Abstract:Backdoor attacks are emerging threats to deep neural networks, which typically embed malicious behaviors into a victim model by injecting poisoned samples. Adversaries can activate the injected backdoor during inference by presenting the trigger on input images. Prior defensive methods have achieved remarkable success in countering dirty-label backdoor attacks where the labels of poisoned samples are often mislabeled. However, these approaches do not work for a recent new type of backdoor -- clean-label backdoor attacks that imperceptibly modify poisoned data and hold consistent labels. More complex and powerful algorithms are demanded to defend against such stealthy attacks. In this paper, we propose UltraClean, a general framework that simplifies the identification of poisoned samples and defends against both dirty-label and clean-label backdoor attacks. Given the fact that backdoor triggers introduce adversarial noise that intensifies in feed-forward propagation, UltraClean first generates two variants of training samples using off-the-shelf denoising functions. It then measures the susceptibility of training samples leveraging the error amplification effect in DNNs, which dilates the noise difference between the original image and denoised variants. Lastly, it filters out poisoned samples based on the susceptibility to thwart the backdoor implantation. Despite its simplicity, UltraClean achieves a superior detection rate across various datasets and significantly reduces the backdoor attack success rate while maintaining a decent model accuracy on clean data, outperforming existing defensive methods by a large margin. Code is available at <a class="link-external link-https" href="https://github.com/bxz9200/UltraClean" rel="external noopener nofollow">this https URL</a>.

Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning

Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples

BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning

Model-Contrastive Learning for Backdoor Elimination

Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness

Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System

On the Difficulty of Defending Contrastive Learning against Backdoor Attacks

UNLEARNING BACKDOOR ATTACKS IN FEDERATED LEARNING

Backdoor Attacks via Machine Unlearning

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

Mitigating Backdoor Attacks using Activation-Guided Model Editing

Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearning

Backdoor Contrastive Learning via Bi-level Trigger Optimization

Adversarial Backdoor Defense in CLIP

Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansing

Stand-in Backdoor: A Stealthy and Powerful Backdoor Attack

UltraClean: A Simple Framework to Train Robust Neural Networks against Backdoor Attacks

DLP: towards active defense against backdoor attacks with decoupled learning process