PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoor Defense via Decoupling the Training Process

Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, Kui Ren

arXiv:2202.03423v1cs.CRcs.CVcs.LG

TL;DR

Backdoor attacks can hide malicious trigger–target behavior in DNNs trained on poisoned samples. The paper proposes DBD, which decouples feature learning from classifier training and uses semi-supervised fine-tuning; experiments report reduced backdoor threats with high benign accuracy.

  • Problem

    Backdoor attacks manipulate predictions on triggered inputs while preserving normal behavior on benign samples, making hidden backdoors a serious DNN security threat.

  • Method

    DBD learns a backbone with self-supervised learning, trains the remaining fully connected layers separately, then semi-supervised-fine-tunes the whole model using credibility-based label removal.

  • Results

    DBD achieves attack success rates below 2% in all reported cases, mostly below 0.5%, while benign-accuracy decreases remain below 2% for poison-label attacks.

  • Takeaways & Limitations

    Decoupling-based training provides a general pipeline for obtaining backdoor-free DNNs even when training data contains poisoned samples.

  • Takeaways & Limitations

    The defense is limited to untrusted-sample training and poisoning-based backdoors in image classification; other attack scenarios are out of scope.

Abstract

from arXiv · show

Recent studies have revealed that deep neural networks (DNNs) are vulnerable to backdoor attacks, where attackers embed hidden backdoors in the DNN model by poisoning a few training samples. The attacked model behaves normally on benign samples, whereas its prediction will be maliciously changed when the backdoor is activated. We reveal that poisoned samples tend to cluster together in the feature space of the attacked DNN model, which is mostly due to the end-to-end supervised training paradigm. Inspired by this observation, we propose a novel backdoor defense via decoupling the original end-to-end training process into three stages. Specifically, we first learn the backbone of a DNN model via \emph{self-supervised learning} based on training samples without their labels. The learned backbone will map samples with the same ground-truth label to similar locations in the feature space. Then, we freeze the parameters of the learned backbone and train the remaining fully connected layers via standard training with all (labeled) training samples. Lastly, to further alleviate side-effects of poisoned samples in the second stage, we remove labels of some `low-credible' samples determined based on the learned model and conduct a \emph{semi-supervised fine-tuning} of the whole model. Extensive experiments on multiple benchmark datasets and DNN models verify that the proposed defense is effective in reducing backdoor threats while preserving high accuracy in predicting benign samples. Our code is available at \url{https://github.com/SCLBD/DBD}.

1 INTRODUCTION

The paper identifies feature-space clustering of poisoned samples as a consequence of end-to-end supervised training and proposes DBD, a decoupled defense to reduce backdoor threats.

  • Backdoor attacks poison a few training samples so models behave normally on benign inputs but predict an attacker-chosen target when triggered.The hidden trigger–target connection makes the attack difficult to detect in practical DNN applications.
  • Preliminary analysis finds that poisoned samples cluster in the attacked model’s feature space, largely because of end-to-end supervised training.The training paradigm can learn trigger-related features and associate them with the target label.
  • DBD decouples the network into a backbone feature extractor and the remaining fully connected classifier layers.The proposed defense is based on separating feature learning from classifier training.
  • The method further uses label-noise learning to identify high- and low-credible samples and reduce poisoned samples’ side effects during training.This sample credibility step supports the defense’s later training procedure.
  • Experiments on classical benchmark datasets verify the effectiveness of the decoupling-based defense.

2 RELATED WORK

The related work covers poisoning-based backdoor attacks, empirical and certified defenses, and the use of semi-supervised and self-supervised learning for security-related problems.

  • Backdoor attacks: Poison-label attacks assign poisoned samples an attacker-specified target label different from their ground-truth label.BadNets is described as the first and most representative poison-label attack, using stamped triggers and altered labels.
  • Backdoor attacks: Clean-label attacks keep poisoned samples’ target labels consistent with their ground-truth labels to improve stealthiness.They modify benign target-class images before applying the trigger injection process.
  • Backdoor defenses: Existing backdoor defenses are mostly empirical and include detection, preprocessing, model reconstruction, and trigger-synthesis approaches.
  • Backdoor defenses: Certified defenses provide theoretical robustness guarantees under assumptions but are generally weaker than empirical methods in practice.
  • Learning paradigms: Semi-supervised learning combines labeled and unlabeled samples, while self-supervised learning trains DNNs using supervisory signals generated from the data itself.The paper notes prior security applications for both learning paradigms, while self-supervised backdoor attacks that control other training components are out of scope.

3 REVISITING BACKDOOR ATTACKS FROM THE HIDDEN FEATURE SPACE

The paper revisits poisoned samples in hidden feature space and observes that standard supervised learning separates them into clusters, whereas self-supervised learning places them near their ground-truth classes.

  • Experimental settings: The analysis compares BadNets and label-consistent attacks on CIFAR-10 using supervised and SimCLR-based self-supervised training.Poisoned samples are visualized in attacked models’ hidden spaces with t-SNE.
  • Results: Under self-supervised training, poisoned samples lie closely to samples with their ground-truth label rather than clustering around the attack target.The figure reports this pattern for both BadNets and label-consistent attacks.
  • Results: Under standard supervised training, poisoned samples form a separate cluster for both poison-label and clean-label attacks.This behavior is presented as an explanation for why poisoning-based backdoor attacks can succeed.

4 DECOUPLING-BASED BACKDOOR DEFENSE

DBD decouples training into self-supervised feature extraction, supervised classifier training, and semi-supervised fine-tuning to reduce poisoning-based backdoor threats. The method filters low-credibility samples while retaining useful information and aims to preserve benign-sample accuracy.

  • Stages 1–2: DBD first trains a feature extractor with self-supervised learning on label-removed training samples, then freezes it while supervised learning trains the remaining fully connected layers.The self-supervised loss can be instantiated with NT-Xent, while the second stage can use cross-entropy.
  • Stage 2: The second-stage loss ranks samples by credibility: the α% samples with the smallest loss form the high-credible set, while the remainder becomes unlabeled data.The defense does not seek perfect poison-benign separation; it seeks a high-credible set containing as few poisoned samples as possible.
  • Motivation and limitations: The decoupled process avoids creating a hidden backdoor through a purified extractor, but freezing that extractor can reduce benign accuracy and poisoned samples can hinder second-stage learning as outliers.These limitations motivate removing poisoned samples and retraining or fine-tuning the whole model.
  • Stage 2: Using symmetric cross-entropy rather than cross-entropy significantly increases loss differences between poisoned and benign samples under the stated BadNets experiment.The experiment uses CIFAR-10, a 20% poisoning rate, and normalized loss values in [0, 1].
  • Stage 3: Finally, DBD fine-tunes the whole model semi-supervisedly with high-credible samples labeled and low-credible samples unlabeled.This stage is intended to limit poisoned-sample side effects while using their useful information and jointly adapting the extractor and classifier.

5 EXPERIMENTS

Experiments evaluate DBD across benchmark datasets, representative attacks, defense baselines, ablations, and an adaptive attack. DBD achieves low attack success while largely preserving benign accuracy and remains effective under stronger poisoning and adaptive attack settings.

  • Experimental Settings: DBD is evaluated on CIFAR-10 and ImageNet with ResNet-18 against BadNets, Blended, WaNet, and Label-Consistent attacks.The study also reports additional VGGFace2 results in the appendix.
  • Evaluation Metrics: Attack success rate measures backdoor effectiveness, while benign accuracy measures prediction quality on unmodified test samples.Lower ASR and higher BA indicate better defense performance.
  • Main Results: ASR is below 2% in all DBD cases, mostly below 0.5%, while benign-accuracy decreases remain below 2% for poison-label attacks.Compared with DPSGD, DBD has 20% higher benign accuracy and 5% lower attack success rate in all cases.
  • Main Results: Against defenses using an additional benign dataset, DBD reaches the smallest ASR while achieving the highest or second-highest BA in almost all cases.NC has benign accuracy on par with DBD but sacrifices attack success rate, especially on ImageNet.
  • Robustness and Ablation: DBD remains effective at a 20% poisoning rate and against an adaptive attack, achieving BA=93.21% and ASR=1.02% versus BA=94.96% and ASR=99.70% without defense.The ablation study attributes performance differences to decoupling, SCE loss, filtering low-credible samples, and semi-supervised fine-tuning.

6 CONCLUSION

The paper concludes that decoupling training with self-supervised backbone learning, supervised classifier training, and semi-supervised fine-tuning reduces backdoor threats while preserving benign accuracy.

  • DBD learns the backbone via self-supervised learning, trains fully connected layers with supervised learning, then fine-tunes the whole model semi-supervised.High- and low-credibility samples are determined using label-noise learning before fine-tuning.
  • The method is motivated by the finding that trigger–target-label connections are learned mostly through end-to-end supervised training.
  • Extensive experiments verify that DBD reduces backdoor threats while preserving high accuracy on benign samples.

ETHICS STATEMENT

The ethics statement frames DNN security as important in mission-critical applications and presents the defense as applicable to training with untrusted samples. It also cautions that the method does not cover every backdoor scenario and should not prompt excessive optimism.

  • DNN security is especially significant because these models are widely used in mission-critical areas such as face recognition.
  • The proposed pipeline aims to obtain backdoor-free DNNs when the training dataset contains poisoned samples.
  • The work is described as purely defensive and as not revealing new DNN vulnerabilities.
  • The defense is applicable only when training with untrusted samples, while backdoor attacks may occur in other scenarios.
  • The authors caution against excessive optimism about eliminating backdoor threats.

B DETAILED SETTINGS FOR MAIN EXPERIMENTS

The detailed settings cover dataset subsets, attack configurations, model training, baseline defenses, visualization, and the three stages of the proposed defense. Experiments use varied attack and optimization parameters across CIFAR-10, ImageNet, and VGGFace2 settings.

  • Attack setups: Main attacks include BadNets, blended, label-consistent, and WaNet attacks, generally using target label y_t = 3.The blended attack uses λ = 0.1; label-consistent settings include varying perturbation sizes.
  • Attack setups: ImageNet WaNet uses kernel size k = 224 and strength s = 1 without the noise mode because default settings weakened attack effectiveness.
  • Proposed defense: DBD uses SimCLR for 100-epoch backbone training, then Adam with learning rate 0.002 and batch size 128 for the fully connected layer.The same settings are used across datasets, models, and attacks.

C DEFENDING AGAINST ATTACKS ON VGGFACE2 DATASET

On VGGFace2, the proposed defense achieves the best reported performance against the evaluated attacks, while NC obtains comparable benign accuracy only with a sacrifice in attack success rate.

  • Experimental setup: VGGFace2 experiments use a randomly selected dataset subset and DenseNet-121 with batch size 32.
  • Experimental setup: The evaluation includes poisoned samples generated by different attacks, with examples shown in Figure 5.
  • Baseline settings: NAD computes its loss over the second-to-last layer of DenseNet-121, using other settings from the ImageNet experiments.
  • Results: The proposed defense reaches the best performance in Table 9 compared with NC and NAD.
  • Results: NC achieves benign accuracy on par with the proposed method, but does so with a sacrifice in attack success rate.
  • Results: DPSGD and NAD are sensitive to hyperparameters, whose best settings are selected by maximizing BA − ASR after defense.

D.1 SEARCHING BEST RESULTS FOR DPSGD

The supplied passages document implementation and sensitivity analyses for DBD and competing defenses, including poisoning rates, trigger variants, filtering, and computational cost. DBD maintains low attack success while preserving benign accuracy across the reported settings.

  • DPSGD settings: For DPSGD, larger σ lowers both ASR and BA, and the reported results identify the best settings across the evaluated tables.The passages provide the qualitative σ relationship but not the table values themselves.
  • Label-consistent attacks: DBD remains effective against label-consistent attacks at a 0.6% poisoning rate, outperforming defenses with the same requirements and matching or exceeding stronger-requirement defenses under default settings.NC and NAD require an additional local benign dataset, unlike DPSGD, ShrinkPad, and DBD.
  • Different trigger patterns: ASR remains below 2% and BA above 92% for every tested trigger pattern in the BadNets CIFAR-10 evaluation.The study changes trigger location and size while keeping other settings unchanged.
  • Dynamic triggers: 92.4% benign accuracy and 0.4% attack success rate are reported for DBD against a dynamic-trigger attack, compared with 94.8% and 2.4% for MESA.The dynamic attack uses a distribution of triggers rather than a fixed trigger; MESA failed against blended attack whereas DBD remained effective.
  • Filtering rate: Filtering rate α creates a trade-off: higher rates increase labeled samples but also increase the probability that poisoned samples enter the high-credible set.DBD maintains relatively high benign accuracy at α = 30% and reaches a nearly 0% attack success rate in all tested cases; very large α can recreate hidden backdoors during fine-tuning.
  • Implementation and cost: The defense evaluation uses SimCLR, MixMatch, and label-noise learning components, with DBD’s filtering rate α set to 50% in all cases.The supplied implementation passages also describe NT-Xent, SCE, and MixMatch losses and the reported computational facilities.

M DBD WITH DIFFERENT SELF-SUPERVISED METHODS

DBD is evaluated with alternative self-supervised backbones and label-noise learning configurations. Its performance remains similar or effective across these substitutions.

  • Self-supervised methods: All DBD variants have similar performance when SimCLR is replaced by MoCo-V2 or BYOL, indicating low sensitivity to the self-supervised method.The comparison uses CIFAR-10 and keeps other settings unchanged.

N DBD WITH DIFFERENT LABEL-NOISE LEARNING METHODS

The paper explains DBD’s effectiveness against label-consistent attacks through feature-space behavior under self-supervised learning and the distinct feature composition of poisoned samples.

  • Feature-space mechanism: Poisoned samples cluster under standard supervised learning across poison-label and clean-label attacks, motivating self-supervised learning to prevent this gathering.The paper links the clustering to trigger-feature learning under the end-to-end supervised paradigm.
  • Label-consistent attacks: In label-consistent attacks, poisoned samples combine trigger features with benign features carrying untargeted adversarial perturbations, helping explain their separation under self-supervised learning.This explanation is specific to the feature composition described for the label-consistent attack.
Loading 2202.03423v1…