Defending Against Patch-based Backdoor Attacks on Self-Supervised Learning-猫眼课题宝

DOI：

10.1109/cvpr52729.2023.01178

发表时间：

2023-04

期刊：

2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

影响因子：

通讯作者：

中科院分区：

其他

文献类型：

作者：

Ajinkya Tejankar;Maziar Sanjabi;Qifan Wang;Sinong Wang;Hamed Firooz;H. Pirsiavash;L Tan

最近，自我监督学习（SSL）被证明容易受到基于补丁的数据中毒后门攻击。结果表明，攻击者可以毒害一小部分未标记的数据，因此当受害者在其上训练SSL模型时，最终模型将具有攻击者可以利用的后门。这项工作旨在保护自我监督学习免受此类攻击。我们使用三步防御管道，首先在中毒数据上训练模型。在第二步中，我们提出的防御算法（PatchSearch）使用训练好的模型来搜索训练数据中的中毒样本，并将它们从训练集中删除。在第三步中，在清理的训练集上训练最终模型。我们的研究结果表明，补丁搜索是一种有效的防御。例如，它将包含触发器的图像的模型准确率从38.2%提高到63.7%，非常接近干净模型的准确率64.6%。此外，我们还展示了PatchSearch的性能优于基线和最先进的防御方法，包括使用额外干净、可信数据的方法。我们的代码可在https://github.com/UCDvision/PatchSearch上获得

Recently, self-supervised learning (SSL) was shown to be vulnerable to patch-based data poisoning backdoor attacks. It was shown that an adversary can poison a small part of the unlabeled data so that when a victim trains an SSL model on it, the final model will have a back-door that the adversary can exploit. This work aims to defend self-supervised learning against such attacks. We use a three-step defense pipeline, where we first train a model on the poisoned data. In the second step, our proposed defense algorithm (PatchSearch) uses the trained model to search the training data for poisoned samples and removes them from the training set. In the third step, a final model is trained on the cleaned-up training set. Our results show that PatchSearch is an effective defense. As an example, it improves a model's accuracy on images containing the trigger from 38.2% to 63.7% which is very close to the clean model's accuracy, 64.6%. More-over, we show that PatchSearch outperforms baselines and state-of-the-art defense approaches including those using additional clean, trusted data. Our code is available at https://github.com/UCDvision/PatchSearch

Defending Against Patch-based Backdoor Attacks on Self-Supervised Learning

文献摘要

相似文献