Anti-Backdoor Learning: Training Clean Models on Poisoned Data

By Yige Li, Xixiang Lyu, Nodens F. Koren, Lingjuan Lyu, Bo Li, Xingjun Ma. Neural Information Processing Systems, 2021

473 citations recorded by the source corpus.

Backdoor attack has emerged as a major security threat to deep neural networks (DNNs). While existing defense methods have demonstrated promising results on detecting or erasing backdoors, it is still not clear whether robust training methods can be devised to prevent the backdoor triggers being injected into the trained model in the first place. In this paper, we introduce the concept of \emph{anti-backdoor learning}, aiming to train \emph{clean} models given backdoor-poisoned data. We frame the overall learning process as a dual-task of learning the \emph{clean} and the \emph{backdoor} portions of data. From this view, we identify two inherent characteristics of backdoor attacks as their weaknesses: 1) the models learn backdoored data much faster than learning with clean data, and the stronger the attack the faster the model converges on backdoored data; 2) the backdoor task is tied to a specific class (the backdoor target class). Based on these two weaknesses, we propose a general learning scheme, Anti-Backdoor Learning (ABL), to automatically prevent backdoor attacks during training. ABL introduces a two-stage \emph{gradient ascent} mechanism for standard training to 1) help isolate backdoor examples at an early training stage, and 2) break the correlation between backdoor examples and the target class at a later training stage. Through extensive experiments on multiple benchmark datasets against 10 state-of-the-art attacks, we empirically show that ABL-trained models on backdoor-poisoned data achieve the same performance as they were trained on purely clean data. Code is available at \url{https://github.com/bboylyg/ABL}.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/d18362341e4d7ffdbc94fef984fb686950f928b3

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Lichao Sun
2. Lingjuan Lyu
3. Philip S. Yu
4. Xingjun Ma
5. Qiang Yang
6. Han Yu
7. Yisen Wang
8. Shutao Xia

Citations in the corpus

• Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, methodology): “Another more recent work called Anti-Backdoor Learning (ABL) [55] aims”
• Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, background): “Meanwhile, other studies focus on training strategies to make the poisoned data have little or no effect on the trained model [23, 40] through randomized smoothing [34, 46], majority vote [21], differential privacy [29], and input preprocessing [27, 4].”
• Rethinking machine unlearning for large language models (2024, unknown): “Unlearning can be a natural solution for both types of attacks given the existing success of unlearning as a defense against adversarial attacks in other domains (Wang et al., 2019; Li et al., 2021; Liu et al., 2022b; Jia et al., 2023).”
• Backdoor Learning: A Survey (2020, methodology): “[27] proposed a gradient ascent based anti-backdoor method, based on the observations that backdoor attacks have faster learning on poisoned data and target-class dependency.”
• Poisoning Web-Scale Training Datasets is Practical (2023, unknown): “…[62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and then asks…”