UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866909257162555392 |
|---|---|
| author | Cheng, Siyuan Shen, Guangyu Zhang, Kaiyuan Tao, Guanhong An, Shengwei Guo, Hanxi Ma, Shiqing Zhang, Xiangyu |
| author_facet | Cheng, Siyuan Shen, Guangyu Zhang, Kaiyuan Tao, Guanhong An, Shengwei Guo, Hanxi Ma, Shiqing Zhang, Xiangyu |
| contents | Deep neural networks (DNNs) have demonstrated effectiveness in various fields. However, DNNs are vulnerable to backdoor attacks, which inject a unique pattern, called trigger, into the input to cause misclassification to an attack-chosen target label. While existing works have proposed various methods to mitigate backdoor effects in poisoned models, they tend to be less effective against recent advanced attacks. In this paper, we introduce a novel post-training defense technique UNIT that can effectively eliminate backdoor effects for a variety of attacks. In specific, UNIT approximates a unique and tight activation distribution for each neuron in the model. It then proactively dispels substantially large activation values that exceed the approximated boundaries. Our experimental results demonstrate that UNIT outperforms 7 popular defense methods against 14 existing backdoor attacks, including 2 advanced attacks, using only 5\% of clean training data. UNIT is also cost efficient. The code is accessible at https://github.com/Megum1/UNIT. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2407_11372 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening Cheng, Siyuan Shen, Guangyu Zhang, Kaiyuan Tao, Guanhong An, Shengwei Guo, Hanxi Ma, Shiqing Zhang, Xiangyu Cryptography and Security Computer Vision and Pattern Recognition Deep neural networks (DNNs) have demonstrated effectiveness in various fields. However, DNNs are vulnerable to backdoor attacks, which inject a unique pattern, called trigger, into the input to cause misclassification to an attack-chosen target label. While existing works have proposed various methods to mitigate backdoor effects in poisoned models, they tend to be less effective against recent advanced attacks. In this paper, we introduce a novel post-training defense technique UNIT that can effectively eliminate backdoor effects for a variety of attacks. In specific, UNIT approximates a unique and tight activation distribution for each neuron in the model. It then proactively dispels substantially large activation values that exceed the approximated boundaries. Our experimental results demonstrate that UNIT outperforms 7 popular defense methods against 14 existing backdoor attacks, including 2 advanced attacks, using only 5\% of clean training data. UNIT is also cost efficient. The code is accessible at https://github.com/Megum1/UNIT. |
| title | UNIT: Backdoor Mitigation via Automated Neural Distribution Tightening |
| topic | Cryptography and Security Computer Vision and Pattern Recognition |
| url | https://arxiv.org/abs/2407.11372 |