Search papers, labs, and topics across Lattice.
This paper addresses the challenge of neural backdoor attacks by formulating a novel defense strategy termed "Anti-Backdoor Coreset Selection," which isolates a benign subset from poisoned training data. The authors utilize Cumulative Entropy as a selection criterion to prioritize samples that exhibit benign functionality and high informativeness, while also employing an unlearning mechanism to enhance the separability of benign and poisonous samples during training. The results demonstrate that this approach effectively mitigates backdoor attacks without significantly compromising the model's natural accuracy, outperforming existing defenses.
Cumulative Entropy-driven coreset selection can effectively isolate benign training samples, yielding robust defenses against neural backdoor attacks with minimal impact on model performance.
Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called"Anti-Backdoor Coreset Selection."Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.
