Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor

Summary

This paper focuses on the in-training backdoor defense by proactively injecting a defensive backdoor into the model during training. During inference, PDB embeds a defensive trigger in the inputs and reverses the model prediction. This operation effectively suppresses malicious backdoors and ensures the model utility on the original task. Various experiments demonstrate the effectiveness.

Strengths

Various experiments demonstrate the proposed method is effective.

Weaknesses

This paper has several limitations. 1. Novelty has been discovered by existing methods. I assume that the author truly share a interesting insight towards the backdoor defense. But in [2] (Usenix Security 2024), “backdoor samples are OOD samples compared to benign samples from the target class, designs indicator task leveraging OOD samples to identify and rule out backdoor updates”. But I do not see that author has discussed in your paper. I wonder whether authors could explain whether directly utilizing [2] in your setting has any problem. 2. Missing comparison and confusing results. As shown in your Table 1: Results (%) on CIFAR-10 with PreAct-ResNet18 and poisoning ratio 5.0%, for attack Trojan, ABL achieves 18.64 100.00, but the results in [1] is not the same. 70.70/0.02. Why do you not present the same setting as the current relative works? I wonder whether you could compare your work in your setting or the [1] scenario. 3. Abaltion for trigger pattern. "Regarding the trigger’s position, it should181 be crafted to preserve the core visual patterns182 of the original image". I wonder whether the author could conduct the experiments on the trigger pattern position to demonstrate your conclusion. [1] Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimization. ICCV 2023. [2] BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning. Usenix Security 2024

Questions

Your work shares a high similar motivation with the BackdoorIndicator. I encourage authors to provide detailed explanations.

Rating

5

Confidence

4

Soundness

3

Presentation

2

Contribution

2

Limitations

Yes, the authors have discussed.

Summary

This paper investigates in-training backdoor defense by proactive defensive backdoor. They introduce a defensive poisoned dataset to train the model together with all poison data. By attach the defensive trigger onto the input sample, the potential backdoor attack is failed by such proactive defensive backdoor. Extensive experiments are conducted to evaluate the effectiveness of our method and compare it with five SOTA defense methods across seven challenging backdoor attacks.

Strengths

The author offers a straightforward solution to eliminate the need for costly detection and relabeling processes, thus improving the efficiency. The experiments seem comprehensive, great attach success rate and defensive effectiveness rate are achieved.

Weaknesses

The author should elaborate why DBD, NAB and V&B result in a substantial increase in training costs in Introduction. Experimental analyses are highly desired. The contribution (1) is overclaimed. This is not the novel paradigm because this work develop based on several proactive attack-based works like NAB. The sensitivity to the defensive poisoned dataset of the proposed method should be evaluated. Though the author claim the proposed method follow Principle 4, more details and thorough analyses are required. Despite better defense effectiveness rate of the proposed method, its accuracy on benign samples is obviously inferior to other methods. When the poisoning ratio is decreasing, the proposed method may unexpectedly become an attack to the original benign dataset, resulting in the degraded accuracy. How to avoid this situation?

Questions

Why the proposed method can meet Principle 4? The explanation in Method is not clear. What is the difference between the malicious poisoned dataset and the defensive poisoned dataset when preparing the data?

Rating

5

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

The generalization of the proposed method to diverse backdoor attack remains unknown. When the attack is invisible or the poison rate is mariginal, the proposed method may degenerate.

Summary

The paper introduces a novel method called Proactive Defensive Backdoor (PDB) to counter backdoor attacks in deep neural networks. PDB differs from traditional methods, which focus on detecting and eliminating suspicious samples. Instead, PDB proactively injects a defensive backdoor into the model during the training phase. PDB operates by embedding a trigger in the model's inputs during prediction, which neutralizes the effects of any malicious trigger present. The authors designed the defensive backdoor in such a way that it can reverse the model's prediction to its true label, thus maintaining its utility on benign tasks. Through extensive experimentation, the authors have demonstrated PDB's ability to outperform existing defense methods by achieving a balance between suppressing malicious backdoors and preserving model performance across various datasets and model architectures.

Strengths

- The paper is well-structured and clearly written. - Introduces a novel approach for mitigating backdoor attacks. - Detailed experiments and comparison with state-of-the-art.

Weaknesses

- The authors evaluated adaptive attacks only by increasing the trigger size of the BadNets attack. A more appropriate adaptive attack would increase the poisoning ratio to strengthen the backdoor effect compared to the defensive backdoor. - It would be interesting to see if PDB can scale for clean label backdoor attacks, where the adversary does not change the trigger label during the backdoor attack. - It is not clear whether the running time in Table 4 refers to training time or inference time. Comparing inference time would be more appropriate, as PDB requires the model to make two predictions for a single image. How does the inference time of PDB compare to other defenses in the literature? - It is not clear why the specific blocks, namely Block 1 and Block 4, were chosen to illustrate the impact of PDB. Also, the plots related to TAC are difficult to understand from the text.

Questions

- Will PDB be effective against adaptive attacks that increase the poisoning ratio? - How does the inference time of PDB compare with other defenses in the literature?

Rating

6

Confidence

3

Soundness

3

Presentation

4

Contribution

3

Limitations

The authors adequately addressed the limitations and potential negative societal impact.

Summary

This paper proposes an proactive defense approach called PDB, which aims to combat malicious backdoor attacks by injecting active defense backdoors introduced by the defender. The main goal of PDB is to suppress the impact of malicious backdoors while preserving the utility of the model for its original tasks. PDB first analyzes the objectives for effective backdoor defense and introduces four fundamental design principles: reversibility, inaccessibility to attackers, minimal impact on model performance, and resistance against other backdoors. Then, an additional defensive poisoning dataset is constructed, and the model is trained using both this dataset and the entire poisoned dataset. To evaluate its effectiveness, the paper compares PDB with five SOTA in-training defense methods against seven SOTA data poisoning backdoor attack methods involving different model architectures and datasets. Experimental results show that PDB performs comparably or even better than existing baseline methods.

Strengths

1. The perspective of the paper is novel. 2. This paper is well-written and easy to understand.

Weaknesses

1. The paper lacks an effective explanation for PDB. 2. The paper lacks sufficient and reasonable explanations for the experimental results.

Questions

The perspective of the paper is innovative, and it is well-written and easy to understand. However, this paper still has the following issues. 1. The paper lacks sufficient and reasonable explanations for the experimental results, particularly those in Table 2. In Table 2, the ASR results for PDB under different attacks are all 0, while the results for other baseline are close to 100 (i.e., they all fail to defend successfully). The paper should provide a reasonable explanation for the significant difference in ASR between PDB and the other baselines. 2. In the Section of Resistance to Adaptive Attack, the paper evaluates PDB's resistance to malicious backdoor attacks with trigger sizes ranging from 3x3 to 6x6. In this section, the paper should set the backdoor attack trigger size to greater than 7x7 to match the trigger size set by PDB. Additionally, it raises the question of why the paper sets the trigger size for PDB to 7x7? 3. In the Section of Influences of Augmentation, different strength of augmentation do not show significant changes in defense-related ACC and ASR, even in cases without any augmentation. Therefore, what is the role of augmentation during the training process? Based on this, it is easy to question why PDB's defense triggers can be stronger than the triggers of the backdoor without relying on augmentation?

Rating

7

Confidence

4

Soundness

3

Presentation

3

Contribution

3

Limitations

The authors have adequately addressed the limitations and potential negative societal impact of their work.

Official Comment by Authors

Dear Reviewer 1B7j, We sincerely appreciate your valuable insights and suggestions on our work. We have made our best efforts to address the concerns and queries you raised during the rebuttal process. We would greatly appreciate confirmation on whether our response has effectively resolved your doubts. Your feedback will be instrumental in improving the quality of our work. **As the end of the discussion period is approaching, we eagerly await your reply before the end.** Sincerely, The Authors