通过分析中间特征识别后门，实现输入检测与模型清除的统一防御
BeniFul: Backdoor Defense via Middle Feature Analysis for Deep Neural Networks
- 利用DNN中间层特征差异区分恶意与正常样本
- 在CIFAR-10和Tiny ImageNet上对五种攻击均实现95%以上检测率
- 适合需要兼顾输入防护与模型净化的安全场景
后门防御在深度神经网络中日益重要，攻击者通过向训练数据注入后门样本植入后门。尽管已有多种方法可检测后门输入或消除模型后门，但二者之间的关系仍不清晰。本文基于DNN中间层特征，分析后门样本与正常样本的差异，提出“后门一致性”概念：若输入端精准检测到触发器，则至少存在一个后门。据此设计了名为BeniFul的综合防御方法，包含灰盒后门输入检测与白盒后门消除两部分。检测阶段使用变分自编码器的重构距离与模型推理结果，消除阶段引入特征距离损失。在CIFAR-10与Tiny ImageNet上针对五种先进攻击的实验表明，BeniFul在后门输入检测与消除方面均表现优异。
原文摘要 · Abstract (English)
Backdoor defenses have recently become important in resisting backdoor attacks in deep neural networks (DNNs), where attackers implant backdoors into the DNN model by injecting backdoor samples into the training dataset. Although there are many defense methods to achieve backdoor detection for DNN inputs and backdoor elimination for DNN models, they still have not presented a clear explanation of the relationship between these two missions. In this paper, we use the features from the middle layer of the DNN model to analyze the difference between backdoor and benign samples and propose Backdoor Consistency, which indicates that at least one backdoor exists in the DNN model if the backdoor trigger is detected exactly on input. By analyzing the middle features, we design an effective and comprehensive backdoor defense method named BeniFul, which consists of two parts: a gray-box backdoor input detection and a white-box backdoor elimination. Specifically, we use the reconstruction distance from the Variational Auto-Encoder and model inference results to implement backdoor input detection and a feature distance loss to achieve backdoor elimination. Experimental results on CIFAR-10 and Tiny ImageNet against five state-of-the-art attacks demonstrate that our BeniFul exhibits a great defense capability in backdoor input detection and backdoor elimination.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。