PaperlayerView exact revision on arXiv

Source-linked AI summary

Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencoder

Tao Sun, Lu Pang, Weimin Lyu, Chao Chen, Haibin Ling

arXiv:2303.15564v3cs.LGcs.CV

TL;DR

Blind test-time defense must recover labels for potentially backdoored images when models and data are unavailable, a challenge amplified by diverse local triggers. BDMAE uses MAE restorations to detect and refine trigger regions, then adaptively fuses them into purified images; experiments report effectiveness across benchmarks and attack settings, with the method focused on local attacks.

  • Problem

    Blind test-time defense seeks correct labels for individual images using only predictions from potentially backdoored models, while existing purification can trade trigger removal against semantic preservation.

    Source: §III · p. 3, K. Discussion and Limitation · p. 14

  • Method

    BDMAE scores trigger regions through image similarity and prediction consistency across MAE restorations, refines the scores with trigger topology, and adaptively fuses restorations for prediction.

    Source: §I · p. 2, C. Topology-aware Score Refinement · p. 5

  • Results

    Experiments on four benchmarks under varied backdoor settings verify BDMAE's effectiveness and generalizability.

    Source: §VII · p. 15

  • Takeaways & Limitations

    The reported demonstrations cover local triggers with different patterns and shapes, while the method's stated scope excludes triggers spanning the entire image.

    Source: K. Discussion and Limitation · pp. 14–15

    BDMAE focuses on local attacks; for triggers overlapping the entire image, an additional transformation may be applied beforehand.

    Source: K. Discussion and Limitation · p. 15

Abstract

from arXiv · show

Deep neural networks are vulnerable to backdoor attacks, where an adversary manipulates the model behavior through overlaying images with special triggers. Existing backdoor defense methods often require accessing a few validation data and model parameters, which is impractical in many real-world applications, e.g., when the model is provided as a cloud service. In this paper, we address the practical task of blind backdoor defense at test time, in particular for local attacks and black-box models. The true label of every test image needs to be recovered on the fly from a suspicious model regardless of image benignity. We consider test-time image purification that incapacitates local triggers while keeping semantic contents intact. Due to diverse trigger patterns and sizes, the heuristic trigger search can be unscalable. We circumvent such barrier by leveraging the strong reconstruction power of generative models, and propose Blind Defense with Masked AutoEncoder (BDMAE). BDMAE detects possible local triggers using image structural similarity and label consistency between the test image and MAE restorations. The detection results are then refined by considering trigger topology. Finally, we fuse MAE restorations adaptively into a purified image for making prediction. Extensive experiments under different backdoor settings validate its effectiveness and generalizability.

I. INTRODUCTION

The introduction frames blind test-time defense for local backdoor attacks as a practical need when model parameters and clean validation data are unavailable. BDMAE uses MAE restorations to detect and remove triggers, with experiments reporting strong accuracy across benchmarks and settings.

I. INTRODUCTION

  • Existing defenses often require validation data or model parameters, limiting their practicality when models are provided as black-box services.Some defenses reverse-engineer triggers, prune neurons, or retrain models; the paper focuses on local attacks.Source: §I · p. 1
  • BDMAE targets on-the-fly recovery of true labels for streamed test images using only hard-label predictions from a potentially backdoored black-box model.The setting assumes no information about whether the model or test images are backdoored and no additional data access.Source: §I · p. 1
  • MAE masking enables trigger search in token space because semantic content can be recovered even at high masking ratios, supporting complex patterns and larger images.Each image patch corresponds to one of 14×14 tokens; the passage gives 75% as an example masking ratio.Source: §I · p. 2
  • BDMAE scores possible trigger patches using structural similarity and prediction consistency across MAE restorations, then refines scores using trigger topology.It adaptively fuses restorations into a purified image for prediction and requires neither task-specific training images nor hyperparameter tuning.Source: §I · p. 2
  • Across Cifar10, GTSRB, ImageNet, and VGGFace2, BDMAE reports superior accuracy on backdoored and clean images across model architectures, image sizes, and trigger patterns.The supplied passage does not provide benchmark-specific values.Source: §I · p. 2

II. RELATED WORKS

Related work distinguishes local visible triggers from global attacks and describes defenses that rely on training data, model access, or image transformations. The motivation contrasts those approaches with MAE-assisted trigger search and restoration, aiming to preserve clean content while handling backdoored images.

II. RELATED WORKS

  • Prior defenses include training-stage changes, model pruning or retraining, and test-time GradCAM purification; several require model access or clean labeled data.Other black-box work commonly identifies backdoored models and rejects predictions, whereas this paper seeks true labels for each test image.Source: §II · p. 2
  • BDMAE is introduced as using pretrained MAE both to detect triggers and restore images, rather than only applying MAE to conventional vision tasks.MAE is described as a scalable self-supervised learner that masks random image patches and restores missing pixels.Source: §II · p. 3

III. MOTIVATION AND INTUITION

  • Global transformations such as blurring or shrinking trade trigger removal against semantic damage, while diffusion purification can alter details under distribution mismatch.Different image resolutions are given as an example of mismatch with pretrained data.Source: §III · p. 3
  • The motivation is to keep clean regions intact while locating local triggers and restoring missing content, using pretrained MAE to search token space instead of image space.The paper contrasts this use of MAE for trigger search with diffusion methods that hallucinate entire image contents.Source: §III · p. 3
  • Unlike methods that filter backdoored images and refuse predictions, BDMAE aims to retain accuracy on both clean and backdoored inputs.The motivation also distinguishes MAE-assisted trigger search from generative methods that reconstruct the entire image.Source: §III · p. 3

A. Problem Formulation

The formulation assumes a black-box model and no additional data, with predictions required for test images whether clean or triggered. BDMAE uses MAE restorations to score candidate trigger regions and restore images for prediction.

A. Problem Formulation

  • Blind defense must recover labels on the fly from hard-label predictions alone, without additional data or knowing whether the model or image is backdoored.The scope is local visible triggers occupying a small image area.Source: A. Problem Formulation · p. 3

B. Trigger Score Generation

  • Image-based SSIM and label-prediction consistency provide complementary trigger scores from MAE restorations.Trigger-region SSIM tends to be low while clean regions are well restored; prediction inconsistency across masks usually signals trigger removal.Source: B. Trigger Score Generation · pp. 3–4
  • MAE’s 14×14 token grid makes trigger search more efficient than searching across all image pixels.The method uses a high masking ratio because MAE can recover image content with 75% of tokens masked.Source: B. Trigger Score Generation · p. 3
  • Each score matrix assigns a trigger likelihood to image patches, and searching the 14×14 token space reduces the search space relative to image pixels.Image-based scoring favors large or complex triggers, while label-based scoring favors small ones.Source: B. Trigger Score Generation · pp. 3–4
  • The purified image produced by adaptive restoration is used for the final prediction.The framework generates trigger scores and refines them using trigger topology before restoration.Source: Figure 2 · p. 4
  • The MAE restoration process resizes images to 224×224 for reconstruction and returns them to their original dimensions.The additional resizing steps aim to remove interpolation errors in unmasked regions.Source: B. Trigger Score Generation · p. 4
  • The procedure samples random token masks repeatedly, obtains MAE reconstructions and hard-label predictions, and fuses restorations for scoring.The sampling uses a default 75% masking ratio.Source: B. Trigger Score Generation · p. 4
  • The fused reconstruction keeps MAE-restored patches and discards the corresponding original patches, so incompletely masked triggers do not reappear there.Sampling is adjusted so every patch can be restored.Source: B. Trigger Score Generation · p. 4

C. Topology-aware Score Refinement

Initial trigger scores are noisy and difficult to threshold. The method refines them with topology-aware masks and model predictions, concentrating refinement on likely trigger regions.

C. Topology-aware Score Refinement

  • Initial trigger scores are noisy, with a small difference between trigger and clean regions that makes a universal filtering threshold difficult to set.The refinement uses continuity of trigger patterns to focus on likely trigger regions.Source: C. Topology-aware Score Refinement · p. 4
  • Refinement is restricted to the top L likely trigger tokens to avoid raising scores in clean regions of clean images or models.The algorithm applies repeated topology-aware masks within that restricted region.Source: C. Topology-aware Score Refinement · p. 5
  • Topology-aware masks select high-scoring tokens and their four-nearest neighbors, balancing score-based selection with random exploration.The selection continues until half of the tokens in the mask are selected.Source: C. Topology-aware Score Refinement · p. 5
  • The method adjusts scores according to whether the masked MAE restoration’s hard-label prediction differs from the original prediction.A prediction change raises scores for masked tokens and lowers scores elsewhere; otherwise, the adjustment is reversed, while the score average remains unchanged.Source: C. Topology-aware Score Refinement · p. 5

D. Adaptive Image Restoration

Because the best binary-mask threshold varies across attacks and datasets, the method fuses MAE restorations from nested thresholds into one purified image for prediction.

D. Adaptive Image Restoration

  • The threshold for converting combined trigger scores into a binary mask varies with image resolution, attack method, and trigger size.A single threshold therefore may not suit all settings.Source: D. Adaptive Image Restoration · p. 5
  • The method fuses restorations from nested score thresholds, increasing them until the lowest threshold selects no more than 25% of image tokens.The same predefined thresholds are used across tasks without dataset-specific tuning.Source: D. Adaptive Image Restoration · p. 5
  • The fused purified image is passed to the model for the final prediction.The restorations correspond to masks formed by applying the different thresholds to the combined trigger score.Source: D. Adaptive Image Restoration · p. 5

E. Generalization to Clean Images and Models

The method is intended for settings in which images and models may be clean or backdoored, and the experiments span several image-classification datasets.

E. Generalization to Clean Images and Models

  • BDMAE applies when either the model or the image is clean or backdoored, and the paper reports a clean-image effectiveness check using the CA metric.The passage points to a separate discussion for clean models but does not report its outcome here.Source: E. Generalization to Clean Images and… · p. 5

A. Datasets

  • Evaluation uses Cifar10, GTSRB, VGGFace2, and ImageNet10, ImageNet50, and ImageNet100.VGGFace2 experiments use 170 randomly selected classes; the ImageNet subsets use the first 10, 50, or 100 classes alphabetically.Source: A. Datasets · p. 5
  • Cifar10 and GTSRB are 32×32 datasets with 50,000 and 39,209 training images, respectively.Their test sets contain 10,000 and 12,630 images, respectively.Source: A. Datasets · p. 5

B. Backdoor Attack Settings

The experiments instantiate BadNet, LC, IAB, and Blended attacks with varied trigger forms, and use shared configurations across datasets alongside pretrained MAE restoration.

B. Backdoor Attack Settings

  • BadNet, LC, IAB, and Blended attacks use triggers ranging from small patches and icons to checkerboards, random pixels, and sample-specific curves or shapes.Source: B. Backdoor Attack Settings · pp. 5–6
  • Sample visualizations show Cifar10 with a 2×2-color trigger and VGGFace2 with a Twitter trigger, while refinement examples use Cifar10/IAB and GTSRB/LC.Source: Figure 3 · p. 6, Figure 4 · p. 6

C. Method Configurations

  • Table I compares diffusion purification on 500 test images, while Tables II and III cover other purification methods and three challenging attacks.Table I covers BadNet, IAB, and Blended; Table III identifies VGGFace2 and ImageNet10 abbreviations.Source: Table I · p. 6, Table II · p. 7, Table III · p. 7

B. Backdoor Attack Settings

  • Backdoored models used 10% poisoned training data, ResNet18 or pretrained ResNet50 backbones, and 14 repeats for Cifar10/GTSRB versus six for VGGFace2/ImageNet.Source: B. Backdoor Attack Settings · p. 6

C. Method Configurations

  • The same hyperparameters were used across experiments, including a 75% masking ratio, No = Ni = 5, and Nr = 10.Source: C. Method Configurations · p. 6
  • The method uses pretrained MAE Base and Large variants; Cifar10 and GTSRB images are up-sampled to 224×224 for restoration and then returned to original size.Source: C. Method Configurations · pp. 6–7

D. Experiment Environment

The evaluation compares BDMAE with purification baselines across standard and challenging backdoor settings. Reported findings emphasize accuracy on clean and backdoored images and differences among competing methods.

D. Experiment Environment

  • Experiments used Nvidia A5000 or A6000 GPUs with PyTorch 1.8; evaluation metrics were clean accuracy (CA), backdoored-image accuracy (BA), and attack success rate (ASR).Compared methods included Blur, ShrinkPad, PatchCleanser, DiffPure, and white-box Februus.Source: D. Experiment Environment · p. 7

E. Main Results

  • DiffPure partially purifies backdoored images but is much less effective than BDMAE; its sampling is extremely slow and results cover only 500 test images.The authors also report low clean accuracy and high attack success rate for DiffPure.Source: E. Main Results · p. 7
  • Februus purifies backdoored images but is not black-box, while PatchCleanser's noisy-label inconsistency check is often associated with low BA and high ASR.Source: E. Main Results · p. 7
  • Figure 5 examines the effects of repeated count No, refinement count Nr, and sampling parameter u in topology-aware token-mask generation.Source: Figure 5 · p. 8
  • Blur and ShrinkPad face a trade-off: stronger transformations are more likely to incapacitate triggers but decrease clean accuracy.Source: E. Main Results · p. 8
  • BDMAE achieves high accuracies on clean and backdoored images, with consistently high accuracies across challenging IAB, LC, and Blended settings.Source: E. Main Results · p. 8

VI. ANALYSIS

The analysis finds that topology-aware refinement sharpens trigger scores and widens useful threshold ranges. Ten refinement steps and topology-aware sampling perform well across the tested settings.

A. Effects of Topology-aware Refinement

  • After 10 refinements, trigger scores concentrate on trigger regions, and refinement widens the ranges of thresholds that work across tasks.The wider ranges make it easier to set unified thresholds.Source: A. Effects of Topology-aware Refinement · p. 8

B. Sensitivity on Hyper-parameters

  • No = 5 generally works well for both image-based and label-based scores, while Nr = 10 is sufficient across tested datasets and triggers.The image-based SSIM score map changes little across MAE restorations, whereas averaging more results reduces variance in the label-based score.Source: B. Sensitivity on Hyper-parameters · p. 9

C. Topology-aware Token Mask Generation

  • For challenging IAB attacks, performance drops without topology-aware sampling; u = 0.5 performs relatively well across four tested tasks.Sampling favors neighboring tokens, encouraging continuous patches during refinement.Source: C. Topology-aware Token Mask Generation · p. 9

D. Computational Efficiency

The analysis compares defense runtime, trigger-size sensitivity, and test-time transformations. BDMAE combines image similarity and label consistency across tested trigger sizes, while transformations alone face a trade-off between reducing attack success and preserving clean accuracy.

D. Computational Efficiency

  • 10.6 minutes for Februus, 24.5 for PatchCleanser, about 54.0 for Large MAE, and over 3000 estimated for DiffPure on 19k images; Base MAE takes similar time to PatchCleanser.Runtime was measured or estimated using one A6000 GPU; DiffPure's estimate extrapolates from a 1k-image sample.Source: D. Computational Efficiency · p. 9

E. Varying Trigger Size

  • The full method works across tested checkerboard sizes by combining image similarity and label consistency, while each score alone has a size-dependent weakness.Image similarity struggles with 1×1 triggers, whereas label consistency degrades as trigger size grows because random masking may not remove the trigger completely.Source: E. Varying Trigger Size · pp. 9–10

F. Defense with More Test-Time Transformations

  • Noise-based voting depends on a narrow intensity trade-off, DeepSeep requires clean samples for fine-tuning, and STRIP neither locates triggers nor recovers true labels.Weak noise may leave backdoor behavior intact, while strong noise may destroy semantic content.Source: F. Defense with More Test-Time… · pp. 10–11
  • Weak transformations do not reduce ASR, while stronger ones reduce it at an unacceptable cost to clean-image accuracy.Maintaining clean-image performance would require adapting the model to the transformations, for example through fine-tuning, which is infeasible in the blind black-box setting.Source: Figure 8 · p. 10, F. Defense with More Test-Time… · p. 11

G. Generalization on Network Architecture

BDMAE performs consistently better than other black-box methods across the tested network architectures. Its design also aims to preserve clean content, and results on clean models show minimal accuracy changes on clean and backdoored images.

G. Generalization on Network Architecture

  • BDMAE achieves consistently better performance than other black-box methods across the tested architectures on Cifar10 and VGGFace2.Februus performs well on the shallow Cifar10 CNN used by its authors but less effectively on ResNet18 and VGG16; its clean accuracies are relatively low on VGGFace2.Source: G. Generalization on Network… · p. 11

H. Generalization to Clean Images and Clean Models

  • On clean models, prediction accuracies on clean and backdoored images are minimally affected; for clean images, small trigger scores leave semantic content unchanged.The method is designed to keep clean regions intact during score refinement and adaptive restoration.Source: H. Generalization to Clean Images and… · pp. 11, 13

I. Visualizations of Defense Process

The visualizations show refined scores locating triggers and purified images retaining content while enabling correct predictions. They also contrast localized restoration with competing transformations and state the method's focus on local attacks.

I. Visualizations of Defense Process

  • Refined trigger scores concentrate on trigger regions, and purification removes triggers while preserving image content and enabling correct predictions.For IAB attacks, the method identifies different sample-specific triggers, including irregular curves and color patches, and also locates tiny triggers in larger images.Source: §I · pp. 13–14

J. Visualization of Defense Results

  • ShrinkPad and Blur use global transformations that may incapacitate triggers without removing them; strong transformations for large IAB triggers also sacrifice clean accuracy.The comparison is illustrated in Figures 11–12.Source: J. Visualization of Defense Results · p. 14
  • DiffPure may alter facial expressions and features or fail to recover GTSRB digits, whereas BDMAE restores trigger-related regions and keeps other semantic details intact.The visual comparison includes VGGFace2 and GTSRB examples.Source: J. Visualization of Defense Results · p. 14

K. Discussion and Limitation

  • The method focuses on local attacks; for triggers spanning the entire image, an additional transformation may be applied before BDMAE.The paper notes that global triggers are less robust against image transformations [41].Source: K. Discussion and Limitation · p. 15

VII. CONCLUSION

  • Experiments on four benchmarks under varied backdoor settings verify the effectiveness and generalizability of the blind test-time defense framework.The framework detects triggers and restores images.Source: §VII · p. 15
Loading 2303.15564v3…