Towards Unified Robustness Against Both Backdoor and Adversarial Attacks

TL;DR

This paper addresses the separate treatment of backdoor and adversarial attacks by uncovering a fundamental connection: after backdoor infection, adversarial perturbations tend to produce samples with features similar to triggered images. Guided by this insight, the authors introduce Progressive Unified Defense (PUD), a joint defense framework that progressively purifies both the infected model and a poisoned extra dataset through a mean-teacher architecture and complementary data-purification strategies (prediction-consistency and SPECTRE), plus a backdoor-unlearning step. The approach performs robust backdoor erasure without requiring a fully clean auxiliary dataset and yields competitive adversarial robustness compared to standard defenses. Extensive experiments on CIFAR-10, GTSRB, and ImageNet-1K demonstrate that PUD outperforms state-of-the-art model-repairing defenses and appreciably rivals advanced adversarial defenses, highlighting its practical impact for safer deployments of deep networks.

Abstract

Deep Neural Networks (DNNs) are known to be vulnerable to both backdoor and adversarial attacks. In the literature, these two types of attacks are commonly treated as distinct robustness problems and solved separately, since they belong to training-time and inference-time attacks respectively. However, this paper revealed that there is an intriguing connection between them: (1) planting a backdoor into a model will significantly affect the model's adversarial examples; (2) for an infected model, its adversarial examples have similar features as the triggered images. Based on these observations, a novel Progressive Unified Defense (PUD) algorithm is proposed to defend against backdoor and adversarial attacks simultaneously. Specifically, our PUD has a progressive model purification scheme to jointly erase backdoors and enhance the model's adversarial robustness. At the early stage, the adversarial examples of infected models are utilized to erase backdoors. With the backdoor gradually erased, our model purification can naturally turn into a stage to boost the model's robustness against adversarial attacks. Besides, our PUD algorithm can effectively identify poisoned images, which allows the initial extra dataset not to be completely clean. Extensive experimental results show that, our discovered connection between backdoor and adversarial attacks is ubiquitous, no matter what type of backdoor attack. The proposed PUD outperforms the state-of-the-art backdoor defense, including the model repairing-based and data filtering-based methods. Besides, it also has the ability to compete with the most advanced adversarial defense methods.

Figures (11)

• Figure 1: With $10,000$ images randomly sampled from CIFAR-10: (a) For an infected model (whose backdoor target-label was predetermined as 'class 0' in this case), its adversarial examples are highly likely classified as the target-label (i.e.,'class 0'). (b) But for a benign model, its adversarial examples could be classified as any class with almost equal probability.
• Figure 2: Predicated labels of adversarial examples v.s. Backdoor target-labels. For an infected model, no matter what backdoor target-label is set (class '0', class '1',$\dots$, class '9'), the predicted labels always align with the backdoor target-label, as shown by the matrix diagonal in Fig.2a.
• Figure 3: The visualization of image features for: (a) clean image $x$; (b) benign model's adversarial example $\widetilde{\bm{x}}$; (c) infected model's adversarial example $\widetilde{\bm{x}}'$; and (d) triggered image $x^t$. The image features is the output of the last convolution layer (just before the fully-connected layer). Obviously, the features of $\widetilde{\bm{x}}'$ are very similar to $x^t$. In contrast, there is a significant difference between $\widetilde{\bm{x}}'$ and $\widetilde{\bm{x}}$, which indicates adversarial examples will change significantly after planting a backdoor into a model.
• Figure 4: Illustration of our observations. For benign models, adversarial attack will make an image move close to any class (class '0', class '2', $\dots$, class '$l$', etc.) in feature space. But for infected models, adversarial attack will always make it move close to the target-label class (class '$l$').
• Figure 5: Comparison of workflow between PBE and PUD algorithms. In PUD, a teacher-student mechanism is proposed to improve both model purification and data purification.

Theorems & Definitions (1)

• Theorem 1