Model-Contrastive Learning for Backdoor Defense (2022-05-09T00:00:00.000000Z)

TL;DR

A novel two-stage backdoor defense method, named MCLDef, based on Model-Contrastive Learning (MCL), which significantly outperforms state-of-the-art defense methods by up to 95.79% reduction in ASR, while in most cases the BA degradation can be controlled within less than 2%.

Abstract

Due to the popularity of Artificial Intelligence (AI) techniques, we are witnessing an increasing number of backdoor injection attacks that are designed to maliciously threaten Deep Neural Networks (DNNs) causing misclassification. Although there exist various defense methods that can effectively erase backdoors from DNNs, they greatly suffer from both high Attack Success Rate (ASR) and a non-negligible loss in Benign Accuracy (BA). Inspired by the observation that a backdoored DNN tends to form a new cluster in its feature spaces for poisoned data, in this paper we propose a novel two-stage backdoor defense method, named MCLDef, based on Model-Contrastive Learning (MCL). In the first stage, our approach performs trigger inversion based on trigger synthesis, where the resultant trigger can be used to generate poisoned data. In the second stage, under the guidance of MCL and our defined positive and negative pairs, MCLDef can purify the backdoored model by pulling the feature representations of poisoned data towards those of their clean data counterparts. Due to the shrunken cluster of poisoned data, the backdoor formed by end-to-end supervised learning is eliminated. Comprehensive experimental results show that, with only 5% of clean data, MCLDef significantly outperforms state-of-the-art defense methods by up to 95.79% reduction in ASR, while in most cases the BA degradation can be controlled within less than 2%. Our code is available at https://github.com/WeCanShow/MCL.

Authors

Zhihao Yue

1 papers

Jun Xia

2 papers

Zhiwei Ling

1 papers

TL;DR

Abstract

Authors

References44 items

Backdoor Defense via Decoupling the Training Process

Fault Detection in Nuclear Power Plants using Deep Leaning based Image Classification with Imaged Time-series Data

Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarios

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

Adversarial Unlearning of Backdoors via Implicit Hypergradient

Topological Detection of Trojaned Neural Networks

Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspective

Model-Contrastive Federated Learning

Black-box Detection of Backdoor Attacks with Limited Information and Data

MagFace: A Universal Representation for Face Recognition and Quality Assessment

Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

Exploring Simple Siamese Representation Learning

Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff

Pillar-based Object Detection for Autonomous Driving

Backdoor Learning: A Survey

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

FDA$^3$: Federated Defense Against Adversarial Attacks for Cloud-Based IIoT Applications

Big Self-Supervised Models are Strong Semi-Supervised Learners

A Simple Framework for Contrastive Learning of Visual Representations

Label-Consistent Backdoor Attacks

PyTorch: An Imperative Style, High-Performance Deep Learning Library

Momentum Contrast for Unsupervised Visual Representation Learning

Defending Neural Backdoors via Generative Distribution Modeling

Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection

BadNets: Evaluating Backdooring Attacks on Deep Neural Networks

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

Self-Supervised Visual Feature Learning With Deep Neural Networks: A Survey

A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning

Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation

Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Mixed Precision Training

ChestX-Ray8: Hospital-Scale Chest X-Ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseases

Improved Deep Metric Learning with Multi-class N-pair Loss Objective

Towards Evaluating the Robustness of Neural Networks

Wide Residual Networks

Deep Residual Learning for Image Recognition

Bidirectional recurrent neural network language models for automatic speech recognition

Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition

ImageNet: A large-scale hierarchical image database

SPECTRE: Defending Against Backdoor Attacks Using Robust Covariance Estimation

Trojaning Attack on Neural Networks

Learning Multiple Layers of Features from Tiny Images

Visualizing Data using t-SNE

Field of Study

Journal Information

Name

Volume

Venue Information

Name

Type

URL

Alternate Names