Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks

Abstract

Deep learning models have recently shown to be vulnerable to backdoor poisoning, an insidious attack where the victim model predicts clean images correctly but classifies the same images as the target class when a trigger poison pattern is added. This poison pattern can be embedded in the training dataset by the adversary. Existing defenses are effective under certain conditions such as a small size of the poison pattern, knowledge about the ratio of poisoned training samples or when a validated clean dataset is available. Since a defender may not have such prior knowledge or resources, we propose a defense against backdoor poisoning that is effective even when those prerequisites are not met. It is made up of several parts: one to extract a backdoor poison signal, detect poison target and base classes, and filter out poisoned from clean samples with proven guarantees. The final part of our defense involves retraining the poisoned model on a dataset augmented with the extracted poison signal and corrective relabeling of poisoned samples to neutralize the backdoor. Our approach has shown to be effective in defending against backdoor attacks that use both small and large-sized poison patterns on nine different target-base class pairs from the CIFAR10 dataset.

References in corpus (13)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Deep Learning in Neural Networks: An Overview
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Understanding Black-box Predictions via Influence Functions
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Synthesizing Robust Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Robustness May Be at Odds with Accuracy
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Support Vector Machines under Adversarial Label Contamination

Cited by in corpus (7)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identification
• Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder
• Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
• Widen The Backdoor To Let More Attackers In