用变分推理修复被投毒数据，让模型自动识别干净标签。
Seal Your Backdoor with Variational Defense
- 将恶意输入和错误标签视为可观测变量，通过变分推断恢复真实标签。
- 在标准数据集上对多种投毒攻击的防御准确率超现有方法。
- 可与自监督学习结合，适合高维分类任务的抗投毒场景。
我们提出VIBE，一种与模型无关的框架，用于训练对抗后门攻击的分类器。其核心思想是将训练数据中恶意输入和污染标签视为可观测随机变量，而真实干净标签为潜在变量。VIBE通过变分推断恢复对应的潜在干净标签后验分布，训练过程遵循期望-最大化（EM）算法：E步通过求解熵正则化最优传输问题推断干净伪标签，M步通过梯度下降更新分类器参数。该框架具有模块性，可无缝集成近期自监督表示学习技术，增强抗后门攻击能力。我们在标准数据集、包含1,000类的大规模设置及多攻击共存的中毒数据集上验证了方法有效性，结果表明，VIBE在所有测试场景中均持续优于先前防御方法。
原文摘要 · Abstract (English)
We propose VIBE, a model-agnostic framework that trains classifiers resilient to backdoor attacks. The key concept behind our approach is to treat malicious inputs and corrupted labels from the training dataset as observed random variables, while the actual clean labels are latent. VIBE then recovers the corresponding latent clean label posterior through variational inference. The resulting training procedure follows the expectation-maximization (EM) algorithm. The E-step infers the clean pseudolabels by solving an entropy-regularized optimal transport problem, while the M-step updates the classifier parameters via gradient descent. Being modular, VIBE can seamlessly integrate with recent advancements in self-supervised representation learning, which enhance its ability to resist backdoor attacks. We experimentally validate the method effectiveness against contemporary backdoor attacks on standard datasets, a large-scale setup with 1$k$ classes, and a dataset poisoned with multiple attacks. VIBE consistently outperforms previous defenses across all tested scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。