Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Backdoor Mitigation in Deep Neural Networks via Strategic Retraining

Akshay Dhonthi, Ernst Moritz Hahn, Vahid Hashemi

TL;DR

This work addresses backdoors in safety-critical DNNs by combining an ABS-based black-box backdoor identification with a strategic, post-hoc retraining pipeline. By generating trojan masks and retraining focused on the most affected classes (top_p), the method unlearns poisoned patterns while preserving benign accuracy, particularly in smaller networks. Experimental results on the GTSRB traffic sign dataset show the approach can reduce or eliminate backdoors (zero Trojan neurons within a few iterations) and outperform Neural Cleanse in this setting. The practical impact lies in enabling safer deployment of DNNs in automotive settings through targeted, data-efficient mitigation, with avenues for extending to larger architectures and more realistic attack models.”

Abstract

Deep Neural Networks (DNN) are becoming increasingly more important in assisted and automated driving. Using such entities which are obtained using machine learning is inevitable: tasks such as recognizing traffic signs cannot be developed reasonably using traditional software development methods. DNN however do have the problem that they are mostly black boxes and therefore hard to understand and debug. One particular problem is that they are prone to hidden backdoors. This means that the DNN misclassifies its input, because it considers properties that should not be decisive for the output. Backdoors may either be introduced by malicious attackers or by inappropriate training. In any case, detecting and removing them is important in the automotive area, as they might lead to safety violations with potentially severe consequences. In this paper, we introduce a novel method to remove backdoors. Our method works for both intentional as well as unintentional backdoors. We also do not require prior knowledge about the shape or distribution of backdoors. Experimental evidence shows that our method performs well on several medium-sized examples.

Backdoor Mitigation in Deep Neural Networks via Strategic Retraining

TL;DR

This work addresses backdoors in safety-critical DNNs by combining an ABS-based black-box backdoor identification with a strategic, post-hoc retraining pipeline. By generating trojan masks and retraining focused on the most affected classes (top_p), the method unlearns poisoned patterns while preserving benign accuracy, particularly in smaller networks. Experimental results on the GTSRB traffic sign dataset show the approach can reduce or eliminate backdoors (zero Trojan neurons within a few iterations) and outperform Neural Cleanse in this setting. The practical impact lies in enabling safer deployment of DNNs in automotive settings through targeted, data-efficient mitigation, with avenues for extending to larger architectures and more realistic attack models.”

Abstract

Deep Neural Networks (DNN) are becoming increasingly more important in assisted and automated driving. Using such entities which are obtained using machine learning is inevitable: tasks such as recognizing traffic signs cannot be developed reasonably using traditional software development methods. DNN however do have the problem that they are mostly black boxes and therefore hard to understand and debug. One particular problem is that they are prone to hidden backdoors. This means that the DNN misclassifies its input, because it considers properties that should not be decisive for the output. Backdoors may either be introduced by malicious attackers or by inappropriate training. In any case, detecting and removing them is important in the automotive area, as they might lead to safety violations with potentially severe consequences. In this paper, we introduce a novel method to remove backdoors. Our method works for both intentional as well as unintentional backdoors. We also do not require prior knowledge about the shape or distribution of backdoors. Experimental evidence shows that our method performs well on several medium-sized examples.
Paper Structure (9 sections, 4 figures, 7 tables, 1 algorithm)

This paper contains 9 sections, 4 figures, 7 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Deep Neural Networks
  4. Artificial Brain Stimulation Analysis
  5. Methodology
  6. Experiments
  7. Experiment Setup
  8. Mitigation Results
  9. Conclusion

Figures (4)

  • Figure 1: Framework of the backdoor or bias mitigation approach
  • Figure 2: Sample of trojaned images
  • Figure 3: Confusion Matrix from predictions of model $\mathcal{N}_\mathit{SN}$ on data $X_\mathit{test}^{M_1}$ (image in first column from left) and predictions of model $\mathcal{N}_\mathit{SN}^\mathit{troj}$ on data $X_\mathit{test}^{M_2}$ (images in second and third columns).
  • Figure 4: Drop in classification accuracy after retraining at different $\mathit{top}_p$ values