Abstract:Recent studies have revealed the vulnerability of deep neural networks (DNNs) to various backdoor attacks, where the behavior of DNNs can be compromised by utilizing certain types of triggers or poisoning mechanisms. State-of-the-art (SOTA) defenses employ too-sophisticated mechanisms that require either a computationally expensive adversarial search module for reverse-engineering the trigger distribution or an over-sensitive hyper-parameter selection module. Moreover, they offer sub-par performance in challenging scenarios, e.g., limited validation data and strong attacks. In this paper, we propose Neural mask Fine-Tuning (NFT) with an aim to optimally re-organize the neuron activities in a way that the effect of the backdoor is removed. Utilizing a simple data augmentation like MixUp, NFT relaxes the trigger synthesis process and eliminates the requirement of the adversarial search module. Our study further reveals that direct weight fine-tuning under limited validation data results in poor post-purification clean test accuracy, primarily due to overfitting issue. To overcome this, we propose to fine-tune neural masks instead of model weights. In addition, a mask regularizer has been devised to further mitigate the model drift during the purification process. The distinct characteristics of NFT render it highly efficient in both runtime and sample usage, as it can remove the backdoor even when a single sample is available from each class. We validate the effectiveness of NFT through extensive experiments covering the tasks of image classification, object detection, video action recognition, 3D point cloud, and natural language processing. We evaluate our method against 14 different attacks (LIRA, WaNet, etc.) on 11 benchmark data sets such as ImageNet, UCF101, Pascal VOC, ModelNet, OpenSubtitles2012, etc.

UltraClean: A Simple Framework to Train Robust Neural Networks against Backdoor Attacks

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Clean-Annotation Backdoor Attack against Lane Detection Systems in the Wild

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

Beating Backdoor Attack at Its Own Game

Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks

Backdoor Cleansing with Unlabeled Data

A lightweight backdoor defense framework based on image inpainting

Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing

Backdoor Defense via Decoupling the Training Process

PAD-FT: A Lightweight Defense for Backdoor Attacks via Data Purification and Fine-Tuning

Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

A Defense Method Against Backdoor Attacks in Neural Networks Using an Image Repair Technique

Backdoor Defense Via Deconfounded Representation Learning

The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data

Stealthy Low-frequency Backdoor Attack against Deep Neural Networks

Clean-image Backdoor Attacks

Augmented Neural Fine-Tuning for Efficient Backdoor Purification

Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios

Adversarial Fine-tuning for Backdoor Defense: Connect Adversarial Examples to Triggered Samples