Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

Abstract

Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a training time attack that injects a trigger pattern into a small proportion of training data so as to control the model's prediction at the test time. Backdoor attacks are notably dangerous since they do not affect the model's performance on clean examples, yet can fool the model to make incorrect prediction whenever the trigger pattern appears during testing. In this paper, we propose a novel defense framework Neural Attention Distillation (NAD) to erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to guide the finetuning of the backdoored student network on a small clean subset of data such that the intermediate-layer attention of the student network aligns with that of the teacher network. The teacher network can be obtained by an independent finetuning process on the same clean subset. We empirically show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase the backdoor triggers using only 5\% clean training data without causing obvious performance degradation on clean examples. Code is available in https://github.com/bboylyg/NAD.

arXiv comment19 pages, 14 figures, ICLR 2021

References in corpus (17)

• Distilling the Knowledge in a Neural Network
• Improved Regularization of Convolutional Neural Networks with Cutout
• Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfer
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• Like What You Like: Knowledge Distill via Neuron Selectivity Transfer
• On the Convergence and Robustness of Adversarial Training
• Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
• Label Refinery: Improving ImageNet Classification through Label Progression
• Rethinking the Trigger of Backdoor Attack
• Defending Neural Backdoors via Generative Distribution Modeling
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Variational Information Distillation for Knowledge Transfer
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Removing Backdoor-Based Watermarks in Neural Networks with Limited Data

Cited by in corpus (18)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspective
• Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Backdoor Attack through Frequency Domain
• NNoculation: Catching BadNets in the Wild
• Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data
• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• M-to-N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models
• Backdoor Attacks on Crowd Counting
• How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data
• Secure Watermark for Deep Neural Networks with Multi-task Learning
• Towards Practical Watermark for Deep Neural Networks in Federated Learning
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
• Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Better
• Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models