Abstract:Deep neural networks (DNNs) are vulnerable to backdoor attacks. Previous works have shown it extremely challenging to unlearn the undesired backdoor behavior from the network, since the entire network can be affected by the backdoor samples. In this paper, we propose a brand-new backdoor defense strategy, which makes it much easier to remove the harmful influence of backdoor samples from the model. Our defense strategy, \emph{Trap and Replace}, consists of two stages. In the first stage, we bait and trap the backdoors in a small and easy-to-replace subnetwork. Specifically, we add an auxiliary image reconstruction head on top of the stem network shared with a light-weighted classification head. The intuition is that the auxiliary image reconstruction task encourages the stem network to keep sufficient low-level visual features that are hard to learn but semantically correct, instead of overfitting to the easy-to-learn but semantically incorrect backdoor correlations. As a result, when trained on backdoored datasets, the backdoors are easily baited towards the unprotected classification head, since it is much more vulnerable than the shared stem, leaving the stem network hardly poisoned. In the second stage, we replace the poisoned light-weighted classification head with an untainted one, by re-training it from scratch only on a small holdout dataset with clean samples, while fixing the stem network. As a result, both the stem and the classification head in the final network are hardly affected by backdoor training samples. We evaluate our method against ten different backdoor attacks. Our method outperforms previous state-of-the-art methods by up to $20.57\%$, $9.80\%$, and $13.72\%$ attack success rate and on-average $3.14\%$, $1.80\%$, and $1.21\%$ clean classification accuracy on CIFAR10, GTSRB, and ImageNet-12, respectively. Code is available online.

BadRes: Reveal the Backdoors Through Residual Connection

B3: Backdoor Attacks Against Black-box Machine Learning Models

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Backdoor Defense Via Suppressing Model Shortcuts

Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attack

An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers

PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification

BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Lifting

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork

BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection

BAN: Detecting Backdoors Activated by Adversarial Neuron Noise

Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks

Investigating the Backdoor on DNNs Based on Recolorization and Reconstruction: From a Multi-Channel Perspective

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

CatchBackdoor: Backdoor Detection via Critical Trojan Neural Path Fuzzing

Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets

Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Sparse Backdoor Attack Against Neural Networks.

Defense-Resistant Backdoor Attacks Against Deep Neural Networks in Outsourced Cloud Environment

Reconstructive Neuron Pruning for Backdoor Defense