Source-linked AI summary
Data-free Backdoor Removal based on Channel Lipschitzness
Runkai Zheng, Rongjun Tang, Jianze Li, Li Liu
TL;DR
Backdoor defenses may need to operate with only an infected model and no training data. The paper proposes CLP, which uses channel Lipschitz upper bounds from model weights to prune likely backdoor channels; experiments report effective backdoor removal with high clean accuracy and threshold robustness.
Problem
Defenders may receive only a pretrained infected model, while backdoor-related channels must be identified without relying on unavailable trigger or training data.
Method
CLP calculates upper bounds of channel Lipschitz constants from model weights and prunes channels with abnormally high values.
Results
CLP reduces attack success rates against different advanced attacks with only a negligible clean-accuracy drop and achieves state-of-the-art performance without data.
Takeaways & Limitations
Channel Lipschitzness provides a data-free basis for locating potential backdoor channels and repairing infected models through simple pruning.
Takeaways & Limitations
The method assumes the model parameters are accessible and relies on activation functions such as ReLU being Lipschitz; extreme pruning can make predictions illogical.
Abstract
from arXiv · showhide
Recent studies have shown that Deep Neural Networks (DNNs) are vulnerable to the backdoor attacks, which leads to malicious behaviors of DNNs when specific triggers are attached to the input images. It was further demonstrated that the infected DNNs possess a collection of channels, which are more sensitive to the backdoor triggers compared with normal channels. Pruning these channels was then shown to be effective in mitigating the backdoor behaviors. To locate those channels, it is natural to consider their Lipschitzness, which measures their sensitivity against worst-case perturbations on the inputs. In this work, we introduce a novel concept called Channel Lipschitz Constant (CLC), which is defined as the Lipschitz constant of the mapping from the input images to the output of each channel. Then we provide empirical evidences to show the strong correlation between an Upper bound of the CLC (UCLC) and the trigger-activated change on the channel activation. Since UCLC can be directly calculated from the weight matrices, we can detect the potential backdoor channels in a data-free manner, and do simple pruning on the infected DNN to repair the model. The proposed Channel Lipschitzness based Pruning (CLP) method is super fast, simple, data-free and robust to the choice of the pruning threshold. Extensive experiments are conducted to evaluate the efficiency and effectiveness of CLP, which achieves state-of-the-art results among the mainstream defense methods even without any data. Source codes are available at https://github.com/rkteddy/channel-Lipschitzness-based-pruning.
1. Introduction
The paper targets backdoor defense when defenders have only an infected model, proposing data-free pruning based on channel sensitivity measured through Lipschitzness. It links high channel Lipschitzness to trigger-related activation changes and reports fast, threshold-robust mitigation with negligible clean-accuracy loss.
- Backdoor attacks implant trigger-specific malicious responses while preserving normal behavior on benign inputs.
- When only a pretrained infected model is available, defenders may lack control of training and access to the original data.
- Channel Lipschitzness measures each channel’s input sensitivity, targeting sensitive channels rather than controlling the whole network’s Lipschitz constant.
- Channels with large trigger-activated changes usually have high channel Lipschitz constants, motivating their pruning.
- CLP derives channel Lipschitz upper bounds from model weights and prunes high-Lipschitz channels without training data.
- CLP reduces attack success rates against different advanced attacks with only a negligible drop in clean accuracy and is robust to its pruning threshold.
2. Related work
The related work covers poisoning and non-poisoning backdoor attacks, training-stage defenses, and model post-processing defenses. CLP is positioned as a data-free post-processing alternative that is robust to its sole hyperparameter.
- 2.1. Backdoor Attack: Poisoning-based backdoors inject trigger patterns and malicious labels into training samples, whereas non-poisoning attacks directly modify model architectures or parameters.
- 2.2.1. TRAINING STAGE DEFENSES: Training-stage defenses filter poisoned data or suppress triggers while assuming access to the training process.
- 2.2.2. MODEL POST-PROCESSING DEFENSES: Model post-processing defenses remove backdoors from suspicious models using pruning, trigger reverse engineering, fine-tuning, or related techniques.
- 2.2.2. MODEL POST-PROCESSING DEFENSES: Adversarial Neuron Pruning detects sensitive neurons with adversarial perturbations but requires benign data and careful hyperparameter tuning.
- 2.2.2. MODEL POST-PROCESSING DEFENSES: CLP differs from these post-processing methods by requiring no benign data and remaining robust to its only hyperparameter.
3. Preliminaries
The preliminaries define the classification setting, network and pruning notation, poisoning setup, and Lipschitz sensitivity measure. They also introduce TAC as trigger-induced activation change and UCLC–TAC correlation as the basis for channel selection.
- 3.1. Notations: The paper considers a C-class classification problem with N training samples and image dimensions described by channel, height, and width variables.
- 3.1. Notations: The network is a composition of L linear layers and elementwise nonlinear activations, with convolutional weights indexed by layer.
- 3.1. Notations: Pruning selects layer-channel indices and applies binary masks to convolutional weight tensors through the Hadamard product.
- 3.1. Notations: The poisoning rate is the fraction of the original training set whose inputs are modified by a poisoning function.
- 3.3. Lipschitz Constant in Neural Networks: TAC measures average channel-activation differences between inputs with and without triggers, while UCLC is compared with TAC to identify sensitive channels.
- 3.2. Lipschitz Constant: A Lipschitz constant bounds the maximum output-to-input perturbation ratio and therefore measures sensitivity to input perturbations.
4. Methodology
The methodology defines channel-wise Lipschitz measures, relates trigger-activated changes to these measures, and uses weight-derived upper bounds to prune potentially backdoor-sensitive channels without data.
- Channel Lipschitz Constant: The channel Lipschitz constant measures the sensitivity of each layer's channel-output function to input changes.The model-to-channel mapping is treated as an independent function for each channel.
- Channel Lipschitz Constant: The upper bound of the channel Lipschitz constant is computed from layer weight matrices and cumulative Lipschitz factors.The bound incorporates linear-layer norms and activation-function Lipschitz constants.
- Channel Lipschitz Constant: For convolutional layers, reshaped kernel matrices provide a simpler spectral-norm approximation than explicitly constructing doubly block-Toeplitz matrices.The approximation avoids the time and memory costs of forming the full convolution matrix and showed acceptable experimental results.
- Trigger-activated Change: Trigger-activated Change measures the average activation difference for the same inputs with and without a trigger.Its magnitude reflects the trigger's effect on a channel, but calculating it requires access to the trigger pattern.
- Correlation between CLC and TAC: A high correlation between TAC and UCLC motivates using UCLC, which is weight-accessible, to identify potential backdoor channels.The method uses UCLC because TAC is inaccessible to defenders in general.
- Channel Lipschitzness based Pruning: Batch-normalization parameters are incorporated into the convolutional linear transformation when calculating UCLC.The paper treats each Conv-BN block as one linear layer.
- Channel Lipschitzness based Pruning: CLP prunes channels whose UCLC exceeds a layer-specific threshold based on the layer mean and standard deviation.The algorithm reshapes each channel's kernel, computes its spectral norm, applies the threshold, and outputs a pruned network.
5. Experiments
Experiments evaluate CLP across attacks, datasets, architectures, poisoning rates, and hyperparameters. CLP substantially reduces attack success while preserving clean accuracy, requires no data, and runs faster than comparison defenses.
- Experimental Results: CLP reduces average ASR to 2.81% with only a 0.67% average ACC drop on CIFAR-10.The comparison uses seven mainstream attacks on ResNet-18; CLP requires no data, while ANP and NAD use benign data and incur larger ACC tradeoffs.
- Experimental Results: CLP maintains robustness on Tiny ImageNet, including against the sample-specific attacks IAB and SSBA.The compared defenses experience severe ACC and ASR degradation on the larger-scale dataset.
- Ablation Studies: CLP’s hyperparameter u controls the trade-off between clean accuracy and backdoor robustness, with ASR often falling before ACC declines.The robustness interval is wider for Blended attack, narrower for CLA, and u = 3 remains acceptable for CLA.
- Ablation Studies: Across tested ResNet, VGG, and SENet architectures, CLP performs well, although the optimal u differs by architecture.For example, the reported optimal u for VGG-16 is about 9.
- Ablation Studies: CLP generally maintains high ACC and reduces ASR across poisoning rates, although CLA at a 1% poisoning rate yields about 10% ASR.The authors report that poisoning rate does not affect CLP performance much overall.
- Ablation Studies: CLP requires only 2.87 seconds and is almost five times faster than the fastest comparison method in the reported runtime test.CLP uses CPU time on 500 CIFAR-10 images with ResNet-18, whereas the other methods are evaluated on an RTX 2080Ti GPU.
6. Conclusions
The paper connects channel Lipschitzness with backdoor behavior and uses this connection to develop CLP, which prunes channels with abnormally high UCLC. CLP is data-free, fast, effective across attacks and architectures, and robust to its sole hyperparameter.
- The paper reveals a connection between channel Lipschitzness and backdoor behaviors in infected DNNs.
- CLP calculates an upper bound of each channel’s Lipschitz constant and prunes channels with abnormally high UCLC.
- Because UCLC is induced directly from model weights, CLP requires no data and runs super fast.
- Extensive experiments show effective backdoor removal while maintaining high ACC against various SOTA attacks.
- Ablation studies show robustness to the sole hyperparameter u and generalization across different CNN architectures.
A. You can have an appendix here.
The appendix may be used for additional material, including a one-column format, while the main body is limited to eight pages.
- The main body must be at most 8 pages long.
- An appendix may be added, including in a one-column format.