Title: Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Deep Learning, Adversarial Learning, Backdoor Detection

Abstract: Most post-training backdoor detection methods rely on attacked models exhibiting extreme outlier detection statistics for the target class of an attack, compared to non-target classes. However, these approaches may fail: (1) when some (non-target) classes are easily discriminable from all others, in which case they may ${\it naturally}$ achieve extreme detection statistics (e.g., decision confidence); and (2) when the backdoor is subtle, i.e., with its features weak relative to intrinsic class-discriminative features. A key observation is that the backdoor target class has contributions to its detection statistic from both the backdoor trigger ${\it and}$ from its intrinsic features, whereas non-target classes ${\it only}$ have contributions from their intrinsic features. To achieve more sensitive detectors, we thus propose to ${\it suppress}$ intrinsic features while optimizing the detection statistic for a given class. For non-target classes, such suppression will drastically reduce the achievable statistic, whereas for the target class the (significant) contribution from the backdoor trigger remains. In practice, we formulate a constrained optimization problem, leveraging a small set of clean examples from a given class, and optimizing the detection statistic while orthogonalizing with respect to the class’s intrinsic features. We dub this approach ``class subspace orthogonalization’’ (CSO). 
CSO can be applied to a wide variety of existing detectors.
We demonstrate its effectiveness in improving several well-known detectors, comparing with a variety of baseline detectors, against a variety of attacks, on the CIFAR-10, GTSRB, and TinyImageNet domains. Moreover, we also evaluate against a novel mixed clean/dirty-label poisoning attack that is more surgical and harder to detect than traditional dirty-label attacks, as well as against adaptive attackers.