Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networks
This addresses a critical security gap in AI systems by enabling real-time detection of backdoor attacks, though it is incremental as it builds on existing post-training defenses.
The paper tackles the problem of detecting backdoor triggers in deep neural networks during test-time, proposing an 'in-flight' defense that identifies trigger use and infers the source class, with experimental validation against strong attacks.
Backdoor (Trojan) attacks are emerging threats against deep neural networks (DNN). A DNN being attacked will predict to an attacker-desired target class whenever a test sample from any source class is embedded with a backdoor pattern; while correctly classifying clean (attack-free) test samples. Existing backdoor defenses have shown success in detecting whether a DNN is attacked and in reverse-engineering the backdoor pattern in a "post-training" regime: the defender has access to the DNN to be inspected and a small, clean dataset collected independently, but has no access to the (possibly poisoned) training set of the DNN. However, these defenses neither catch culprits in the act of triggering the backdoor mapping, nor mitigate the backdoor attack at test-time. In this paper, we propose an "in-flight" defense against backdoor attacks on image classification that 1) detects use of a backdoor trigger at test-time; and 2) infers the class of origin (source class) for a detected trigger example. The effectiveness of our defense is demonstrated experimentally against different strong backdoor attacks.