用非目标标签训练和互学习修复被投毒的模型
NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learning
- 用干净数据重训模型，生成高精度教师与高置信学生模型
- 在6种攻击下用少量干净样本仍有效防御，优于5种先进方法
- 适合对抗复杂后门攻击的模型安全防护场景
近期研究显示深度神经网络易受后门攻击，攻击者通过向数据集注入特定触发器，在激活时引发错误预测。本文提出一种新防御机制——非目标标签训练与互学习（NT-ML），可在高级后门攻击下成功恢复被污染模型。NT阶段通过使用标准训练输出重新训练模型，获得在干净数据上表现优异的教师模型，以及在投毒数据上具有更高正确预测置信度的学生模型。随后，教师与学生通过互学习（Mutual Learning）相互汲取优势，最终得到净化的学生模型。大量实验表明，NT-ML仅需少量干净样本即可有效防御6种后门攻击，性能超越5种现有先进防御方法。
原文摘要 · Abstract (English)
Recent studies have shown that deep neural networks (DNNs) are vulnerable to backdoor attacks, where a designed trigger is injected into the dataset, causing erroneous predictions when activated. In this paper, we propose a novel defense mechanism, Non-target label Training and Mutual Learning (NT-ML), which can successfully restore the poisoned model under advanced backdoor attacks. NT aims to reduce the harm of poisoned data by retraining the model with the outputs of the standard training. At this stage, a teacher model with high accuracy on clean data and a student model with higher confidence in correct prediction on poisoned data are obtained. Then, the teacher and student can learn the strengths from each other through ML to obtain a purified student model. Extensive experiments show that NT-ML can effectively defend against 6 backdoor attacks with a small number of clean samples, and outperforms 5 state-of-the-art backdoor defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。