Variance-Based Defense Against Blended Backdoor Attacks
This addresses the challenge of backdoor attacks in AI security, particularly in scenarios where clean datasets are unavailable, offering an incremental improvement over existing defenses.
The paper tackles the problem of defending against blended backdoor attacks in AI models by proposing a method that trains a model, detects poisoned classes, and extracts trigger parts without needing a clean dataset, achieving effectiveness demonstrated through experiments on image datasets and comparisons with SCAn, ABL, and AGPD.
Backdoor attacks represent a subtle yet effective class of cyberattacks targeting AI models, primarily due to their stealthy nature. The model behaves normally on clean data but exhibits malicious behavior only when the attacker embeds a specific trigger into the input. This attack is performed during the training phase, where the adversary corrupts a small subset of the training data by embedding a pattern and modifying the labels to a chosen target. The objective is to make the model associate the pattern with the target label while maintaining normal performance on unaltered data. Several defense mechanisms have been proposed to sanitize training data-sets. However, these methods often rely on the availability of a clean dataset to compute statistical anomalies, which may not always be feasible in real-world scenarios where datasets can be unavailable or compromised. To address this limitation, we propose a novel defense method that trains a model on the given dataset, detects poisoned classes, and extracts the critical part of the attack trigger before identifying the poisoned instances. This approach enhances explainability by explicitly revealing the harmful part of the trigger. The effectiveness of our method is demonstrated through experimental evaluations on well-known image datasets and comparative analysis against three state-of-the-art algorithms: SCAn, ABL, and AGPD.