Backdoor attacks pose a severe threat to deep neural networks (DNNs) by injecting malicious triggers into training data, allowing attackers to manipulate model predictions while maintaining normal behavior for regular users. To address this, we propose a proactive defense method called PMRF (pruning-based segmentation & Mutual Reinforcement Filtering). Our approach filters out backdoor samples before model training by leveraging the behavioral differences between clean and backdoor samples under pruned models. PMRF can be integrated with most post-training defense methods, effectively mitigating backdoor threats. We evaluate our method on the CIFAR-10 dataset (with a poisoning rate of 0.3%) against four attacks using VGG16 and ResNet18 models. Experimental results demonstrate the robustness of PMRF across various attack scenarios. For instance, on the ResNet-18 architecture, the clean data accuracy (ACC) only drops from 91.71% to 91.24%, while the attack success rate (ASR) decreases significantly from 100% to 1.33%, substantially mitigating the threats of backdoor attacks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

BackdoorHunter: Poisoned Training Data Removal via Contrastive Responses Under Pruned Models

  • Rixi Liang,
  • Shuai Zhou,
  • Mingxu Zhu,
  • Chi Liu,
  • Minfeng Qi

摘要

Backdoor attacks pose a severe threat to deep neural networks (DNNs) by injecting malicious triggers into training data, allowing attackers to manipulate model predictions while maintaining normal behavior for regular users. To address this, we propose a proactive defense method called PMRF (pruning-based segmentation & Mutual Reinforcement Filtering). Our approach filters out backdoor samples before model training by leveraging the behavioral differences between clean and backdoor samples under pruned models. PMRF can be integrated with most post-training defense methods, effectively mitigating backdoor threats. We evaluate our method on the CIFAR-10 dataset (with a poisoning rate of 0.3%) against four attacks using VGG16 and ResNet18 models. Experimental results demonstrate the robustness of PMRF across various attack scenarios. For instance, on the ResNet-18 architecture, the clean data accuracy (ACC) only drops from 91.71% to 91.24%, while the attack success rate (ASR) decreases significantly from 100% to 1.33%, substantially mitigating the threats of backdoor attacks.