Learning from Distinction: Mitigating backdoors using a low-capacity model

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-03 19:08:14

Abstract: Deep neural networks (DNNs) are susceptible to backdoor attacks due to their black-box nature and lack of interpretability. Backdoor attacks intend to manipulate the model's prediction when hidden backdoors are activated by predefined triggers. Although considerable progress has been made in backdoor detection and removal at the model deployment stage, an effective defense against backdoor attacks during the training time is still under-explored. In this paper, we propose a novel training-time backdoor defense method called Learning from Distinction (LfD), allowing training a backdoor-free model on the backdoor-poisoned data. LfD uses a low-capacity model as a teacher to guide the learning of a backdoor-free student model via a dynamic weighting strategy. Extensive experiments on CIFAR-10, GTSRB and ImageNet-subset datasets show that LfD significantly reduces attack success rates to 0.67\%, 6.14\% and 1.42\%, respectively, with minimal impact on clean accuracy (less than 1\%, 3\% and 1\%).

Main paper: 
 introduction: 
 Deep neural networks (DNNs) have achieved unprecedented success due to their remarkable performance in many applications, such as image classification (Russakovsky et al., 2015) , object detection (Zou et al., 2023) , and traffic accident detection (Ijjina et al., 2019; Jiansheng et al., 2014) . Its superiority relies on model training on large datasets using intensive computational resources (Rosenfeld et al., 2019) . In this process, if the data is obtained from third-party data sources or the model is trained on a third-party platform, the attacker is able to add predefined triggers to the data samples (Gu et al., 2017; Nguyen & Tran, 2020; Barni et al., 2019) or directly modify the model's parameters to implant a backdoor into the model (Dumford & Scheirer, 2020; Rakin et al., 2020; Chen et al., 2021) . In addition, using pre-trained models or outsourced Machine Learning as a Service (MLaaS) provide attackers the opportunity to backdoor the model, though they may offer substantial performance improvements at a low cost. As a result, the attacked models perform normally on clean data, whereas misclassifying specific data to the target class when predefined triggers are activated, which poses a severe security threat to DNN applications (Gu et al., 2017; Tran et al., 2018) .To alleviate this threat, existing defense methods can be categorized into two aspects: backdoor detection methods (Tran et al., 2018; Goldblum et al., 2022; Gao et al., 2019) and backdoor removal methods (Kolouri et al., 2020; Wang et al., 2020; Chen et al., 2019b) . Backdoor detection methods aim to identify whether a given model contains a backdoor trigger or whether a given dataset contains poisoned data. Backdoor removal methods are designed to remove backdoors during or after the model training process while preserving the model performance. Although the after-training removal methods have shown promising defense results, their effectiveness relies on the availability of clean data, rendering them unsuitable for scenarios where clean data is not accessible (Liu et al., 2018; Wu & Wang, 2021) . Training-time removal methods aim to detect potential poisoned data during the training of the model and prevent the model from learning from these poisoned data so as to obtain a backdoor-free model (Levine & Feizi, 2021; Jia et al., 2021; Li et al., 2021) . Such methods implemented during training often involve utilizing additional datasets to identify poisoned data (Tran et al., 2018; Hayase et al., 2021a) or training multiple models ensemble (Goldblum et al., 2022; Levine & Feizi, 2021; Jia et al., 2021) , often suffering from significant computational costs. Recently, Li et al. proposed a two-stage unlearning technique (ABL) that allows for training a clean model on a poisoned dataset (Li et al., 2021) . However, this method presents challenges in terms of inaccurate data isolation and reduced accuracy of purified model. Currently, effective defense meth-ods against backdoor attacks during the training phase remain a crucial problem and need further exploration.To fulfill the requirement of effectively mitigating backdoors during training, this study proposes a novel training-time defense method named Learning from Distinction (LfD), which allows training a backdoor-free model on backdoor-poisoned data. Specifically, LfD has two stages. In the first stage, it fine-tunes a low-capacity model on the backdoor-poisoned dataset for a few epochs and then utilizes this model as a teacher model to supervise the training of a backdoor-free student model. In the second stage, a dynamic weighting strategy is adopted during training to flexibly select the poisoned data from the poisoned datasets. We theoretically analyze the reason why low-capacity models can act as the teacher to help with backdoor defenses. Empirical results across various datasets and model architectures demonstrate that our proposed LfD method achieves superior performance compared to existing state-of-the-art defenses.In summary, our contributions are as follows:• We present the impact of model capacity on the distinction of the loss value between backdoored and clean data during training. Utilizing a lower capacity model makes the distinction of the loss value between backdoored and clean data more prominent, which can contribute to identifying the poisoned data.• We propose a novel training-time backdoor defense method called Learning from Distinction (LfD), which allows training a clean student model on a backdoored dataset with the help of a low-capacity teacher model.• We conduct extensive experiments on CIFAR-10, GTSRB and ImageNet-subset datasets to validate the effectiveness of LfD against 9 well-known backdoor attacks. The results show that LfD outperforms existing state-of-the-art defenses and significantly reduces attack success rate with minor impact on clean accuracy. 
related work: 
 2.1 BACKDOOR ATTACKS Existing backdoor attacks can be classified into two main categories: (1) Dirty-label attacks insert trigger patterns into data and change their labels to a specific target label, associating the trigger with the target label. Gu et al. first introduced backdoor attacks in deep learning (Gu et al., 2017) . Subsequently, several studies focused on making poisoned data indistinguishable from clean data to evade human inspection, some of them replace triggers with subtle perturbations (Turner et al., 2019; Zhong et al., 2020; Li et al., 2020a; Moosavi-Dezfooli et al., 2017) , and others disperse the trigger to a much larger area of the image (Liu et al., 2020; Barni et al., 2019) . However, in the above attacks, the source labels of the poisoned data are still different from the target label, making them detectable by examining the image-label relationship.(2) Clean-label attacks only modify the data whose source labels are the same as the target label. Hence, they do not need to change the data's label, making them more covert compared to dirty-label attacks. Several studies focus on modifying data and adding easy-to-learn trigger patterns on them to perform clean-label attacks (Turner et al., 2019; Barni et al., 2019) . Nevertheless, compared to dirty-label attacks, clean-label attacks often suffer from lower attack success rate (Li et al., 2022; Zhao et al., 2020b) .Recently, numerous defense methods have been proposed to mitigate the threat of backdoor attacks.Existing defense methods can be broadly categorized into two categories based on when they take effect: (1) The defense methods adopted during the model deployment phase aim to detect whether the input data (Tran et al., 2018; Gao et al., 2019; Chen et al., 2019a; Xu et al., 2021; Hayase et al., 2021b; Tang et al., 2021) or the model (Wang et al., 2019; Chen et al., 2019b; Kolouri et al., 2020; Shen et al., 2021) has been backdoor-poisoned and to remove the existing backdoor in the backdoor-poisoned model (Zhao et al., 2020a; Li et al., 2020b; Wu & Wang, 2021) . The anomaly input detection methods employ the concept of outlier detection to filter out backdoor-poisoned data (Du et al., 2019; Gao et al., 2019; Subedar et al., 2019; Jin et al., 2020; Javaheripi et al., 2020) , while the backdoored model detection methods utilize meta-classifiers (Kolouri et al., 2020; Huang et al., 2019; Xu et al., 2021) or analyze the model's internal structure (Liu et al., 2019; Zheng et al., 2021) to identify the presence of backdoors. Unlike detection methods, removal methods' purpose is to eliminate the impact of backdoor attacks. Some removal methods reconstruct the trigger and employ fine-tuning to repair the model (Wang et al., 2019; Chen et al., 2022; Dong et al., 2021; Guan et al., 2022; Tao et al., 2022) . Apart from those trigger-reconstruct defenses, other approaches have been widely applied in removal backdoors, e.g., pruning (Wu & Wang, 2021; Liu et al., 2018; Zheng et al., 2022) and model distillation (Li et al., 2020b) . ( 2) Training-time backdoor defense methods intend to train backdoor-free models on backdoor-poisoned datasets. Some approaches achieve this by extracting features of clean data from additional datasets to identify the poisoned data in the training dataset (Tran et al., 2018; Hayase et al., 2021a) . Other approaches, on the other hand, focus on training multiple model ensembles and applying voting mechanisms to mitigate the impact of poisoned data (Goldblum et al., 2022; Levine & Feizi, 2021; Jia et al., 2021) . Recently, Anti-backdoor learning (ABL) isolates a portion of poisoned data and unlearns these data in the last few epochs of training to eliminate the backdoor (Li et al., 2021) . However, unlearning can lead to the loss of semantic features and a decrease in the accuracy of the model. Our proposed defense method LfD belongs to the training-time backdoor defense method. 
background and preliminary analysis: 
 In this section, we first present the utilization of gradient ascent training for backdoor defense. Subsequently, we delineate our observations regarding distinct learning behaviors between the losses of poisoned and clean data . Finally, we propose a method to amplify this distinction.In the backdoor attack scenario, the goal of the adversary is to inject triggers into the model by solving an optimization problem as follows:EQUATIONwhere t represents the number of training epochs, D clean and D poison represent the set of clean data and poisoned data, respectively, D clean ∪ D poison = D train , and ℓ(•) denotes the loss function which computes the distance between the predicted label f θ (x) and the ground truth label y. Then, the minimum value of the loss is calculated by using the gradient descent optimization method, thereby improving model's classification accuracy. This equation indicates that the entire learning task is decomposed into two sub-tasks: one is to minimize f θ on clean data, and the other is to minimize f θ on poisoned data. Therefore, the trained backdoored model exhibits high classification accuracy on clean data and high attack success rate on poisoned data.To mitigate the impact of backdoor attacks on the model, the gradient ascent training method can be employed to alleviate the influence of poisoned data (Li et al., 2021) . The process is as follows:EQUATIONAs shown in the above equation, maximizing the loss of poisoned data can effectively amplify the distance between model predictions and their labels, i.e., target labels. This prevents the model from classifying poisoned data as the target label, thus reducing the model's attack success rate. Therefore, if we can devise a method for precisely identifying poisoned data within the dataset, we can integrate it with the gradient ascent training approach to mitigate the impact of backdoor attacks on the model.Previous studies have identified poisoned data within datasets through the analysis of data loss. This is owing to the nature of backdoor attacks, which require the establishment of explicit associations between triggers and target labels to ensure that poisoned data is classified into the target label rather than its ground truth label. Consequently, poisoned data is found to be more easily learnable than clean data, resulting in lower losses (Li et al., 2021) . To demonstrate this inference, we apply three classic backdoor attacks, named BadNets (Gu et al., 2017 ), Dynamic(Nguyen & Tran, 2020) , and SIG (Barni et al., 2019) to construct three poisoned datasets with an injection rate of 10% on CIFAR-10 training data. Subsequently, we train the ResNet-18 model (He et al., 2016) on these poisoned datasets following the same configurations in Section 5. As shown in Figure 1a , 1b, 1c, for all three types of backdoor attacks, the average loss of clean data is higher than that of poisoned data, and this trend is more significant in the early stages of training. The above observations suggest that the loss of poisoned data is usually lower than that of clean data, especially in the early stage.However, this method of identifying poisoned data has its shortcomings. Despite the significant difference in average losses between poisoned and clean data, there is still a possibility of poisoned data having losses similar to that of clean data. In Figure 2 , we plot the number of poisoned data with losses greater than the average loss of clean data at the early training stage on the ResNet-18 model, and it is evident that such poisoned data exist in three poisoned datasets. Since some powerful backdoor attacks can succeed with just a tiny number of poisoned data (Li et al., 2021) , it is necessary to employ a strategy that amplifies the distinction in the losses of these two types of data in order to accurately identify the poisoned data in the dataset. Tran, 2020) , and Dynamic (Barni et al., 2019) . The experiments were conducted on the CIFAR-10 dataset (Krizhevsky, 2009) with a poisoning rate of 10%.The capacity of a neural network model signifies the complexity of features it can learn. A model's capacity can be measured through its intricacy, such as the quantity of neurons of the model. Based on prior research, the generalization error of neural networks can be approximately formalized to a function of the model and dataset size (Rosenfeld et al., 2019) . Given a fixed dataset size, the following equation holds:EQUATIONwhere ε denotes the classification error on the test dataset, m denotes the number of parameters in the model, β(β ≥ 0) control the global rate at which error decreases with the sizes of the model, i = √ -1, and c ∞ (c ∞ > 0) is the asymptotic lower value attainable. Here the simple pole at η controls the transition point from the initial random-guess level ϵ 0 as (m) increase.The above equation showed that the classification error increases as the number of model parameters decreases. This implies that the model's capability to accurately classify data decreases with a reduction in its capacity. Moreover, since the loss of data measures the classificatuon accurcy As depicted in Figure 1 , across various backdoor attack scenarios, the average loss of clean data on ResNet-S is notably higher than that on ResNet-18. However, the average loss of poisoned data exhibits no significant disparity between these two models. The above findings validate our proposition that, despite the difficulty of ResNet-S in learning clean data due to its low capacity, it still has the ability to learn poisoned data, which leads to a more pronounced distinction in the average loss between the two types of data on ResNet-S. Stage 1: Fine-tuning a f θ teacher capable of distinguishing between clean and poisoned data sets.First and foremost, we require a f θ teacher capable of distinguishing between clean and poisoned data within D train . Drawing insights from the observations described in Section 3, it becomes evident that models with low capacity face challenges in classifying clean data. Nevertheless, these models still exhibit an intrinsic aptitude for adeptly classifying poisoned data, especially during the initial phases of training. This phenomenon engenders a noticeable discrepancy in losses between these two data categories. Consequently, we embark on creating a low-capacity model by reducing the number of neurons within the model, followed by subjecting it to a few epochs of fine-tuning solely on D train . This maneuver ensures a pronounced dissimilarity between poisoned and clean data on this model. Subsequently, this model assumes a pivotal role in the context of Learning from Distinction (LfD), functioning as the cornerstone of f θ teacher .Stage 2: Utilizing f θ teacher for the dynamic discrimination of poisoned data to supervise the training process of a backdoor-free model f θ student . Subsequently, we identify potential poisoned data within D train based on their losses on f θ teacher , followed by gradient ascent training on these identified data to train a clean f θ student on D train . This stage aims to mitigate the impact of poisoned data in the training process of f θ student . To identify the poisoned data within D train , we initially adaptively establish a threshold based on the losses of data in D train on f θ teacher :EQUATIONwhere n represents the number of data in D train , and α is a hyperparameter, the DT() function first calculates the losses of all data points in D train with respect to f teacher , then sorts the losses in ascending order, and selects the loss at the index-th position as the threshold. We perform gradient ascent training on the data in D train with losses below this threshold. Specifically, as shown in Equation 1, when updating f θ student , we subtract the losses of these data points to decrease the probability of f θ student classifying them into their labels. Though we cannot guarantee that the loss of every poisoned data in D train is below the threshold, training a substantial portion of the poisoned data with gradient ascent can still mitigate the impact of these unrecognized poisoned data. Therefore, the loss function employed for updating f θ student is presented as follows:EQUATIONHowever, the gradient ascent training method may have an impact on the accuracy of f θ student on clean data as we presented in Section 5.2. We posit that this phenomenon arises due to the some clean data instances have losses below the threshold, and performing gradient ascent training on these data reduces the classification accuracy of f θ student . Therefore, we introduce a weighting method that dynamically assigns weights to data to determine their significance during training, thereby mitigating the impact of gradient ascent training on the accuracy of f θ student . The weight for each data in D train is computed as follows:EQUATIONwhere the weight of data (x, y) is denoted as w (x,y) in the equation, the hyperparameter β determines the importance of gradient ascent training relative to gradient descent training. Different from equation 5, equation 6 calculates L(θ t ) by considering the weight of each data point based on its loss on f θ teacher . Compared to the solely unweighted gradient ascent training, even when some clean data possess losses below the threshold and are assigned negative weights, their relatively lower losses compared to most poisoned data result in lower absolute values of their negative weights. Consequently, the impact on the clean accuracy of f θ student on clean data is limited. 
experiment: 
 We evaluated our LfD defense method against seven dirty-label backdoor attacks and two cleanlabel backdoor attacks on CIFAR-10(Krizhevsky, 2009) , GTSRB (Stallkamp et al., 2012) , and an ImageNet subset (Deng et al., 2009) . Specifically, dirty-label attacks include BadNets with white square pattern (referred to as BN-W) (Gu et al., 2017) , BadNets with grid square pattern (referred to as BN-G) (Gu et al., 2017) , Trojan attack with square pattern (referred to as TJ-SQ) (Liu et al., 2017) , Trojan attack with watermark pattern (referred to as TJ-WM) (Liu et al., 2017) , l2-Invisible attack (referred to as L2) (Li et al., 2020a) , Dynamic attack (Nguyen & Tran, 2020) , Blend attack (Chen et al., 2017) , and clean-label attacks include Sinusoidal signal attack (referred to as SIG) (Barni et al., 2019) and Clean-Label attack (referred to as CL) (Turner et al., 2018) . Detailed configurations of each backdoor attack are provided in Appendix A.1.On the CIFAR-10 and ImageNet-subset dataset, we set α = 0.15 and β = 1e -3, while on the GT-SRB dataset, we set α = 0.2 and β = 3e -3. We employed ResNet-S as f θ teacher across all three datasets and utilized ResNet-18 as f θ student on CIFAR-10 and GTSRB, while on the ImageNetsubset, we employed ResNet-34 as f θ student . During the fine-tuning of f θ teacher , no data augmentation is applied. For the training of f θ student , we employ random cropping and random horizontal flipping as data augmentation. We compare LfD with three state-of-the-art defense methods: Finepruning (FP) (Liu et al., 2018) , Activation-Cluster (AC) (Chen et al., 2019a) , and Anti-Backdoor Learning (ABL) (Li et al., 2021) . For FP, AC, and ABL, we follow the configurations specified in their original papers, including the use of available clean data for fine-tuning/repair/training settings. Further defense details can be found in the appendix A.2.Metrics We employ two metrics to evaluate the effectiveness of LfD. The first one is Clean Accuracy (CA), which measures the accuracy of f θ student in classifying clean test data. The second metric is Attack Success Rate (ASR), which quantifies the probability of f θ student classifying poisoned test data as the target label.Table 1 presents the LfD results on the CIFAR-10, GTSRB, and ImageNet-subset datasets. Evidently, our LfD demonstrates optimal performance in reducing ASR while maintaining a high CA in most backdoor attacks. Compared to the best-performing defense method ABL, our LfD reduces the average ASR by 7.68% (0.52% vs. 8.20%), 7.86% (11.31% vs. 19.17%), and 36.10% (1.42% vs. 37.52%) on CIFAR-10, GTSRB, and the ImageNet-subset datasets, respectively. This advantage becomes more pronounced compared to other defense methods.We note that our LfD is not always the best when considering each attack individually. For instance, ABL exhibits the best defense against TJ-WM and Dynamic attacks on GTSRB. We suspect that this is due to the similarity between the triggers used in these two attacks and the feature of normal images. We suspect this is because even clean data may contain patterns similar to the trigger, making the detection of poisoned data more challenging (Zhao et al., 2021) . If LfD fails to identify the majority of poisoned data, its defense effectiveness will be weakened. This limitation represents one of the shortcomings of our LfD approach and requires further improvement in future work.Maintaining CA and reducing ASR are equally important, as significant degradation of CA suggests difficulties in correctly classifying clean data, rendering the method impractical. By examining the results in Table 1 , we can observe that our LfD achieves higher CA than other defense methods in most scenarios. Specifically, our LfD outperforms ABL in terms of average CA on CIFAR-10, GTSRB, and ImageNet-subset by 5.56% (92.09% vs. 86.53%), 4.79% (93.42% vs. 88.63%), and 4.91% (90.97% vs. 86.06%), respectively. This demonstrates the practicality of our LfD defense for industrial applications where performance and security are equally important. Effect of Hyperparameter α The variable α controls the amount of data used in gradient ascent training. We present the performance of f θ student under four different settings in Figure 4b , where α takes values of 1, 10, 15, and 50, respectively. The results demonstrate that a higher α leads to a better defense against backdoor attacks in LfD, as more poisoned data are isolated during training. However, we observed that increasing α also leads to a loss in CA, as more clean data in the gradient ascent training process can affect the model's performance.Effect of Hyperparameter β The variable β controls the importance of gradient ascent training relative to gradient descent training. We present the performance of f θ student under four different settings in Figure 4b , where β takes values of 0, 1e-4, 1e-3, and 1e-2. The results demonstrate that a higher β leads to a lower ASR as the intensity of gradient ascent training on poisoned data increases. However, we note that a high β may also result in a loss of CA, as gradient ascent training on some clean data is also intensified.Effect of f θ teacher 's capacity The capacity of f θ teacher influences the complexity of features it is capable of learning. We present in Figure 4a the CA and ASR of f θ student when utilizing four distinct models as f θ teacher . The models employed are all derived from ResNet architecture,they are ResNet-S1(RN-S1)<ResNet-S(RN-S)<ResNet-S2(RN-S2)<ResNet-18(RN-18), and their detailed structures are provided in Appendix A.3. The results indicate that when the capacity of f θ teacher is high, its capacity to learn complex features is enhanced. This results in a significant number of clean data instances having losses similar to those of poisoned data, subsequently prompting LfD to engage in gradient ascent training on a large number of clean data. Consequently, the CA of f θ student diminishes. Conversely, when f θ teacher has a excessively low capacity, its aptitude to learn features becomes exceedingly feeble, rendering it challenging to learn clean data and the majority of poisoned data. This results in the majority of clean and poisoned data have high losses. As a result, many poisoned data is either assigned positive weights or weights close to zero. Hence, the CA and ASR of f θ student remain largely unaffected. the poisoned trainset. Then, we extracted the activation values of all data in layer 4 of the training dataset and applied the K-means clustering algorithm to cluster them into two clusters. Finally, we trained a new model from scratch using the cluster with more data. All defense methods were trained with Random Crop (padding = 4) and Random Horizontal Flip.We employed various models in our experiments. In this section, we describe the architectures of all the small-size models we used.We based our modifications on the ResNet architecture, altering the number of neurons and blocks to create ResNet-S, ResNet-S1, and ResNet-S2. For ResNet-S, ResNet-S1, and ResNet-S2, the first four layers consist of only one block each. In ResNet-S, these blocks contain 2, 2, 2, and 4 neurons respectively. For ResNet-S1, each block in the first four layers contains 1 neuron. In the case of ResNet-S2, the number of neurons in the blocks of the first four layers are 64, 128, 256, and 512 respectively.For the VGG network, we modified the number of neurons in each convolutional layer to obtain the VGG-S network. Specifically, in the VGG-S network, the number of neurons in each convolutional layer are set as 4, 8, 16, 16, 32, 32, 32, and 512 , respectively.Finally, we made modifications to the MobileNetV2 network and obtained the MobileNetV2-S network. MobileNetV2-S consists of 2 bottlenecks, where bottleneck 1 contains 1 block with 3 convolutional layers, and the number of neurons in each layer is 4, 4, and 8 respectively. Bottleneck 2 contains 2 blocks, each with 3 convolutional layers, and the number of neurons in the two blocks' convolutional layers are 4, 4, 8 and 8, 8, 8 respectively. In addition, there are 2 convolutional layers outside the bottleneck, where the number of neurons is 4 and 16 respectively.A.4 EXPLORATION ACROSS VARIOUS MODEL ARCHITECTURES We constructed low-capacity models on several other model architectures (described in detail in Appendix A.3) for additional exploration. As shown in Figure 6 , the results indicate that the distinction in average loss between poisoned and clean data is consistently greater in low-capacity models 
 
 Appendix:  


Decision: The paper introduces a novel training-time backdoor defense method, guided by a low-capacity model.  Reviewers generally consider the method novel and effective and the experiments are comprehensive (to a large extent). Although some issues were raised, they were well addressed during rebuttal. All reviewers support acceptance.

Reviews: review: paper_summary: paper_summary: The paper introduces a novel training-time backdoor defense method called Learning from Distinction (LfD). It focuses on using low-capacity models and dynamic discriminative strategies to reduce backdoor attacks in deep neural networks (DNNs), which enhances the robustness of the model, its acceptance of malicious attacks and its ability to maintain a high accuracy rate when using clean data. Experimental results show that the method can effectively reduce the success rate of malicious attacks and improve the accuracy of clean data.
strength_weakness: strength_weakness: 1. Backdoor defence methods used in this paper take a low-capacity model to guide the training of a backdoor-free student model. Unlike traditional backdoor defence methods, the security of the model can be further improved.
2. The paper conducts extensive experiments on CIFAR-10, GTSRB, and ImageNet-subset datasets to evaluate the performance of LfD against various backdoor attacks. The results show that the success rate of the attack is dramatically reduced and does not affect the accuracy of the plot data, and the whole evaluation process is more comprehensive.
limitations: limitations: 1. This paper can be further improved by expanding the experimental section to include a wider range of datasets, especially those with different complexities and characteristics.
2. There are many state-of-the-art backdoor defence methods now. Please compare with more baselines to illustrate the superiority of the methods.
3. Even a clean model theoretically has a very small attack success rate. Why is it directly 0 in this paper?
paper_summary: paper_summary: The paper proposes a new training-time backdoor defense method called Learning from Distinction (LfD), to counter backdoor attacks in neural networks. While traditional backdoor defense methods focus on detection and removal, LfD aims to prevent the learning of backdoor features during model training. The paper observed the impact of model capacity on the distinction of loss values between backdoored and clean data during training. Based on these observations, LfD utilizes a low-capacity model as a teacher to guide the learning of a backdoor-free student model through dynamic weighting. Experiments on various datasets demonstrate that LfD significantly reduces attack success rates while minimally affecting clean accuracy.
strength_weakness: strength_weakness: 1. The paper theoretically analyzes the reason why low-capacity models can act as the teacher to help with backdoor defenses.

2. This paper conducts sufficient ablation studies to verify the effectiveness of each stage and each hyperparameter in the method.

3. The paper is well-written and easy to follow.
limitations: limitations: 1. The threat model of the paper is not clear. LfD needs to control the training process of the model, however, some backdoor attack methods also need to control the training process of the model, such as Dynamic. How does the LfD defend against the attacks in this situation?

2. This paper only analyzed three kinds of backdoor attacks in the preliminary analysis, which cannot reflect the general characteristics of existing SOTA backdoor attacks.

3. The paper lacks comparisons against the SOTA backdoor attacks in the experiments, such as  WaNet [1], ISSBA [2] and BPP [3].

[1] Nguyen et al. ‘‘Wanet-imperceptible warping-based backdoor attack.’’ ICLR 2021

[2] Li et al. ‘‘Invisible backdoor attack with sample-specific triggers.’’ ICCV 2021

[3] Wang et al. ‘‘Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learn.’’ CVPR 2022
paper_summary: paper_summary: This paper studies the backdoor defense of deep neural networks, proposing a training-time backdoor defense method based on distinguishing the loss value between backdoored and clean data during training. The method consists of two stages. Firstly, it trains a low-capacity model and utilizes it as a teacher model to supervise the backdoor-free student model. In the second stage, a dynamic weighting strategy is employed to select poisoned data from the poisoned datasets. Evaluations conducted on CIFAR-10, GTSRB, and ImageNet-subset datasets demonstrate the effectiveness of the proposed method.
strength_weakness: strength_weakness: - The paper is overall well structured. In particular, the preliminary analysis and the method part are logically coherent and structured clearly. 
- The proposed approach is interesting and is effective against 9 well-known backdoor attacks.
- This paper reveals a highly important observation in backdoor attacks.
limitations: limitations: - Figure 4 demonstrates that three hyperparameters (f_{teacher}, \alpha, \beta) are highly sensitive, which may limit the practical applicability of this method. In practical scenarios, how can a defender select these three hyperparameters without knowing the attack information?
- The baseline choices for the evaluation are not up to date. The authors have overlooked some recently published backdoor defenses (e.g., [1-2]).
- (Not limitations) I'm curious about the relationship between teacher models and student models. Specifically, are there any interesting connections in terms of parameters and architecture? Additionally, what experimental conclusions can be drawn if the pre-training dataset is very large?

[1] Wang, Liu, et al. "Backdoor Defense via Deconfounded Representation Learning" CVPR 2023.

[2] Huang, Li, et al. "Backdoor defense via decoupling the training process" ICLR 2022.
paper_summary: paper_summary: The paper starts their work from the observation that poisoned samples have higher loss comparing to the clean samples and this phenomenon is more obvious in low-capacity models. Sufficient exploration on different model architectures and different datasets have verified this point. Based on these, Learning From Distinction(LFD) exploits a low-capacity teacher model to train a clean student model on backdoored datasets. Sufficient experiments on different datasets against 9 attacks show the method's effectiveness. Ablation study on hyper-parameters is enough to verify the method's correctness.
strength_weakness: strength_weakness: 1. The observation of the huge loss descrepacy on low-capacity models is novel and has good contribution to the whole paper.
2. Extensive Experiments on various datasets shows good effect on defense.
3. The paper is well-organized and easy to follow.
4. The weighted method successfully utilizes the teacher model to supervise the student model to train a backdoor-free model.
limitations: limitations: Limitations:
1. The better performance of the benign accuracy comparing to the normal train on Imagenet should also be discussed.
2. High ASR on GTSRB against TJ-SQ is needed to be analyzed.
3. The construction of low-capacity model seems have no unified standards. How do the authors select the number of neurons in each layer?
4. The differences of the low-capacity model and the standard model is not clear enough. The comparison of the amount of parameters are better for the readers. Besides, the amount of the low-capacity models' parameters is also an important part needed to be discussed which can greatly enrich the whole paper.
5. Only ResNet models are explored in the main experiments, it would be better to show the vgg's results in the main experiments tables.

Suggestions:
1. It would be better to add the following citations:"Backdoor Defense via Adaptively Splitting Poisoned Dataset" "Backdoor Defense via Decoupling the Training Process" "Backdoor Defense via Suppressing Model Shortcuts"

2. It would be better to test the LFD on ISSBA.
"Invisible Backdoor Attack with Sample-Specific Triggers"