Progressive Poisoned Data Isolation for Training-time Backdoor Defense
This addresses the security issue of backdoor attacks in machine learning for practitioners needing robust model training, though it is incremental as it builds on existing isolation methods.
The paper tackles the problem of training deep neural networks on potentially poisoned datasets to defend against backdoor attacks by introducing a progressive isolation method that enhances accuracy and reduces misclassification of benign samples, achieving an average True Positive Rate of 99.95% and False Positive Rate of 0.06% on CIFAR-10 against nine state-of-the-art attacks.
Deep Neural Networks (DNN) are susceptible to backdoor attacks where malicious attackers manipulate the model's predictions via data poisoning. It is hence imperative to develop a strategy for training a clean model using a potentially poisoned dataset. Previous training-time defense mechanisms typically employ an one-time isolation process, often leading to suboptimal isolation outcomes. In this study, we present a novel and efficacious defense method, termed Progressive Isolation of Poisoned Data (PIPD), that progressively isolates poisoned data to enhance the isolation accuracy and mitigate the risk of benign samples being misclassified as poisoned ones. Once the poisoned portion of the dataset has been identified, we introduce a selective training process to train a clean model. Through the implementation of these techniques, we ensure that the trained model manifests a significantly diminished attack success rate against the poisoned data. Extensive experiments on multiple benchmark datasets and DNN models, assessed against nine state-of-the-art backdoor attacks, demonstrate the superior performance of our PIPD method for backdoor defense. For instance, our PIPD achieves an average True Positive Rate (TPR) of 99.95% and an average False Positive Rate (FPR) of 0.06% for diverse attacks over CIFAR-10 dataset, markedly surpassing the performance of state-of-the-art methods.