Backdoor attack has emerged as a major security threat to deep neural networks (DNNs). While existing defense methods have demonstrated promising results on detecting or erasing backdoors, it is still not clear whether robust training methods can be devised to prevent the backdoor triggers being injected into the trained model in the first place. In this paper, we introduce the concept of \emph{anti-backdoor learning}, aiming to train \emph{clean} models given backdoor-poisoned data. We frame the overall learning process as a dual-task of learning the \emph{clean} and the \emph{backdoor} portions of data. From this view, we identify two inherent characteristics of backdoor attacks as their weaknesses: 1) the models learn backdoored data much faster than learning with clean data, and the stronger the attack the faster the model converges on backdoored data; 2) the backdoor task is tied to a specific class (the backdoor target class). Based on these two weaknesses, we propose a general learning scheme, Anti-Backdoor Learning (ABL), to automatically prevent backdoor attacks during training. ABL introduces a two-stage \emph{gradient ascent} mechanism for standard training to 1) help isolate backdoor examples at an early training stage, and 2) break the correlation between backdoor examples and the target class at a later training stage. Through extensive experiments on multiple benchmark datasets against 10 state-of-the-art attacks, we empirically show that ABL-trained models on backdoor-poisoned data achieve the same performance as they were trained on purely clean data. Code is available at \url{https://github.com/bboylyg/ABL}.
翻译:后门攻击已成为对深层神经网络( DNNS ) 的重大安全威胁。 虽然现有的防御方法在发现或消除后门数据部分方面显示了令人乐观的成果, 但仍不清楚能否设计出强有力的培训方法来防止后门触发器被注入到经过训练的模式中。 在本文中, 我们引入了“ emph{ anti- brown learning} 概念, 旨在培训后门数据提供的模式。 我们把整个学习过程设置为学习\ emph{ clean} 和\ emph{ backdoor} 数据部分的双重任务。 从这个角度, 我们发现后门攻击的两个内在特征是其弱点:(1) 后门攻击的内在特征比学习清洁数据要快得多, 而后门学习的速度越快;(2) 后门任务与特定的类( 后门目标类) 有关。 基于这两个弱点, 我们提出一个通用学习计划, 反后门学习( ABL), 自动防止后门攻击的内在特性特征攻击, 在培训的AL 阶段, 在后门级训练中, 将一个标准 级, 以Breal- breportal viol- beal viol