Paper: Fine-Tuning Is All You Need to Mitigate Backdoor Attacks (ICLR-2024)

Reviewer comment (Experiments):
I am somewhat worried about the claim in this paper "Fine-Tuning Is All You Need to Mitigate Backdoor Attacks". IMHO, it is a little bit overclaimed. At a high level, the authors only evaluate against vision models. Whether fine-tuning is enough for NLP models is not evaluated. For this point of view, we cannot say that fine-tuning is enough for mitigating backdoor attacks.

Author response:
Sorry for the misunderstanding. We just want to highlight that fine-tuning can be used as an effective method to remove backdoor attacks.

Reviewer comment (Theory):
The proposed method needs better justification. Some design choices need to be justified.

Author response:
Thanks for your suggestions, we will make the statement in the paper that lr does not need to change linearly but just from the small learning rate to the large learning rate. We will specify in the paper that we use clean datasets for fine-tuning.  
Regarding the learning rate, we will add the process to find the best learning rate for each phase in the revised version. Initially, the finding process can be the traversal algorithm on the evaluated datasets. We show the initial results on CIFAR10 BadNets below:  

|                | super-fine-tuning | super-fine-tuning with the finding process |  
|----------------|-------------------|--------------------------------------------|  
| ASR before     | 0.945               | 0.945                                        |  
| ASR after      | 0.096               | 0.083                                        |

Reviewer comment (Experiments):
Not sure the reason why the lr changes linearly in each phase, can we use another annealing method?

Author response:
Thanks for your suggestions, we will make the statement in the paper that lr does not need to change linearly but just from the small learning rate to the large learning rate. We will specify in the paper that we use clean datasets for fine-tuning.  
Regarding the learning rate, we will add the process to find the best learning rate for each phase in the revised version. Initially, the finding process can be the traversal algorithm on the evaluated datasets. We show the initial results on CIFAR10 BadNets below:  

|                | super-fine-tuning | super-fine-tuning with the finding process |  
|----------------|-------------------|--------------------------------------------|  
| ASR before     | 0.945               | 0.945                                        |  
| ASR after      | 0.096               | 0.083                                        |

Reviewer comment (Experiments):
I assume the fine-tuning is using only the clean data, but this is not explicitly specified.

Author response:
Thanks for your suggestions, we will make the statement in the paper that lr does not need to change linearly but just from the small learning rate to the large learning rate. We will specify in the paper that we use clean datasets for fine-tuning.  
Regarding the learning rate, we will add the process to find the best learning rate for each phase in the revised version. Initially, the finding process can be the traversal algorithm on the evaluated datasets. We show the initial results on CIFAR10 BadNets below:  

|                | super-fine-tuning | super-fine-tuning with the finding process |  
|----------------|-------------------|--------------------------------------------|  
| ASR before     | 0.945               | 0.945                                        |  
| ASR after      | 0.096               | 0.083                                        |

Reviewer comment (Experiments):
As mentioned in the paper, the defense efficacy depends largely on the learning rates, and it is very sensitive to the learning rate. With that said, I am worried about how to select the proper learning rate for different models. The tuning process might be tricky and requires a lot of effort and trials.

Author response:
Thanks for your suggestions, we will make the statement in the paper that lr does not need to change linearly but just from the small learning rate to the large learning rate. We will specify in the paper that we use clean datasets for fine-tuning.  
Regarding the learning rate, we will add the process to find the best learning rate for each phase in the revised version. Initially, the finding process can be the traversal algorithm on the evaluated datasets. We show the initial results on CIFAR10 BadNets below:  

|                | super-fine-tuning | super-fine-tuning with the finding process |  
|----------------|-------------------|--------------------------------------------|  
| ASR before     | 0.945               | 0.945                                        |  
| ASR after      | 0.096               | 0.083                                        |

Reviewer comment (Reproducibility):
It is not sure whether changing trigger pattern and size will affect the fine-tuning process. Actually, the paper does not specify what type of triggers are used.

Author response:
Thanks for your suggestions, we will add the analysis on the effectiveness of the trigger pattern and trigger size. Here we show some initial results on the trigger size.  

|                | 2x2|3x3 | 4x4|  
|----------------|-------------------|--------------------------------------------|--------------------------------------------|  
| ASR before super-fine-tuning     | 0.974               | 0.945                                        | 0.996 |  
| ASR after  super-fine-tuning    | 0.102               | 0.096                                       | 0.132 |

Reviewer comment (Experiments):
The authors should evaluate their method under more complicated datasets, such as ImageNet or its subset.

Author response:
Thanks for your suggestion. We will conduct more experiments on the large-scale datasets.

Reviewer comment (Experiments):
I think the authors should compare their method with more advanced backdoor-removal defenses. All compared baseline defenses are at least two years before and their performance is still some way from the SOTA methods.

Author response:
We will add more defense for the comparison in the revised paper. Note that we compared super-fine-tuning with fine-pruning, neural cleanse, and many other defenses which are already considered as the state-of-the-art defense method.

Reviewer comment (Experiments):
The number of studied attacks is still not sufficient to show that fine-tuning IS ALL YOU NEED. The authors should include more attacks to make the claim more convincing.

Author response:
Thanks for your suggestions. We will add more attacks in the revised version. Note that all attacks considered in this paper are state-of-the-art attacks.

Reviewer comment (Experiments):
The more challenging scenario is the standalone scenario which should be tested more thoroughly. Several attacks fail the transfer learning scenario even without defense, so it is hard to believe it is the proposed method that works.

Author response:
Several attacks fail the transfer settings proving that fine-tuning is an effective method to remove backdoor attacks. Note that we already consider more cases in the standalone setting.

Reviewer comment (Evaluation):
In the standalone scenario, in Figure 4, the Inputaware-GTSRB subplot, the ASR of super-fine-tuning is above 40%, but this was not analyzed in the paper. In Figure 3, the ASR of super-fine-tuning is only around 20%, which means the defense performance is not as strong as claimed in the text, i.e., the attacker can still succeed in 5 shots. This was also not analyzed.

Author response:
Even though the ASR of super-fine-tuning is about 40%, it is still more effective than other existing defense methods as we have shown in Figure 6.

Reviewer comment (Experiments):
The effectiveness and efficiency comparison missed the pruning-based methods, like [1,3], which I believe achieved the SOTA defense performance and efficiency. The advantage of the fine-tuning based method is not clear when compared with pruning-based methods which also leverage fine-tuning.

Author response:
We show the performance of fine-pruning in Figure 6. It can be concluded that super-fine-tuning can achieve better ASR and CA while having a lower cost.

Reviewer comment (Experiments):
Missing the consideration of adaptive attacks, i.e., what if the adversary knows the adaptive learning rate scheduler and adapts its trigger injection to evade the meta-fine-tuning — could it be possible?

Author response:
We appreciate your suggestion and try two different adaptive attacks by adding the fine-tuning process into the backdoor injection phase or affecting as few neurons as possible. We show the results below. It can be concluded that it is still very hard for the adversary to bypass the fine-tuning even if they know the defense. We will add more explanation in the revision phase.

|                 | adaptive1 | adaptive2 |
|-----------------|-----------|-----------|
| ASR before fine-tuning | 0.874     | 0.912     |
| ASR after fine-tuning  | 0.132     | 0.097     |

Reviewer comment (Experiments):
It is a strong statement to say that "Fine-tuning and super-fine-tuning is sufficient in most cases" in *Conclusion*. I believe more experiments in different model architectures are required to conclude this statement since currently only *ResNet18* is being utilized.

Author response:
> Too strong statement in the conclusion.

We will add more experiments on different architecture in our revised paper. Here we show some results on MobileNet on CIFAR10 BadNets in the standalone scenario.

|                |  super-fine-tuning |
|----------------|--------------------------------------------|
| ASR before     |   0.934                                      |
| ASR after      |  0.091                                        |

Reviewer comment (Experiments):
It seems like the epoch of both phases in *super-fine-tuning* is a variable that is worth discussing. Experiments on how the number of epochs of the *First Phase* affects the performance of mitigation might be necessary.

Author response:
> How to decide epochs.

 Thanks for the suggestions, we will add more experiments on the effects of the epochs in our paper.

Reviewer comment (Presentation):
For the plots of *Accuracy(ASR or CA) vs Epoch*, I suggest making them consistent by showing the initial ASR and CA at Epoch 0 since it could show the models' original behavior. For example, *Figure 3* doesn't contain Epoch 0, and *Figure 4* contains Epoch 0.

Author response:
> Figure issues and limitation

Thanks for your suggestions, we will modify the figures and add the limitation part in our revised verison.

Reviewer comment (Experiments):
What is the limitation of *conventional fine-tuning* or *super-fine-tuning*? For example, are there any attacking tasks, poison ratio of the dataset, or dataset size that could greatly impact the mitigation performance? This might be worth mentioning in a *Discussion* section if possible.

Author response:
> Figure issues and limitation

Thanks for your suggestions, we will modify the figures and add the limitation part in our revised verison.

Reviewer comment (Reproducibility):
In a transfer learning scenario, does the proposed defense recommend to freeze the feature extraction layers during fine-tuning? Typically, in transfer learning, it's common practice to freeze the feature extraction layers and fine-tune only the classification layers. However, the authors assert that their defense approach comes with zero computational cost in the context of transfer learning. It is important to clarify whether, in this zero-cost defense, users should still freeze the feature extraction layers and only fine-tune the classification layers. If not, it implies that this defense may not truly have zero computational cost in the general case of transfer learning scenarios.

Author response:
> Statement of zero cost should be changed.

Fine-tuning here is the method we propose to defend against backdoor attacks. Therefore, we do not need to follow the original transfer settings methods. We will change our statement about no cost in the revised version.

Reviewer comment (Experiments):
It seems that there are related works that perform fine-tuning with varying learning rates while utilizing a smaller validation set in contrast to the entire training dataset employed in the proposed defense. For instance, "NNoculation: Catching BadNets in the Wild."

Author response:
> Related work should be discussed.

Our experiments only take a small amount of data for fine-tuning. Compared to the NNoclulation, we consider more state-of-the-art attacks in our paper. Also, NNoclulation only used a large learning rate to retrain the model which is different than our paper.

Reviewer comment (Experiments):
How did the authors determine the base learning rate, maximum learning rate, and the number of fine-tuning steps? Providing insight into the rationale behind these choices, along with a framework for tuning the hyperparameters of the defense, would significantly enhance the paper's generalizability. Without such guidance, the proposed hyperparameter values in the paper may not be universally applicable to all datasets and model architectures. For example, setting the maximum learning rate to 0.01, as suggested in the ResNet paper, may limit the defense's effectiveness when applied to different model architectures. It's essential to include the computational costs associated with hyperparameter tuning in the evaluation of the defense.

Author response:
> How to decide learning rate.

We determine the learning rate based on the previous works’ suggestions. For the LR-MAX, we follow the setting in super-convergence. for the LR-base, we follow the original Resnet paper. We will add the process to find the best learning rate for each phase in the revised version. Initially, the finding process can be the traversal algorithm on the evaluated datasets. We show the initial results on CIFAR10 BadNets below:
|                | super-fine-tuning | super-fine-tuning with the finding process |
|----------------|-------------------|--------------------------------------------|
| ASR before     | 0.945               | 0.945                                        |
| ASR after      | 0.096               | 0.083                                        |

Reviewer comment (Experiments):
The intuition behind super-fine-tuning is not entirely clear to me. By employing an exceedingly high learning rate, the model appears to discard not only the backdoor but also the utility it previously learned. Subsequently, using a smaller learning rate aids in relearning the utility. In essence, this process seems equivalent to training a model from scratch with randomly initialized weights in the standalone scenario. It would be helpful to provide further clarification on this point, perhaps by comparing the proposed defense to training the entire model from scratch with randomly initialized weights while utilizing the same computational resources and ensuring proper hyperparameter tuning.

Author response:
> The intuition behind super-fine-tuning.

Thanks for your suggestions. We admit that the process of super-fine-tuning can make the model forget some of the previous clean images. However, from the figures shown in our paper, the CA has not dropped. Therefore, we still consider super-fine-tuning as an effective method to remove backdoors while maintaining utility.

Reviewer comment (Theory):
Kindly discuss the limitation of the proposed defense. It's worth noting that backdooring can still be a threat in situations where a user has ample computational resources but lacks access to high-quality, clean training data. This might be due to privacy concerns or the prohibitive costs of labeling data. In such cases, it's important to discuss the applicability of the proposed defense, especially since it assumes access to the entire clean training dataset.

Author response:
> Lack of limitation

Thanks for your suggestion, we will add the limitation part in our paper.