Backdoor Cleansing with Unlabeled Data
Backdoor Cleansing with Unlabeled Data
复制标题
DOI：
10.1109/cvpr52729.2023.01176
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Lu Pang;Tao Sun;Haibin Ling;Chao Chen
中科院分区：
文献类型：
--
作者：
Lu Pang;Tao Sun;Haibin Ling;Chao Chen
由于深度神经网络(DNN)的计算需求日益增长，公司和组织已经开始将训练过程外包。但是，外部训练的DNN可能会受到后门攻击。防御此类攻击至关重要，即对可疑模型进行后处理，以减轻其后门行为，同时保持其对干净输入的正常预测能力不受影响。为了去除异常的后门行为，现有的方法大多依赖于额外标记的干净样本。然而，这样的要求可能是不现实的，因为最终用户往往无法获得培训数据。在本文中，我们研究了绕过这一障碍的可能性。提出了一种新的不需要训练标签的防御方法。通过精心设计的层次化权值重新初始化和知识提炼，该方法可以有效地清除可疑网络的后门行为，而不会对其正常行为造成损害。在实验中，我们的方法在没有标签的情况下训练，与使用标签训练的最先进的防御方法不相上下。我们还观察到即使在分布外的数据上也有很有希望的防御结果。这使得我们的方法非常实用。代码可从以下网址获得：https://github.com/luluppang/BCU.
Due to the increasing computational demand of Deep Neural Networks (DNNs), companies and organizations have begun to outsource the training process. However, the externally trained DNNs can potentially be backdoor attacked. It is crucial to defend against such attacks, i.e., to postprocess a suspicious model so that its backdoor behavior is mitigated while its normal prediction power on clean inputs remain uncompromised. To remove the abnormal backdoor behavior, existing methods mostly rely on additional labeled clean samples. However, such requirement may be unrealistic as the training data are often unavailable to end users. In this paper, we investigate the possibility of circumventing such barrier. We propose a novel defense method that does not require training labels. Through a carefully designed layer-wise weight reinitialization and knowledge distillation, our method can effectively cleanse backdoor behaviors of a suspicious network with negligible compromise in its normal behavior. In experiments, we show that our method, trained without labels, is on-par with state-of-the-art defense methods trained using labels. We also observe promising defense results even on out-of-distribution data. This makes our method very practical. Code is available at: https://github.com/luluppang/BCU.