Abstract:Deep neural networks (DNNs) are vulnerable to backdoor attacks. Previous works have shown it extremely challenging to unlearn the undesired backdoor behavior from the network, since the entire network can be affected by the backdoor samples. In this paper, we propose a brand-new backdoor defense strategy, which makes it much easier to remove the harmful influence of backdoor samples from the model. Our defense strategy, \emph{Trap and Replace}, consists of two stages. In the first stage, we bait and trap the backdoors in a small and easy-to-replace subnetwork. Specifically, we add an auxiliary image reconstruction head on top of the stem network shared with a light-weighted classification head. The intuition is that the auxiliary image reconstruction task encourages the stem network to keep sufficient low-level visual features that are hard to learn but semantically correct, instead of overfitting to the easy-to-learn but semantically incorrect backdoor correlations. As a result, when trained on backdoored datasets, the backdoors are easily baited towards the unprotected classification head, since it is much more vulnerable than the shared stem, leaving the stem network hardly poisoned. In the second stage, we replace the poisoned light-weighted classification head with an untainted one, by re-training it from scratch only on a small holdout dataset with clean samples, while fixing the stem network. As a result, both the stem and the classification head in the final network are hardly affected by backdoor training samples. We evaluate our method against ten different backdoor attacks. Our method outperforms previous state-of-the-art methods by up to $20.57\%$, $9.80\%$, and $13.72\%$ attack success rate and on-average $3.14\%$, $1.80\%$, and $1.21\%$ clean classification accuracy on CIFAR10, GTSRB, and ImageNet-12, respectively. Code is available online.

Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearning

Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness

Reconstructive Neuron Pruning for Backdoor Defense

Backdoor Defense with Machine Unlearning

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System

Unlearning Backdoor Attacks through Gradient-Based Model Pruning

Mitigating Backdoor Attacks using Activation-Guided Model Editing

Knowledge-Driven Backdoor Removal in Deep Neural Networks Via Reinforcement Learning

Need for Speed: Taming Backdoor Attacks with Speed and Precision

Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats

Backdoor Cleansing with Unlabeled Data

UNLEARNING BACKDOOR ATTACKS IN FEDERATED LEARNING

Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation

Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples

Augmented Neural Fine-Tuning for Efficient Backdoor Purification

Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning

Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork

Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense

Efficient Backdoor Removal Through Natural Gradient Fine-tuning

Unlearn to Relearn Backdoors: Deferred Backdoor Functionality Attacks on Deep Learning Models

"No Matter What You Do": Purifying GNN Models via Backdoor Unlearning