Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization
This work addresses security vulnerabilities in machine learning models for applications like autonomous systems and cybersecurity, offering an incremental improvement over existing backdoor detection techniques.
The paper tackles the problem of backdoor detection in neural networks by addressing failures in existing methods when non-target classes are easily discriminable or backdoors are subtle, proposing a method that suppresses intrinsic features to enhance detection sensitivity and achieving improved detection rates against challenging attacks.
Most post-training backdoor detection methods rely on attacked models exhibiting extreme outlier detection statistics for the target class of an attack, compared to non-target classes. However, these approaches may fail: (1) when some (non-target) classes are easily discriminable from all others, in which case they may naturally achieve extreme detection statistics (e.g., decision confidence); and (2) when the backdoor is subtle, i.e., with its features weak relative to intrinsic class-discriminative features. A key observation is that the backdoor target class has contributions to its detection statistic from both the backdoor trigger and from its intrinsic features, whereas non-target classes only have contributions from their intrinsic features. To achieve more sensitive detectors, we thus propose to suppress intrinsic features while optimizing the detection statistic for a given class. For non-target classes, such suppression will drastically reduce the achievable statistic, whereas for the target class the (significant) contribution from the backdoor trigger remains. In practice, we formulate a constrained optimization problem, leveraging a small set of clean examples from a given class, and optimizing the detection statistic while orthogonalizing with respect to the class's intrinsic features. We dub this plug-and-play approach Class Subspace Orthogonalization (CSO) and assess it against challenging mixed-label and adaptive attacks.