Defending Neural Backdoors via Generative Distribution Modeling

Abstract

Neural backdoor attack is emerging as a severe security threat to deep learning, while the capability of existing defense methods is limited, especially for complex backdoor triggers. In the work, we explore the space formed by the pixel values of all possible backdoor triggers. An original trigger used by an attacker to build the backdoored model represents only a point in the space. It then will be generalized into a distribution of valid triggers, all of which can influence the backdoored model. Thus, previous methods that model only one point of the trigger distribution is not sufficient. Getting the entire trigger distribution, e.g., via generative modeling, is a key to effective defense. However, existing generative modeling techniques for image generation are not applicable to the backdoor scenario as the trigger distribution is completely unknown. In this work, we propose max-entropy staircase approximator (MESA), an algorithm for high-dimensional sampling-free generative modeling and use it to recover the trigger distribution. We also develop a defense technique to remove the triggers from the backdoored model. Our experiments on Cifar10/100 dataset demonstrate the effectiveness of MESA in modeling the trigger distribution and the robustness of the proposed defense method.

Cited by in corpus (28)

• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Poison Ink: Robust and Invisible Backdoor Attack
• Blind Backdoors in Deep Learning Models
• Rethinking the Trigger of Backdoor Attack
• Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Natural Backdoor Attack on Text Data
• Poisoned classifiers are not only backdoored, they are fundamentally broken
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• Embedding and Extraction of Knowledge in Tree Ensemble Classifiers
• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• Towards Security Threats of Deep Learning Systems: A Survey
• One-pixel Signature: Characterizing CNN Models for Backdoor Detection
• What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input Space
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Hidden Backdoors in Human-Centric Language Models
• On Evaluating Neural Network Backdoor Defenses
• ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
• Bias Busters: Robustifying DL-based Lithographic Hotspot Detectors Against Backdooring Attacks
• On Provable Backdoor Defense in Collaborative Learning
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• A Sweet Rabbit Hole by DARCY: Using Honeypots to Detect Universal Trigger's Adversarial Attacks
• BioLeaF: A Bio-plausible Learning Framework for Training of Spiking Neural Networks