Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples
Abstract
Poisoning-based backdoor attacks are serious threat for training deep models on data from untrustworthy sources.
Given a backdoored model, we observe that the feature representations of poisoned samples with trigger are more sensitive to transformations than those of clean samples.
It inspires us to design a simple sensitivity metric, called feature consistency towards transformations (FCT) , to distinguish poisoned samples from clean samples in the untrustworthy training set.
Moreover, we propose two effective backdoor defense methods.
Built upon a sample-distinguishment module utilizing the FCT metric, the first method trains a secure model from scratch using a two-stage secure training module.
And the second method removes backdoor from a backdoored model with a backdoor removal module which alternatively unlearns the distinguished poisoned samples and relearns the distinguished clean samples.
Extensive results on three benchmark datasets demonstrate the superior defense performance against eight types of backdoor attacks, to state-of-the-art backdoor defenses.
Codes are available at: https://github.com/SCLBD/Effective_backdoor_defense.
Introduction
Training deep neural networks (DNNs) often requires a large amount of training data, which is sometimes obtained from a third-party untrustworthy source.
However, the untrustworthy data may bring serious security threats.
One of the typical threats is the poisoning-based backdoor attack [1], which could inject undesired backdoor—the correlation between trigger(s) and target class(es)—into the model through maliciously poisoning a few training samples.
Specifically, as shown in the top left of Fig. 1, each poisoned sample is attached with a trigger (see a small grid patch) at the bottom right corner, and relabelled as a target class.
Consequently, the trained backdoored model will predict clean samples very well, but is likely to predict any sample with the trigger to be the target class.
It has been observed in [2] that poisoned samples with triggers are likely to gather together in the feature space of a backdoored model, as shown in the top right of Fig.
Note that these poisoned samples contain diverse objects (may be from different source classes), but the information from these objects seems to be ignored by the backdoor model.
In other words, the feature representations of poisoned samples are dominated by the triggers, rather than the objects.
We conjecture that such a domination is mainly due to the overfitting to the triggers by the backdoor model, since triggers across different poisoned samples are much less diverse than objects.
To verify this conjecture, we propose to slightly perturb both poisoned and clean samples, such as rotation transformation.
As shown in the bottom right of Fig.
1, there is no longer gathering of poisoned samples in the feature space, and they are located close to samples of their source classes, i.e. , the dominance of triggers over other objects disappears, which verifies the triggers overfitting.
P o
i s o n e d ( l a b e l 0 )
C l ea n ( C l a ss 1 ) ...
Before Transformations
After Transformations ...
Before Transformations
After Transformations
Input ...
[Figure]
l ea n ( C l a ss 1 ) P o
i s o n e d ( l a b e l 0 )
[Figure]
Besides, although the feature representations of clean samples are also affected by transformations, their changes are much smaller than those of poisoned samples.
In other words, poisoned samples are more sensitive to transformations than clean samples.
It inspires that poisoned samples could be distinguished from clean samples according to the sensitivity to transformations, which is measured by a simple sensitivity metric, called feature consistency towards transformations (FCT).
In our experiments, the precision of the distinguished clean and poisoned samples is nearly 100% in most cases, respectively.
In this work, we aim to obtain a secure model ( i.e. , high-performance and without backdoor) based on an untrustworthy training set.
To this end, we consider two defense paradigms: one is training a secure model from scratch, while the other is firstly training a backdoored model using standard supervised learning, and then removing backdoor from the backdoored model.
Under paradigm 1, we propose an innovative secure training method, called Distinguishment and Secure Training (D-ST) , which consists of two consecutive modules.
The first sample-distinguishment (SD) module splits the whole training set into clean, poisoned and uncertain samples, according to the FCT metric.
The second twostage secure training (ST) module firstly learns the feature extractor via semi-supervised contrastive learning, and then learns the classifier via minimizing a mixed cross-entropy loss.
Under paradigm 2, we propose an innovative backdoor removal method, called Distinguishment and Backdoor Removal (D-BR) , which consists of the SD module and a backdoor removal (BR) module .
BR module alternatively unlearns the distinguished poisoned samples and learns the distinguished clean samples.
Extensive experiments are conducted to verify the superior defense performance of the above two proposed methods, as well as effectiveness of each individual module.
The main contributions of this work are three-folds.
(1) We demonstrate the sensitivity of poisoned samples to transformations, which is mainly due to the overfitting to trigger, and propose a simple sensitivity metric to distinguish poisoned samples from clean samples.
(2) We propose two effective backdoor defense methods for training a secure model from scratch and removing backdoor from the backdoored model, respectively.
(3) Extensive experiments on 3 benchmark datasets show the superior performance of the proposed defense methods against 8 widely used backdoor attacks, tostate-of-the-art defense methods.
Related work
Backdoor attack.
In poisoning-based backdoor attacks, the attacker attaches a few training samples with trigger(s) , and relabel them as target class(es) .
Existing attacks can be categorized according to a variety of criteria as follows.
(1) Size of trigger: Patch-based attacks [1, 5, 6] craft patch-like triggers while in blend-based attacks [7, 8], triggers capture the whole image.
(2) Visibility of trigger: Visible attacks [1, 6] design visible but not suspicious triggers while invisible attacks [8, 9, 10] propose invisible and still effective ones.
(3) Variability of trigger: Triggers are invariant in sample-agnostic attacks [1, 7, 11] while vary with samples in sample-specific attacks [9, 12].
(4) Label-consistency: If poisoned samples are chosen from samples with target class, then we call these attacks as clean-label attacks [11, 13, 12, 14].
Otherwise, we name them as dirty-label attacks [1, 6, 7, 8].
(5) Number of
Secure Model
[Figure]
Dataset
Paradigm2: Backdoor Removal
StandardSupervisedTraining
Paradigm1: Secure Training from Scratch
Backdoored Model
StandardSupervisedTraining
FCT Metric
Backdoored Model
Unlearning
Relearning
STModule
Semi-SupervisedContrastiveLearning
Secure Feature Extractor
Minimizing Mixed Cross-EntropyLoss ...
... SDModule
BRModule
Stage
Stage 2 Secure Classifier
[Figure]
target classes: All2one attacks [1, 6, 7, 8] designate one class as the target class while in all2all attacks [1], poisoned samples are relabelled as the next class.
There are also other attacks [15, 16, 17, 18, 19] that require the attacker to control the training process, which are out of scope of this paper.
The attack performance of the methods above can be referred to the Backdoorbench [20].
Backdoor defense.
In general, there are two types of defense paradigms against poisoning-based backdoor attacks—secure training and backdoor removal.
Mainstream defense methods belong to the latter one, which leverage the model properties [21, 22, 23] or the feature space characteristics [24, 5, 25, 26, 27, 28, 29] of a backdoored model, to remove the hidden backdoor.
For instance, FP [21] observes that some neurons are activated by poisoned samples while others are by clean samples.
AC [24] notices the difference in size between the cluster of clean target samples and that of poisoned samples.
So far, there is still few works for the former defense.
Secure training attempts to train a secure model from scratch, preventing backdoor inserted during training.
The core point lies in how to distinguish poisoned samples from clean samples.
The first method DBD [2] uses the loss values, the symmetric cross-entropy loss particularly, to distinguish samples during training while our proposed secure training method, i.e. , D-ST, leverages the property that the feature representations of poisoned samples in a backdoored model are more sensitive to transformations than those of clean samples, to distinguish samples in advance of the training.
Proposed method 3.1 Problem formulation
Threat model.
In this paper, we consider the threat model of poisoning-based backdoor attacks, where the attacker can manipulate a few samples in the original clean training set D train =
D c ∪ { ( x i , y i ) } m p
i
=1 , with D c
= { ( x i , y i ) } m c
i =1 indicating the unmanipulated subset.
For the remaining m p samples, each sample x i ∈ X is fused with a trigger δ to form a poisoned sample ¯ x i
= x i ⊕ δ with ⊕ being the fusion operator.
Meanwhile, its label y i
∈
Y is also changed to a target class t .
Then, a poisoned training set is constructed, denoted as ¯ D train ≡ D c ∪ D p , with D p = { (¯ x i , t ) }
m p
i =1 .
When a user downloads ¯ D train and trains a DNN classifier g θ : X → Y based on ¯ D train using the standard supervised learning algorithm, it may learn a undesired backdoor, i.e. , a stable mapping from the trigger δ to the target class t .
Consequently, for any new sample with the trigger δ , it is likely to be predicted as the target class t .
Note that the user does not know which sample is poisoned or clean.
Defense goal.
Given the poisoned training set ¯ D train , the defender aims to obtain a high-performance model g θ without backdoor, i.e. , a secure model.
In this work, we consider two different paradigms:
• Paradigm 1 : a secure model is directly trained from scratch, as described in Section 3.3.
• Paradigm 2 : a backdoored model is firstly trained using the standard supervised learning, then the backdoor is removed from the backdoored model, as described in Section 3.4.
3.2 Sensitivity of poisoned samples
Sensitivity metric.
As illustrated in Section 1 and Fig.
1, we have found that the poisoned samples are much more sensitive to transformations than the clean samples in a backdoored model.
To accurately measure such a difference, we propose a simple metric, feature consistency towards transformations (FCT) .
Specifically, given a backdoored model g θ trained on ¯ D train with f θ e ( · ) indicating its feature extractor, and a set of transformations τ ( e.g. , rotation, scaling, will be specified in experiments), for any sample x (poisoned or clean), the FCT metric is formulated as follows:
[Equation]
It measures the change of the feature representation due to the transformations τ .
If ∆ trans ( x ; τ, f ) is large, then it means that x is sensitive to τ , otherwise stable.
For clarity, we use ∆ trans ( x ) hereafter.
[Figure]
Sample-distinguishment module.
Utilizing
FCT, we develop a sample-distinguishment (SD) module.
Specifically, we firstly train a backdoored model g θ based on ¯ D train using the standard supervised learning algorithm with a few epochs (explained in Appendix A.1).
Then, we calculate ∆ trans ( x i ) , ∀ x i ∈ ¯ D train , and plot the histogram.
As shown in Fig.
3, where two representative backdoor attacks are evaluated, there is remarkable difference on the distribution between the poisoned and the clean samples in both histograms.
It demonstrates that ∆ trans is a good metric to distinguish the poisoned samples from the clean samples in ¯ D train .
Based on the sensitivity histogram, we set two proportion values α c , α p ∈ [0 , 1] .
The samples with the bottom- α c ∆ trans values are separated to a subset of clean samples ˆ D c , while those with the top- α p ∆ trans values are separated into a subset of poisoned samples ˆ D p , while the remaining samples are partitioned as an uncertain subset denoted as ˆ D u .
We have ¯ D train =
ˆ D c ∪ ˆ D p ∪ ˆ D u .
More details are in Algorithm 1 in Appendix A.
3.3 Method for paradigm 1: secure training from scratch
Here, we consider the backdoor defense under paradigm 1.
We propose an innovative secure training method, called Distinguishment and Secure Training (D-ST) method.
As illustrated in Fig.
2, D-ST consists of the SD module (see above) and a two-stage secure training (ST) module , which is described as follows.
Details of the D-ST method are summarized in Algorithm 3 in Appendix A.2..
Stage 1: learning feature extractor via semi-supervised contrastive learning (SS-CTL).
Our method is inspired by a recent backdoor defense method called DBD [2], which proposed to learn a good feature extractor f θ e based on ¯ D train using a self-supervised learning algorithm, i.e. , contrastive learning (CTL).
Consequently, the feature representations of samples with similar appearances will be similar, and poisoned samples with triggers cannot gather together to form the backdoor.
Note that all labels have been abandoned in DBD before the extractor learning since there is no way to identify poisoned samples in advance of the learning, leading to the waste of the valuable information contained in clean samples.
Fortunately, the proposed SD module could identify some clean samples.
Thus, inspired by the supervised contrastive learning (S-CTL) [30], which has shown to learn a feature extractor with better performance than CTL, we propose a novel learning called semi-supervised contrastive learning (SS-CTL) , to learn f θ e by minimizing the following loss function:
[Equation]
where the contrastive loss ℓ CTL encourages the two augmented versions ˜ x (1) i , ˜ x (2)
i ( e.g. , cropping, details are introduced in Appendix C) of a sample x i to be close in the feature space, while the supervised contrastive loss ℓ S − CTL additionally encourages the feature representations of two clean augmented samples from the same class to be close.
In this work, we instantiate ℓ CTL as the contrastive loss defined in [31] and ℓ S − CTL as the SupCon loss defined in [30].
Stage 2: learning classifier via minimizing the mixed cross-entropy loss.
Given the feature extractor f θ e learned in stage 1, we then learn the classifier h θ c by minimizing the following mixed cross-entropy (MCE) loss:
[Equation]
where the first term is the standard cross-entropy loss defined based on the distinguished clean samples ˆ
D c , while the second term is the negative cross-entropy loss defined based on the distinguished poisoned samples ˆ D p , which is used to eliminate the effect of poisoned samples.
λ p ∈ R
+ is a trade-off parameter between two losses.
3.4 Method for paradigm 2: backdoor removal
Here we consider the backdoor defense under paradigm 2.
We propose an innovative backdoor removal method, called Distinguishment and Backdoor Removal (D-BR) method.
As illustrated in
Fig.
2, D-BR consists of the SD module (see Section 3.2) and a backdoor removal (BR) module .
The BR module aims to remove the backdoor from the backdoored model, i.e. , the backdoor is no longer activated by the trigger, while keeping the high performance on clean samples.
To this end, the BR module implements an iterative learning algorithm, which consists of two alternating steps, i.e. , unlearning and relearning .
The D-BR method is summarized in Algorithm 4 in Appendix A.3.
Unlearning.
This step aims to eliminate the effect of the trigger, through unlearning [32] the poisoned samples in ˆ D p distinguished by the SD module, as follows:
[Equation]
Relearning.
After conducting the above unlearning step for one epoch, although the effect of poisoned samples is somewhat eliminated, in experiments we find that the performance on clean samples is also degraded to some extent.
Thus, we want to relearn the mapping from the clean objects to the ground-truth classes based on clean samples in ˆ D c distinguished by the SD module, as follows:
[Equation]
Note that both unlearning and relearning are run for one epoch in each round.
Experiments 4.1 Experimental settings
Attack configurations.
According to the taxonomy described in Section 2, we consider 8 typical poisoning-based backdoor attacks by choosing at least one method from each category, including:
BadNets [1] using two attack types (BadNets-all2one, BadNets-all2all), Trojan backdoor attack [6] (Trojan), Blend backdoor attack using two different patterns (Blend-Signal, Blend-Kitty) 2 [7], Cleanlabel backdoor (CL) [13], Sinusoidal signal backdoor attack (SIG) [11], Sample-specific backdoor attack (SSBA) [9].
We evaluate all attacks on 3 benchmark datasets, CIFAR-10 [3], CIFAR-100 [3] and an ImageNet subset [33, 9], with ResNet-18 [34] as the base model.
Poisoning rate is set to 10% in all attacks.
Due to the space limit, more implementations details about attacks can be found in
Appendix C.3.
Defense configurations.
We first compare the proposed D-ST method with DBD [2].
Since studies with this secure-training paradigm are limited, we additionally add 2 baselines for comparison which are detailed in Section 4.2.
We then compare the proposed D-BR method with 5 state-of-the-art methods with the same backdoor-removal paradigm: the standard fine-tuning FT, ANP [22], NAD [35], MCR [36] and ABL [37].
For methods requiring extra clean data, 1% of the clean training samples are provided.
Other configurations are set as clarified in the original papers.
In summary, we consider 6 state-of-the-art defense methods and 2 additional baselines.
More implementations details can be found in Appendix C.4.
For our proposed methods, we use α c = 20% , α p = 5% and τ = rotate+affine in all experiments.
Other details can be seen in Appendix C.5.
Evaluation metrics.
We evaluate the defense performance adopting two commonly used metrics: accuracy on clean samples (ACC) and attack success rate (ASR), i.e. , accuracy of predicting poisoned samples as the target label.
4.2 Experimental results
Effectiveness of D-ST method.
We first consider paradigm 1—secure training from scratch.
Performance of different defense methods against various attacks on CIFAR-10 and CIFAR-100 is demonstrated in Table 1.
An ideal defense method is supposed to increase ACC while keep ASR as low as possible.
Thus, a larger ACC-ASR indicates a better method.
We mark the best result in boldface.
Note that we only report results on successful attacks where ASR is higher than 85%.
[Table]
DBD fails in most attacks on CIFAR-10 and CIFAR-100, probably due to the failure of the symmetric cross-entropy to distinguish samples.
By comparison, the good performance reached by D-ST illustrates the accurate distinguishment from the FCT-based SD module.
We additionally introduce two feasible baselines without requiring special knowledge.
Baseline1 first uses SimCLR [31] to train the feature extractor and then trains the classifier on the poisoned dataset with standard supervised learning.
By comparison, Baseline2 leverages S-CTL [30] to train the feature extractor.
We focus on discussing the effect of different extractor-training algorithms on defense performance.
More discussions are in the later experiments.
Baseline 1 reveals that training extractor without labels may result in low ASR (<5% / <20% in some cases on CIFAR-10 / CIFAR-100), but will sacrifice ACC definitely (84.65% / 56.47% on average).
While Baseline 2 demonstrates that training extractor with all labels guarantees high ACC (93.43% / 71.12% on average), but also brings high ASR (93.73% / 100% on average).
By contrast, results of D-ST illustrate the effectiveness of ST module in training the feature extractor in a secure way since ACC is high (91.66% / 67.79% on average) and ASR (1.21% / 0.05% on average) is extremely low.
Effectiveness of D-BR method.
Then, we consider paradigm 2—backdoor removal.
Defense performance of different defense methods against various attacks on CIFAR-10 and CIFAR-100 is demonstrated in Table 2.
Results on ImageNet is shown in Table 5 in Appendix D.
Results on CIFAR-10.
We discover that except for FT and MCR, other selected methods generally reduce ACC markedly.
Additionally, they have two common disadvantages.
(1) They can not take effect on all attacks.
For example, ANP can defend against Trojan and Blend attacks (ASR < 1%) while fails in clean-label attacks, i.e. SIG and CL (ASR > 10%).
(2) There exists at least one attack that can disable the methods (ASR > 50%).
By contrast, the proposed D-BR method overcomes these drawbacks.
It not only maintains ACC as large as that of backdoored model, but also reduces ASR to less than 1% on all attacks, verifying the effectiveness of the BR module and the high precision of the distinguishment conducted by the SD module.
[Table]
Results on CIFAR-100.
Although FT and NAD have a relatively high ACC (> 68%), they fail to reduce ASR (91.46% and 74.83% on average).
While ANP and ABL can decrease ASR to less than 0.1%, they sacrifice too much ACC (66.59% and 57.69% on average).
Among the selected methods,
MCR performs the best (ACC = 73.80% on average, ASR < 0.5% in three cases), but it still fails to defend against the Blend-Kitty attack (ASR = 20.60%).
Note that MCR requires extra clean data.
In contrast, D-BR keeps ACC higher than 72%, while reduces ASR to almost 0% without any extra clean data.
4.3 Ablation studies
Effectiveness of the SD module.
Here, we aim to study the effectiveness of the SD module.
Specifically, we will show how our proposed FCT metric, performs better than other metrics, under the backdoor-removal paradigm for illustration.
To this end, we select three existing metrics for comparison.
Spectral signatures [5] specifies the metric as the correlation with the top singular vector of the covariance matrix of feature representations .
DBD [2] assigns symmetric cross-entropy loss as the metric.
The metric used in ABL [37] is loss value applied with local gradient ascent .
The metric values of clean samples are smaller than those of poisoned samples according to the former two metrics, while larger for the third metric.
For fair comparison, we uniformly set α c = 20% , α p = 5% .
We first apply the metric-replaced SD module on the poisoned training set, and then conduct the BR module based on the distinguished samples.
Results are shown in Fig.
[Figure]
The height of the blue bar above the orange bar suggests how well the metric could distinguish.
As shown in Fig.
4 (a,b,d), orange bars are all higher than blue bars for Spectral signatures and DBD, indicating metrics of which fail to distinguish in BadNets, Blend and CL attacks.
In contrast, the metric of ABL is reliable since ABL performs well in most cases except for Blend attack where ASR is 24.72%.
By comparison, our proposed FCT metric could distinguish samples stably well, resulting in extremely low ASR (< 0.5%) on all attacks.
We attribute the success to that FCT exploits the sensitivity of poisoned samples, which is mainly due to the overfitting to trigger by the backdoored model that exists in all backdoor attacks we have evaluated in this paper.
Effectiveness of the BR module.
Here, we focus on studying the effectiveness of the BR module.
Specifically, we aim to show how the iterative learning algorithm consisting of unlearning and relearning performs better than the pure unlearning adopted by [37] or pure relearning .
To this end, we first conduct the SD module, and then apply different learning algorithms.
For the three algorithms, we run 20 epochs on CIFAR-10 and record the variations of Test ACC and Test ASR which are illustrated as Fig.
[Figure]
Although pure unlearning (red lines) effectively decreases ASR, it could hardy maintain ACC, showing a downward trend.
The results indicate a strict requirement for choosing the number of unlearning epochs.
On the contrary, pure relearning (green lines) can keep ACC stably high, but it takes tiny effect in reducing ASR.
By contrast, unlearning+relearning (blue lines) combines their advantages and successfully diminishes ASR while maintains ACC.
ACC and ASR steadily converge to high and low values, respectively, validating the effectiveness and the stability of the BR module.
Effectiveness of the ST module.
Here, we aim to study the effectiveness of the ST Module.
Backdoor can be injected during training the feature extractor f
θ e and the classifier h θ c .
The final defense performance of g θ depends on how well f θ e and h θ c inhibit backdoor.
Firstly, we want to show how SS-CTL performs better than CTL or S-CTL in training a secure feature extractor f θ e .
To this end, we train f θ e with different learning algorithms and then uniformly leverage
L MCE to train h θ c .
Training f θ e with CTL, as shown in the first row in Table 3, guarantees low ASR, but the low ACC turns into a tradeoff.
Note that the low ASR is the joint effort of CTL and L MCE .
And the usage of CTL does not indicate low ASR definitely, but it indeed reduces the possibility of backdoor injection in f θ e
The second row illustrates that S-CTL could bring high ACC and the potentially high ASR, as seen in the SIG and CL attacks.
Since all labels (including poisoned) are used in this scenario, ACC is reasonably high.
Besides, backdoor is already injected into f θ e .
But due to the inhibition effect of L MCE , the ASR of g θ may not be high.
For example, in dirty-label attacks, i.e. BadNets, Trojan and Blend attacks, ASR is almost 0%.
While in clean-label attacks, i.e. SIG and CL attacks, L MCE can not withstand the backdoor injected in f θ e , so the ASR is almost 100%.
Hence, in order to establish a reliable defense module, f θ e should be trained in a more secure way.
In comparison, the third row demonstrates the superior defense performance of SS-CTL, illustrating that the ST module securely bridges genuinely clean intra-class samples together which are distinguished by the SD module.
[Table]
Secondly, we explore how L MCE affects the defense performance of h θ c .
For clarity, we denote
L 1 ≡ − 1 | ˆ D c | (cid:80) ( x ,y ) ∈
ˆ D c log[ h θ c ( f θ e ( x ))]
y and L 2 ≡ 1 | ˆ D p | · (cid:80) ( x ,y ) ∈
ˆ D p log[ h θ c ( f θ e ( x ))]
y .
We have
L MCE =
L 1 + λ p L 2 .
Generally, if knowing clean samples, the defender will train h θ c with L 1 .
So here, we aim to show how our proposed L 2 and the trade-off parameter λ
p affect h θ c .
To this end, we first fix f θ e learned by SS-CTL and then apply L MCE with λ p = 0 , 0 . 001 , 0 . 01 , 0 .
1 , 1 on h θ c .
Results are shown in Fig.
In the previous experiments, we adopt λ p = 0 .
The comparison between λ p = 0 and λ p ̸ = 0 in the right figure illustrates that L 2 can effectively reduce ASR.
When comparing different λ p ̸ = 0 in the left figure, we discover that as λ p increases, there is a trend of decrease in ACC.
We infer that since L 2 drops faster than L 1 , namely unlearning is faster than relearning, adding weights to L 2 makes h θ c focus on unlearning instead of relearning, leading to the low ACC.
Therefore, we conclude that L 2 helps to inhibit backdoor in h θ c , but its weight should not be too large.
λ p = 0 .
001 is considered to be an appropriate choice.
In summary, we have empirically validated the effectiveness of each individual module, and shown the flexibility of our method to combine with other existing modules.
Appendix.
Due to the space limit, more results and analysis will be presented in Appendix.
The overall structure of the Appendix is listed as follows.
• Appendix A: more algorithmic details and analysis on the proposed method.
• Appendix B: more details on semi-supervised contrastive learning (SS-CTL).
• Appendix C: more implementation details.
• Appendix D: results on ImageNet.
• Appendix E: performance with different data transformations τ .
• Appendix F: performance with different proportion values α c , α p .
• Appendix G: performance with different poisoning rates.
• Appendix H: performance with different model architectures and feature dimensionalities.
• Appendix I: complexities of two proposed methods.
Conclusions
In this paper, we reveal the sensitivity of poisoned samples to transformations and propose a sensitivity metric, called FCT.
Besides, we propose three modules—the SD module to distinguish between clean and poisoned samples, the ST module to train a secure model from scratch and the BR module to remove backdoor—which constitute two defense methods, i.e. D-ST and D-BR, to defend under two different defense paradigms.
Extensive experiments have demonstrated the effectiveness of each individual module and also the proposed defense methods.
Broader impact
Poisoning-based backdoor attacks are severe threats to the learning paradigm of learning a DNN model based on the training set from some untrustworthy sources.
This work reveals the sensitivity of poisoned samples in the backdoored model, which will help people to better understand the inner mechanism of backdoor attacks.
The proposed two effective defense methods can not only significantly mitigate the threat of existing poisoning based backdoor attacks, but also serve as the new baseline for developing more advanced attack methods in future.
Acknowledgments and disclosure of funding
Baoyuan Wu is supported by the NSFC Fund under grant No.62076213, Shenzhen Science and
Technology Program under grant No.
RCYX20210609103057050, No.
GXWD2020123110572200220200901175001001, and No.
ZDSYS20211021111415025.
Haoqian Wang is supported by the
NSFC Fund under grant No.61831014, Shenzhen Science and Technology Program under grant
No.CJGJZD20200617102601004 and No.
JSGG20210802153150005.
[-• Baseline
-]
[-• Baseline
-]