通过可逆剪枝掩码精准清除后门,同时保留正常任务性能。
Backdoor Mitigation via Invertible Pruning Masks
- 设计可逆剪枝掩码,自动识别主任务与后门任务的关键参数。
- 在低数据场景下仍保持高鲁棒性,对受污染样本恢复准确率超90%。
- 适合需要高可解释性的安全模型部署,如医疗或金融领域。
模型剪枝已成为抵御深度学习后门攻击的有前景防御策略。然而,现有剪枝方法常难以准确识别并移除引发后门行为的具体参数。尽管微调类防御因表现更优而主导近期研究,剪枝仍具吸引力,因其具备更强可解释性,并在低数据条件下表现更稳健。本文提出一种新型剪枝方法,包含学习型选择机制以识别主任务与后门任务的关键参数,并引入可逆剪枝掩码,实现双重目标:消除后门任务的同时通过反向掩码保留其能力。该方法被建模为双层优化问题,联合学习选择变量、稀疏可逆掩码及从干净数据导出的样本级后门扰动。内层问题利用反向掩码合成候选触发器,外层问题优化掩码以抑制后门行为而不损害清洁任务准确率。大量实验表明,该方法优于现有剪枝类防御,在低数据条件下性能强劲,且与最先进微调方法相比表现相当。尤其在成功缓解后门后,对受损样本的正确预测恢复率超过90%。
原文摘要 · Abstract (English)
Model pruning has gained traction as a promising defense strategy against backdoor attacks in deep learning. However, existing pruning-based approaches often fall short in accurately identifying and removing the specific parameters responsible for inducing backdoor behaviors. Despite the dominance of fine-tuning-based defenses in recent literature, largely due to their superior performance, pruning remains a compelling alternative, offering greater interpretability and improved robustness in low-data regimes. In this paper, we propose a novel pruning approach featuring a learned \emph{selection} mechanism to identify parameters critical to both main and backdoor tasks, along with an \emph{invertible} pruning mask designed to simultaneously achieve two complementary goals: eliminating the backdoor task while preserving it through the inverse mask. We formulate this as a bi-level optimization problem that jointly learns selection variables, a sparse invertible mask, and sample-specific backdoor perturbations derived from clean data. The inner problem synthesizes candidate triggers using the inverse mask, while the outer problem refines the mask to suppress backdoor behavior without impairing clean-task accuracy. Extensive experiments demonstrate that our approach outperforms existing pruning-based backdoor mitigation approaches, maintains strong performance under limited data conditions, and achieves competitive results compared to state-of-the-art fine-tuning approaches. Notably, the proposed approach is particularly effective in restoring correct predictions for compromised samples after successful backdoor mitigation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。