用自监督生成模型检测并清除数据投毒，提升模型安全性
Backdoor Defense through Self-Supervised and Generative Learning
- 在自监督表征空间中建模每类数据的生成分布
- 能有效识别中毒样本，净化数据集后攻击成功率大幅下降
- 适合关注模型鲁棒性与安全防御的研究者
后门攻击通过在少量训练数据中引入人工触发器并篡改标签，使模型在特定测试样本上产生恶意预测。现有防御多基于判别式学习的修改，本文提出新方法：在自监督表征空间中对每类数据构建生成模型。实验发现，近期后门攻击下这些表征要么保持稳定，要么被严重破坏，但无论哪种情况，生成模型均能有效检测中毒数据并实现数据净化。在净化后的数据上训练可显著降低攻击成功率，同时保持对良性输入的准确率。
原文摘要 · Abstract (English)
Backdoor attacks change a small portion of training data by introducing hand-crafted triggers and rewiring the corresponding labels towards a desired target class. Training on such data injects a backdoor which causes malicious inference in selected test samples. Most defenses mitigate such attacks through various modifications of the discriminative learning procedure. In contrast, this paper explores an approach based on generative modelling of per-class distributions in a self-supervised representation space. Interestingly, these representations get either preserved or heavily disturbed under recent backdoor attacks. In both cases, we find that per-class generative models allow to detect poisoned data and cleanse the dataset. Experiments show that training on cleansed dataset greatly reduces the attack success rate and retains the accuracy on benign inputs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。