Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features
This addresses the security vulnerability of neural networks to backdoor attacks, offering a more efficient defense compared to fine-tuning-based methods, though it is incremental as it builds on existing defense approaches.
The paper tackles the problem of backdoor attacks in deep neural networks by proposing a lightweight defense method that inserts a learnable neural polarizer layer to filter trigger information from poisoned samples while preserving benign information, achieving effective backdoor removal across various architectures and datasets with limited clean data.
Recent studies have demonstrated the susceptibility of deep neural networks to backdoor attacks. Given a backdoored model, its prediction of a poisoned sample with trigger will be dominated by the trigger information, though trigger information and benign information coexist. Inspired by the mechanism of the optical polarizer that a polarizer could pass light waves with particular polarizations while filtering light waves with other polarizations, we propose a novel backdoor defense method by inserting a learnable neural polarizer into the backdoored model as an intermediate layer, in order to purify the poisoned sample via filtering trigger information while maintaining benign information. The neural polarizer is instantiated as one lightweight linear transformation layer, which is learned through solving a well designed bi-level optimization problem, based on a limited clean dataset. Compared to other fine-tuning-based defense methods which often adjust all parameters of the backdoored model, the proposed method only needs to learn one additional layer, such that it is more efficient and requires less clean data. Extensive experiments demonstrate the effectiveness and efficiency of our method in removing backdoors across various neural network architectures and datasets, especially in the case of very limited clean data.