Search papers, labs, and topics across Lattice.
This paper introduces HARVEY, a novel approach for removing neural backdoors by focusing on identifying poisonous samples rather than benign ones. By leveraging the observation that models learn backdoored samples more easily, HARVEY achieves near-perfect backdoor removal while maintaining natural accuracy. The method significantly outperforms existing techniques across various attack types, datasets, and architectures, effectively minimizing the attack success rate.
Identifying poisonous samples instead of benign ones allows HARVEY to achieve near-perfect backdoor removal with minimal impact on model performance.
The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting or iteratively learn a reference model as an oracle for identifying benign samples. In particular, the latter has proven effective for anti-backdoor learning. Our method, HARVEY, leverages a similar yet crucially different technique: learning an oracle for poisonous rather than benign samples. Learning a backdoored reference model is significantly easier than learning a reference model on benign data. Consequently, we can identify poisonous samples much more accurately than related work identifies benign samples. This crucial difference enables near-perfect backdoor removal as we demonstrate in our evaluation. HARVEY substantially outperforms related approaches across attack types, datasets, and architectures, lowering the attack success rate to the very minimum at a negligible loss in natural accuracy. The figure below shows an overview of our methods working principle.
