Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

By Yige Li, Nodens F. Koren, Lingjuan Lyu, Xixiang Lyu, Bo Li, Xingjun Ma. International Conference on Learning Representations, 2021

575 citations recorded by the source corpus.

Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a training time attack that injects a trigger pattern into a small proportion of training data so as to control the model's prediction at the test time. Backdoor attacks are notably dangerous since they do not affect the model's performance on clean examples, yet can fool the model to make incorrect prediction whenever the trigger pattern appears during testing. In this paper, we propose a novel defense framework Neural Attention Distillation (NAD) to erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to guide the finetuning of the backdoored student network on a small clean subset of data such that the intermediate-layer attention of the student network aligns with that of the teacher network. The teacher network can be obtained by an independent finetuning process on the same clean subset. We empirically show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase the backdoor triggers using only 5\% clean training data without causing obvious performance degradation on clean examples. Code is available in https://github.com/bboylyg/NAD.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/4d4e5c0c691e42b7078208598d585caacc2e34c2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Zhiyuan Liu
2. Maosong Sun
3. Yisen Wang
4. Dongxian Wu
5. Xingjun Ma
6. Lingjuan Lyu
7. Bo Li
8. Zhengyan Zhang

In Computer Vision and Pattern Recognition

1. Maosong Sun
2. Zhiyuan Liu
3. Xingjun Ma
4. Yisen Wang
5. Dongxian Wu
6. Bo Li
7. Lingjuan Lyu
8. Xixiang Lyu

Citations in the corpus

• Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, methodology): “We follow the settings suggested by [10] and the open-sourced code corresponding to their original papers to configure these attack algorithms.”
• Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, methodology): “Without knowledge of the trigger pattern, previous methods only achieve limited robustness [7, 24, 22].”
• Red Alarm for Pre-trained Models: Universal Vulnerabilities by Neuron-Level Backdoor Attacks (2021, background): “[40] propose to utilize a teacher network to guide the fine-tuning of the backdoored student network on clean data and make the attention of the student network align with that of the teacher network.”