DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation

Abstract

Public resources and services (e.g., datasets, training platforms, pre-trained models) have been widely adopted to ease the development of Deep Learning-based applications. However, if the third-party providers are untrusted, they can inject poisoned samples into the datasets or embed backdoors in those models. Such an integrity breach can cause severe consequences, especially in safety- and security-critical applications. Various backdoor attack techniques have been proposed for higher effectiveness and stealthiness. Unfortunately, existing defense solutions are not practical to thwart those attacks in a comprehensive way. In this paper, we investigate the effectiveness of data augmentation techniques in mitigating backdoor attacks and enhancing DL models' robustness. An evaluation framework is introduced to achieve this goal. Specifically, we consider a unified defense solution, which (1) adopts a data augmentation policy to fine-tune the infected model and eliminate the effects of the embedded backdoor; (2) uses another augmentation policy to preprocess input samples and invalidate the triggers during inference. We propose a systematic approach to discover the optimal policies for defending against different backdoor attacks by comprehensively evaluating 71 state-of-the-art data augmentation functions. Extensive experiments show that our identified policy can effectively mitigate eight different kinds of backdoor attacks and outperform five existing defense methods. We envision this framework can be a good benchmark tool to advance future DNN backdoor studies.

References in corpus (20)

• Continuous control with deep reinforcement learning
• ADADELTA: An Adaptive Learning Rate Method
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Resnet in Resnet: Generalizing Residual Architectures
• Spectral Signatures in Backdoor Attacks
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• EDA: Easy Data Augmentation Techniques for Boosting Performance on Text Classification Tasks
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Blind Backdoors in Deep Learning Models
• Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
• Rethinking the Trigger of Backdoor Attack
• Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacy
• Defending Neural Backdoors via Generative Distribution Modeling
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Advbox: a toolbox to generate adversarial examples that fool neural networks
• FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation Techniques
• Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques

Cited by in corpus (5)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective
• Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
• Privacy-preserving Collaborative Learning with Automatic Transformation Search
• Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor