learned according to training data. Let to be the number of parameters, n to be the sample size, assume the obunctivefunction @w Lof is L -e-lipschitz smooth and satisfying
T, is defined as above. Assume the prior distribution of the network param-
1 the PL condition, which is 7 =/1V ll 2 p(ow ). then, with the assumption of bounded oper- ator norm of gradient before loss layer, we have with probability least 1-8, by applying PRL-AT, we have:
kkoog 1
w Ko
2
+ log o 2 2ogg(6n + 3k)
1 0 Lo +ET) + R2 < 14
In general, considering & is a deep neural network, we believe the first term is difficult to analyze without further assumption (i.e. PL condition). Nevertheless, empirical study shows that many noisy label algorithms can effectively minimize the first term loss, which motivates our method to treat those algorithms as a black-box algorithm.
17


Reviews:
[{"review_id": "weI8u9KxyGo", "reviewer": "Reviewer_62pH", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "### **Strengths**:\n\n— The authors present a novel optimization based approach to defend against poisoning attacks. Theoretical justification is provided to motivate the loss and the effect they have on robustness.\n\n— The proposed approach can be agnostic to the noisy label algorithm used during training, which makes it appealing to use with more advanced methods.\n\n### **Concerns**:\n\n— The experimental section is bit lacking. The proposed approach is not compared with previous defenses for noisy label attacks such as Spectral Signature defense.\n\n— More advanced attacks where clean label is used  HTBA (arXiv:1910.00033 ) and Clean label backdoor attacks by Turner et al. have been presented which make the attack more effective. The authors do not consider such attacks in their settings and it would be interesting to see if the proposed work can be adapted for such scenarios.\n\n— The organization of the work can be improved. The experiment section can include previous works for comparison and ablation studies along with hyperparameter related experiments can be considered in another section. This would make analyzing the experiments much easier.\n\n— For the Blend attack, PRL based method performs poorly compared to SPL method, but PRL-AT outperforms SPL-AT. This is seen in multiple settings. The authors mention that filtering based algorithms are more easily boosted, but it is not intuitively clear why? A better noisy label algorithm should correspond to better performance irrespective of AT. Such a case makes it difficult to identify which part of the algorithm is responsible for the improvement.\n\n— **Minor**: Some typos are present in the submitted version which can be corrected. Some of them include \n\n\"In the meantime, it is non-trival\"- \"non-trivial\"\n\n\" we can approximate rvc as the following\" - \"we can approximate c as the following\"\n\n\"resnet-32\"  - \"ResNet-32\"\n\n\"since these two attacks does not require knowing any information about the model or training procedure\" - \"since these two attacks do not require any information about the model or training procedure\".", "summary_of_the_paper": "The proposed work presents a defense algorithm for backdoor poisoning attacks. The authors consider a noisy label setting where the attacker adds a trigger to certain samples of training data and changes their label. This mainly consists of two attacks, BadNets and Blending attack. The authors then come up with an objective to train the network in a noisy label setting such that networks become robust to the poisoning attacks. ", "summary_of_the_review": "The authors presenting an interesting approach towards defending against backdoor attacks involving noisy label algorithm. However, a more thorough comparison with previous defenses and other forms of attacks is required to understand the significance of the method. An optimization based approach towards defending against both clean and noisy label attacks would be interesting.  ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "l6txADHOzOg", "reviewer": "Reviewer_tutw", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The idea of using techniques for dealing with noisy labels for defending against backdoor data poisoning attacks looks interesting and promising. The motivation and the derivation of the algorithm seem reasonable, although the proposed algorithm has some parameters whose selection can be critical for the performance on the clean dataset and the backdoors. \n\nI appreciate that the authors strived to provide a theoretical justification (Section 4.2) of the proposed algorithm. Thus, the authors propose a theorem that gives an upper bound for the risk given the empirical risk on the poisoned dataset with the clean labels (R_c^emp). The authors argue that the first term in the upper bound can be minimized by using a noisy label algorithm, but it is not clear what is the gap between the risk on the poisoned dataset with the flipped labels when using the noisy label algorithms. Can the authors provide some theoretical guarantee here? Perhaps the authors could shed a bit of light in this sense during the rebuttal. \n\nMy main concerns about the paper are on the experimental evaluation: \n1) The results in Tables 1 and 2 shows that the proposed method has a significant negative impact on the performance of the algorithm on the clean dataset, which limits the applicability of the method. \n\n2) The algorithms for mitigating the effect of noisy labels have parameters that assume the fraction of noisy labels that are present in the data. The influence of this parameter can be non-negligible and, a priori is not possible to foresee what is the fraction of poisoned training points for the backdoor attack. Similarly, the perturbation limit (\\tau) used for the adversarial training in the proposed algorithm can also have an impact both on the performance on the clean dataset and on the reduction of the success of the backdoor attacks. For example, if the value of epsilon used for SPL or PRL is very large (e.g. 0.45) and there is no backdoor attack or the amount of poisons is very low (e.g. 1%) the performance on the clean dataset could be severely affected. Conversely, if epsilon is low and the fraction of poisons is high, the algorithm may not be able to defend against the backdoor attack. Thus, setting the value of the parameters of the algorithm is not trivial. In this sense, the authors should provide a more comprehensive analysis on the impact of the parameters on the accuracy both on the clean and the poison accuracy.   \n\n3) The experimental evaluation lacks comparison with other existing methods to defend against backdoors.\n\n4) The scenarios with high levels of poisoning (e.g. 45%) are not really representative of a backdoor attack, where the objective of the attacker is to keep the performance of the resulting model when evaluated on the clean dataset. For large fractions of poisons, the performance on the clean dataset is severely affected as it can be observed in the tables with the results. \n\n5) The experiments only consider CIFAR datasets. I think it would be convenient to include experiments in other benchmarks and, ideally, using other model architectures. \n", "summary_of_the_paper": "The paper introduces an algorithm to defend against backdoor data poisoning attacks by leveraging noisy-label defense algorithms. Per se, noisy-label algorithms are not capable of defending against backdoors. However, the authors propose to use these techniques in combination with their proposed algorithm for adversarial training to reduce the effectiveness of backdoor data poisoning attacks. ", "summary_of_the_review": "The motivation for the proposed algorithm is interesting and promising. However, the empirical evaluation raises important concerns about the applicability and usefulness of the method to defend against backdoor poisoning attacks. On one side, the drop in performance on regular inputs when using the proposed technique is non-negligible and, on the other hand, the selection of the parameters of this algorithm can also have a significant impact both on the performance on the clean and the poisoned dataset (and it is not clear how to set this parameters properly). The experimental evaluation should be more comprehensive. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "knqhSmJcEGx", "reviewer": "Reviewer_MBRR", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\nBy adding noisy label to the training set and performing adversarial training at the same time, the noisy-label defense algorithm can be directly utilized to defense backdoor attacks. The method proposed is simple yet effective. The proof procedure is sufficient and details are provided.\n\nCons:\n1. In Table 2, it is unclear why Bootstrap-AT not perform well with respect to the improvement on the model robustness on CIFAR10 with Patch Attack. The authors did not provide any discussion.\n\n2. The computational cost of the method would be high since adding noisy label together with adversarial training takes much longer time. I suggest to provide a comparison and discussion on the times with other methods against backdoor attacks.\n\n3. The organization of this paper should be improved. The analysis on experiments is short and incomplete. \n\n4. There is a typo in your ‘Proof of Equation 3’. The range of the ∑ on the right-hand side of the first equation in the derivation should be i∈G\\R.\n", "summary_of_the_paper": "This paper aims to apply noisy-label defense algorithms to defend general backdoor attacks. The authors propose a meta-algorithm by adding noisy labels to the training set and optimizing outer minimization and inner maximization of the model by the noisy-label algorithm. Combined with adversarial training, the authors show their method could improve the robustness of models against backdoor attack.", "summary_of_the_review": "The authors theoretically proved that noisy-label defense algorithms can be leveraged to against backdoor attacks, but the method seems not very innovative, and the computational cost would be high compared with other methods.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "SzihJiM4no", "reviewer": "Reviewer_2ape", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n1. The paper is very well written and I really enjoyed reading it. Through a sequence of steps, the authors explained how they arrived at their final formulation and did a nice job in sketching the implication of their theoretical result. \n2. The connection between the noisy-label attack and the backdoor attack has been well explained and later well-exploited to arrive at the formulation and also the AT-based minimax optimization.\n3. For evaluation, the authors chose three noisy-label defenses (SPL, PRL, and Bootstrap) and demonstrated the efficacy of their meta-algorithms (SPL-AT, PRL-AT, Bootstrap-AT) in improving the defense accuracy on the CIFAR-10/CIFAR-100 datasets for two different attack settings.\n\nCons:\n1. One of the main issues I have is with the evaluation. The authors only provide a comparison with AT, and the noisy-label defenses, however, they do not provide any evidence as to how their algorithm compares to other poisoning defenses. In the absence of that comparison, it is difficult to assess the benefits of the defense proposed in this paper. \n\n2. Some insight about which noisy-label algorithm is better suited for the optimization would be beneficial. While the tables (Tables 2 and 3, and the ones with ablation results) do provide defense accuracies but it would be nice if the authors can provide any more insight if one defense is preferred over others. This also goes back to the assumption on the existence of at least one noisy-label defense that the authors mention in Pg. 4 (after Assumption 2). Can we use a mixture of defenses for the inner and outer optimizations?\n\n3. The authors mention that their technique is more beneficial in the large-scale poisoning regime ($\\epsilon=0.45$). In this regard, the numbers in Table 2 (for example) when $\\epsilon=0.45$ are interesting. Often plain AT provides a strong baseline (better than some of the re-inforced variants). Also, there is no real consistency between which of the three re-inforced defenses would do better for attacks. This links back to my earlier point about providing more insights into the choice of the noisy-label defense.\n\nClarifications:\n1. I could not understand the clean accuracy numbers in the evaluation. Maybe, I am missing something here, but I was expecting that it would correspond to the $\\epsilon=0$ setting. Does the 'Standard' column reflect the accuracy over the $(1-\\epsilon)$ fraction of non-poisoned data?\n\n2. In Section 4.2, it would be great if the authors can clarify why $\\tilde{\\mathcal{R}}^{emp}_t$ is not compared with $\\mathcal{R}_t$?\n\n3. The approximation from (4) through the Taylor Series expansion on to (5), especially the use of FGSM for (5) can be explained a little better.\n\n4. Typos:\na. \"but also can has\" -- pg 2 (last sentence)\nb. In Sec 4, the dataset is denoted as $(X^{\\epsilon}, Y^{\\epsilon})$, however, in the previous section they have been defined as  $(X_{\\epsilon}, Y_{\\epsilon})$. -- pg 4\nc. 'rvc' (maybe a latex equation label) is not defined (just above (5)) -- pg 5", "summary_of_the_paper": "The authors propose a defense against backdoor data poisoning attacks by leveraging (reinforcing) existing defenses against noisy-label attacks. ", "summary_of_the_review": "Please see the detailed comments in the main review section.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper proposes a new defense against backdoor attacks utilizing an improved version of defenses against noisy label attacks. The connection between these two problems is interesting and novel, which is acknowledge by all reviewers. The main drawback of the paper is, however, its experimental evaluation. The experiments are carried out only on one benchmark and the considered attack ratios are indicative for indiscriminative poisoning attacks rather than targeted backdoors. The AC addressed the summarized response and is not convinced that the reviews are biased. Despite the scarce response of the reviewers to the author rebuttal, the limitations of the experimental evaluation seem to persist in the revised version of the paper. While acknowledging the novelty and the overall good quality of the paper, the weakness of its experimental evaluation puts at in the position marginally below the acceptance threshold. The AC encourages the authors to revise the paper and improve on the pointed out weaknesses and is confident that this work will be well accepted by the scientific community.
Decision: Reject