不依赖标签数据，用权重对称性清除模型后门
Circumventing Backdoor Space via Weight Symmetry
- 利用神经网络的置换不变性和二次连接性设计净化方法
- 仅需少量干净样本即可在监督与自监督任务中有效去毒
- 适用于多种学习范式，尤其适合无标签场景
深度神经网络易受后门攻击，攻击者可在训练阶段植入恶意行为。现有防御方法虽能有效净化被污染模型，但通常需要标签数据或特定训练流程，难以推广至监督学习以外的场景。近期研究已证明后门攻击可跨多种学习范式成功实施，凸显严重安全风险。为此，我们提出两阶段对称连通性（TSC）防御方法，其不依赖数据格式，仅需少量干净样本即可运行。理论分析表明，通过利用神经网络的置换不变性与二次模式连通性，TSC能放大中毒样本的损失，同时保持清洁准确率稳定。实验显示，TSC在监督学习场景下性能媲美最先进方法；进一步扩展至自监督框架（如SimCLR、CLIP），仍保持强防御能力。代码已开源。
原文摘要 · Abstract (English)
Deep neural networks are vulnerable to backdoor attacks, where malicious behaviors are implanted during training. While existing defenses can effectively purify compromised models, they typically require labeled data or specific training procedures, making them difficult to apply beyond supervised learning settings. Notably, recent studies have shown successful backdoor attacks across various learning paradigms, highlighting a critical security concern. To address this gap, we propose Two-stage Symmetry Connectivity (TSC), a novel backdoor purification defense that operates independently of data format and requires only a small fraction of clean samples. Through theoretical analysis, we prove that by leveraging permutation invariance in neural networks and quadratic mode connectivity, TSC amplifies the loss on poisoned samples while maintaining bounded clean accuracy. Experiments demonstrate that TSC achieves robust performance comparable to state-of-the-art methods in supervised learning scenarios. Furthermore, TSC generalizes to self-supervised learning frameworks, such as SimCLR and CLIP, maintaining its strong defense capabilities. Our code is available at https://github.com/JiePeng104/TSC.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。