Progressive Poisoned Data Isolation for Training-time Backdoor Defense

Yiming Chen,Haiwei Wu,Jiantao Zhou
2023-12-20
Abstract:Deep Neural Networks (DNN) are susceptible to backdoor attacks where malicious attackers manipulate the model's predictions via data poisoning. It is hence imperative to develop a strategy for training a clean model using a potentially poisoned dataset. Previous training-time defense mechanisms typically employ an one-time isolation process, often leading to suboptimal isolation outcomes. In this study, we present a novel and efficacious defense method, termed Progressive Isolation of Poisoned Data (PIPD), that progressively isolates poisoned data to enhance the isolation accuracy and mitigate the risk of benign samples being misclassified as poisoned ones. Once the poisoned portion of the dataset has been identified, we introduce a selective training process to train a clean model. Through the implementation of these techniques, we ensure that the trained model manifests a significantly diminished attack success rate against the poisoned data. Extensive experiments on multiple benchmark datasets and DNN models, assessed against nine state-of-the-art backdoor attacks, demonstrate the superior performance of our PIPD method for backdoor defense. For instance, our PIPD achieves an average True Positive Rate (TPR) of 99.95% and an average False Positive Rate (FPR) of 0.06% for diverse attacks over CIFAR-10 dataset, markedly surpassing the performance of state-of-the-art methods.
Cryptography and Security,Artificial Intelligence,Machine Learning
What problem does this paper attempt to address?
The problem that this paper attempts to solve is the prevention of backdoor attacks during the training process of deep neural networks (DNN). Specifically, malicious attackers can implant hidden backdoors in the model through data poisoning, thereby manipulating the prediction results of the model. This will not only affect the performance of the model, but may also lead to system operation interruption or crash. Therefore, it has become crucial to develop an effective strategy to train a clean model when using a potentially poisoned dataset for training. Existing training - time defense mechanisms usually adopt a one - time isolation process to identify and isolate poisoned data samples, but this method often results in poor isolation effects and is prone to misidentifying benign samples as poisoned samples. In response to these problems, this paper proposes a new defense method - Progressive Isolation of Poisoned Data (PIPD), which improves the accuracy of isolation by progressively isolating poisoned data and reduces the risk of misidentifying benign samples. Once the poisoned part in the dataset is identified, the researchers introduce a selective training process to train a clean model. Through the application of these techniques, it is ensured that the success rate of attacks by poisoned data on the trained model is significantly reduced.