Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features

Summary

This work proposes a defense method against backdoor attacks. The proposed method involves inserting a trainable transformation layer inside a backdoor model while keeping other model parameters fixed that is supposed to purify the poisonous features while allowing benign features to pass without modification.

Strengths

1) The proposed transformation block constitutes a single 1x1 convolution and batch normalization layer which makes it easier to adopt in any model architecture. 2) Faster training time since only the added layer is trained while keeping other model parameters fixed. 3) The proposed method provides good defense performance (low ASR) against various attacks.

Weaknesses

1) To filter out poisonous features from a poisonous sample, the method requires the creation of poisonous samples. While the authors claim to approximate the trigger, they utilize adversarial samples instead of poisoned ones, which are fundamentally different and not equivalent approximations. 2) Previous research [41] has utilized adversarial perturbation to address removing backdoor attacks. It is crucial to emphasize the key differentiation between [41] and the proposed NPD-TU method, aside from the difference in training the entire model versus solely training the added transformation layer. 3) The proposed method exhibits a decrease in benign accuracy, as indicated by the results presented in Table 2. This decline in accuracy is a common occurrence observed in adversarial training techniques. 4) The authors insert the transformation block before the third convolution layer of the fourth layer for PreAct-ResNet18. How is this design decision made, i.e., for a new model which might be potentially backdoored? How does the defender decide where to insert this polarizer block? 5) How does the proposed method perform under an adaptive attack, where the attacker knows the defense strategy? One approach to testing this could be training the backdoor model using adversarial samples. It would be interesting to see this result. 6) How does the proposed method affect the performance of a benign model?

Questions

1) How compatible is neural polarizer with other model architectures like inception and Densenet? 2) How is the defense performance against all2all attacks for attacks other than BadNets?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

I have raised some concerns in the weaknesses section. Those are some possible limitations of the work. The authors should revise their limitation section.

Summary

This paper proposes propose a backdoor defense method by inserting a learnable neural polarizer into the backdoored model as an intermediate layer, in order to purify the poisoned sample via filtering trigger information while maintaining benign information. To more effectively remove backdoor, this paper leverages the reverse trigger and target label to remove backdoor.

Strengths

1. This paper is well written and technically sound. 2. The experiments are sufficient, and its performance achieves SOTA

Weaknesses

1. Neural Polarizer needs to reverse the backdoor trigger and the target label, which is similar to Neural Cleanse. Furthermore, former papers demonstrate that trigger reverse mainly works well on static trigger such as BadNets. The results on sample-specific trigger are bad and the results of reverse trigger and target label are mostly wrong. Thus, the scope where Neural Polarizer can be used is limited. 2. The novelty is limited. Because trigger reversed has been proposed before, the contribution of this paper is to finetune the model with the reversed trigger on Neural Polarizer layer.

Questions

Can you explain why the method works with the reversed trigger which may not be correctly reversed?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

Yes

Summary

The paper proposes a lightweight and effective backdoor defense by inserting a trainable neural layer block. Without modifying original backdoor model, the proposed method can remove backdoor behaviors by filtering poisoned features via the trainable neural block. The authors conduct sufficient experiments to demonstrate the effectiveness of proposed method.

Strengths

1. The proposed method is simple but effective. The inserted neural block only includes one convolution layer followed by a BN layer. Training this layer block is not time-consuming. 2. The experiments are very sufficient. The comparison experiments are conducted with six backdoor defenses against seven backdoor attacks on three datasets. Analysis experiments are also conducted including the effectiveness of losses, poisoning ratios and clean ratios.

Weaknesses

1. The paper does not introduce how to choose different layers to insert the neural polarizer. Since the proposed method largely depends on network architectures. Please also provide more results using more network architectures e.g. vgg.

Questions

1. Does this proposed method work for a network without batch normalization layer? 2. Please explain more about how to choose layers to insert neural polarizer. 3. Could the authors visualize features before and after neural polarizer to qualitatively analyze the effectiveness (e.g. using GradCam)?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have addressed the limitations

Summary

This paper proposes a novel defense method to filter trigger information from poisoned samples. It inserts a learnable intermediate layer (called neural polarizer) into the backdoored model, and proposes bi-level optimization solution to approximate perturbation and target label. Experimental results demonstrate the effectiveness of Neural Polarizer over other defense baselines.

Strengths

1.The paper is well-written and easy to follow. 2.The proposed Nueral Polarizer is interesting. 3.The experiments are comprehensive.

Weaknesses

1.The paper proposes NPD (Neural Polarizer based backdoor Defense) as a normal setting. It also proposes NPD-TP (assume the target label is known) and NPD-TU (assume having full access of benign samples). The NPD-TP and NPD-TU relax the limitation, and is kind of unfair compared to other defense baselines. However, based on Table 1 and Table 2, most of best performance comes from NPD-TP/NPD-TU, while NPD does not perform very well under some situations. More specific, In Table 1, defense on CIFAR-10: NPD does not always perform the best. For example, ASR under WaNet is 0.80 (larger than WaNet with FP and NAD), ASR under Trojan is 6.51 (larger than Trojan with i-BAU and EP). Similar phenomenon happens in Table 2: defense on Tiny ImageNet.

Questions

1.Regarding approximating perturbation $\Delta$ and target label T (eq.5): in inner minimization, the algorithm first estimates the target label, then applies PGD to generate perturbations. I assume this step is very important, because it decides the outer minimization. That are the estimated perturbations look like? Are they similar with the real triggers, or they are just the adversarial perturbations? Are there any experiments/visualizations to elaborate that? 2.How to choose which layer to insert the neural polarizer? Does your method robust to the choice of layer? 3.What if there are more labels. For example, CIFAR-100 or even more labels. Does the proposed method still work?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

The authors adequately addressed the limitations.

Thanks for your response.

Thanks for the author's response. You have released most of my concern. I have increased the score.

Thank you for your feedback

Dear Reviewer qQYz, Thank you very much for your time and for your thoughtful feedback. We sincerely appreciate your diligence in evaluating our work. We are pleased to learn that our detailed rebuttal has addressed most of your concerns and has positively influenced your assessment of the manuscript. All suggested experiments and analysis will be added into the revised manuscript. Thank you again for your time, consideration, and invaluable feedback. Sincerely, Authors