REVIEW 11 cited by
Backdoor Defense via Decoupling the Training Process
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
read the original abstract
Recent studies have revealed that deep neural networks (DNNs) are vulnerable to backdoor attacks, where attackers embed hidden backdoors in the DNN model by poisoning a few training samples. The attacked model behaves normally on benign samples, whereas its prediction will be maliciously changed when the backdoor is activated. We reveal that poisoned samples tend to cluster together in the feature space of the attacked DNN model, which is mostly due to the end-to-end supervised training paradigm. Inspired by this observation, we propose a novel backdoor defense via decoupling the original end-to-end training process into three stages. Specifically, we first learn the backbone of a DNN model via \emph{self-supervised learning} based on training samples without their labels. The learned backbone will map samples with the same ground-truth label to similar locations in the feature space. Then, we freeze the parameters of the learned backbone and train the remaining fully connected layers via standard training with all (labeled) training samples. Lastly, to further alleviate side-effects of poisoned samples in the second stage, we remove labels of some `low-credible' samples determined based on the learned model and conduct a \emph{semi-supervised fine-tuning} of the whole model. Extensive experiments on multiple benchmark datasets and DNN models verify that the proposed defense is effective in reducing backdoor threats while preserving high accuracy in predicting benign samples. Our code is available at \url{https://github.com/SCLBD/DBD}.
Forward citations
Cited by 11 Pith papers
-
DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusion
DISTIL uses a classifier-guided latent diffusion model to invert Trojan triggers without clean data, achieving higher trigger-based scanning accuracy than prior reverse-engineering methods.
-
BURN: Backdoor Unlearning via Adversarial Boundary Analysis
BURN removes backdoors from trained models by detecting poison samples through adversarial boundary distance and re-labeling them with labels recovered by adversarial perturbations.
-
MADE: Graph Backdoor Defense with Masked Unlearning
MADE is a training-set-only graph backdoor defense combining homophily-based poisoned-sample isolation with masked unlearning to drive attack success rate to near zero while keeping accuracy high.
-
BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
BackdoorMBTI is the first backdoor security benchmark and toolkit that covers image, text, and audio modalities with a unified evaluation pipeline.
-
NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learning
NT-ML combines non-target label training and mutual learning to purify a backdoored model using a small set of clean samples.
-
ConSeg: Contextual Backdoor Attack Against Semantic Segmentation
A contextual backdoor attack that improves semantic segmentation attack success by relabeling victim pixels with the target class's co-occurring classes.
-
Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies
The paper proposes a one-to-one mapping between six causes of distribution shift and several AI safety issues, arguing for mutual method transfer through aligned definitions.
-
Gradient Norm-based Fine-Tuning for Backdoor Defense in Automatic Speech Recognition
A gradient-norm-regularized fine-tuning method, GN-FT, removes backdoor behaviors from audio speech recognition models while keeping clean accuracy high.
-
TrojanTime: Backdoor Attacks on Time Series Classification
TrojanTime fine-tunes a pre-trained time series classifier on adversarial samples from an arbitrary external dataset to inject a backdoor without touching the original training data, reporting high attack success with...
-
Backdoor Attacks and Defenses in Computer Vision Domain: A Survey
A literature review that classifies backdoor attacks and defenses in computer vision into a five-axis taxonomy and identifies supply-chain, hardware, and cross-task evaluation as open gaps.
-
A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations
A literature review that taxonomizes LLM backdoor attacks and defenses by model construction phase, with no new experimental results.
Discussion (0). Continue with ORCID to comment.