Research map / Adversarial robustness and security / Backdoor and poisoning
Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AIBD, a training-time backdoor defense that uses PGD adversarial-example iteration counts and adversarial labels to isolate poisoned samples via a progressive top-q scheme and relabel them before retraining.
Problem
Defending DNNs against training-time backdoor (data poisoning) attacks when the poisoning rate and poisoned sample distribution are unknown, while prior work treats backdoor and adversarial attacks separately.
Approach
Observes that backdoor samples need more PGD iterations to become adversarial examples on an infected model and that their adversarial labels tend to equal their true labels; uses these to isolate poisoned samples (top-q by iteration count) and relabel them with adversarial labels before retraining.
Key results
- On CIFAR-10 (10% poisoning), AIBD reduces average ASR from 99.73% to 0.33% while keeping ACC at 85.31% versus 87.02% without defense.
- On GTSRB, AIBD achieves average ASR of 0.08% and ACC of 95.79%, with 0.00% ASR against BadNets, SIG, and WaNet.
- For backdoor sample isolation on CIFAR-10, AIBD obtains average TPR 98.35% and FPR 1.35%, versus ABL TPR 90.90% and FPR 1.08%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply AIBD instead of no defense | ResNet-18 trained on CIFAR-10 · CIFAR-10, average over six attacks | ASR (%): 99.73 -> 0.33 | Helped |
| apply AIBD instead of no defense | WRN-16-1 trained on GTSRB · GTSRB, average over six attacks | ASR (%): 99.62 -> 0.08 | Helped |
| replace isolated poison labels with adversarial labels rather than random labels (ablation) | AIBD · CIFAR-10, average over six attacks | ACC (%): 83.24 -> 84.99 | Helped |
| replace isolated poison labels with adversarial labels rather than random labels (ablation) | AIBD · CIFAR-10, average over six attacks | ASR (%): 1.26 -> 0.33 | Helped |
| replace unlearning of isolated backdoor samples with adversarial-label correction (ablation) | AIBD · CIFAR-10, average over six attacks | ACC (%): 78.52 -> 84.99 | Helped |
| replace unlearning of isolated backdoor samples with adversarial-label correction (ablation) | AIBD · CIFAR-10, average over six attacks | ASR (%): 2.77 -> 0.33 | Mixed |
| use adversarial-example iteration for sample isolation | AIBD · CIFAR-10, five attacks | TPR (%): 90.90 -> 98.35 | Helped |
| use adversarial-example iteration for sample isolation | AIBD · CIFAR-10, five attacks | FPR (%): 1.08 -> 1.35 | Mixed |
Surprising findings
- Unlearning backdoor samples gives low ASR on Blend and SIG but drops clean accuracy substantially, while adversarial-label correction keeps ACC high.
- Naive ABL-style defense incurs large clean accuracy drops when no attack is present (ABL ACC 66.84% on GTSRB clean data).
Limitations
- Progressive top-q search relies on model accuracy stabilizing and assumes poisoning rate under 20%; accuracy drops and ASR rises at 20% poisoning rate.
- Performance at 1% poisoning rate is weaker, with both high ACC and ASR, because backdoor samples are too few to separate.
- Evaluated only on CIFAR-10 and GTSRB with ResNet-18 and WRN-16-1 and six attacks.
Experimental setup
Datasets: CIFAR-10 GTSRB
Benchmarks: CIFAR-10 GTSRB
Metrics: ACC ASR TPR FPR
Baselines: ABL NAD DBD CBD SCALE-UP
Builds on: Anti-Backdoor Learning (ABL) PGD attack Scale-up
Closest papers by meaning
- Hidden Trigger Backdoor Attacks (AAAI 2020 · similarity 0.92)
- Architectural Backdoors in Neural Networks (CVPR 2023 · similarity 0.91)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.89)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.89)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.89)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.