Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

Abstract

Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a training time attack that injects a trigger pattern into a small proportion of training data so as to control the model's prediction at the test time. Backdoor attacks are notably dangerous since they do not affect the model's performance on clean examples, yet can fool the model to make incorrect prediction whenever the trigger pattern appears during testing. In this paper, we propose a novel defense framework Neural Attention Distillation (NAD) to erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to guide the finetuning of the backdoored student network on a small clean subset of data such that the intermediate-layer attention of the student network aligns with that of the teacher network. The teacher network can be obtained by an independent finetuning process on the same clean subset. We empirically show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase the backdoor triggers using only 5\% clean training data without causing obvious performance degradation on clean examples. Code is available in https://github.com/bboylyg/NAD.

19 pages, 14 figures, ICLR 2021

References in corpus (11)

• Distilling the Knowledge in a Neural Network
• Improved Regularization of Convolutional Neural Networks with Cutout
• Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfer
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Like What You Like: Knowledge Distill via Neuron Selectivity Transfer
• On the Convergence and Robustness of Adversarial Training
• Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
• Defending Neural Backdoors via Generative Distribution Modeling
• Variational Information Distillation for Knowledge Transfer
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Removing Backdoor-Based Watermarks in Neural Networks with Limited Data

Cited by in corpus (4)

• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• Backdoor Attacks on Crowd Counting
• Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Better
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models