Expose Before You Defend: Unifying and Enhancing Backdoor Defenses via Exposed Models

TL;DR

The results demonstrate the importance of backdoor exposure for backdoor defense, showing that the exposed models can significantly benefit a range of downstream defense tasks, including backdoor label detection, backdoor trigger recovery, backdoor model detection, and backdoor removal.

Abstract

Backdoor attacks covertly implant triggers into deep neural networks (DNNs) by poisoning a small portion of the training data with pre-designed backdoor triggers. This vulnerability is exacerbated in the era of large models, where extensive (pre-)training on web-crawled datasets is susceptible to compromise. In this paper, we introduce a novel two-step defense framework named Expose Before You Defend (EBYD). EBYD unifies existing backdoor defense methods into a comprehensive defense system with enhanced performance. Specifically, EBYD first exposes the backdoor functionality in the backdoored model through a model preprocessing step called backdoor exposure, and then applies detection and removal methods to the exposed model to identify and eliminate the backdoor features. In the first step of backdoor exposure, we propose a novel technique called Clean Unlearning (CUL), which proactively unlearns clean features from the backdoored model to reveal the hidden backdoor features. We also explore various model editing/modification techniques for backdoor exposure, including fine-tuning, model sparsification, and weight perturbation. Using EBYD, we conduct extensive experiments on 10 image attacks and 6 text attacks across 2 vision datasets (CIFAR-10 and an ImageNet subset) and 4 language datasets (SST-2, IMDB, Twitter, and AG's News). The results demonstrate the importance of backdoor exposure for backdoor defense, showing that the exposed models can significantly benefit a range of downstream defense tasks, including backdoor label detection, backdoor trigger recovery, backdoor model detection, and backdoor removal. We hope our work could inspire more research in developing advanced defense frameworks with exposed models. Our code is available at: https://github.com/bboylyg/Expose-Before-You-Defend.

Figures (9)

• Figure 1: Top: Traditional backdoor defense pipeline; Bottom: Our proposed two-step defense framework EBYD.
• Figure 2: Two central properties of the "exposed model” under Clean Unlearning (CUL). The experiments were conducted with ResNet-18 and BadNets attack on the CIFAR-10 dataset.
• Figure 3: A t-SNE visualization of the decoupled clean (blue) and backdoor (red) features by 4 backdoor exposure techniques.
• Figure 4: The detection performance of 'X+NC' against 10 backdoor attacks on CIFAR-10. DR (%): AUROC rate.
• Figure 5: An illustrative example of our 'CUL' backdoor exposure technique against 4 textual backdoored models.