Backdoor Defense with Machine Unlearning
Open accessAbstract
Backdoor injection attack is an emerging threat to the security of neural networks, however, there still exist limited effective defense methods against the attack. In this paper, we propose BAERASER, a novel method that can erase the backdoor injected into the victim model through machine unlearning. Specifically, BAERASER mainly implements backdoor defense in two key steps. First, trigger pattern recovery is conducted to extract the trigger patterns infected by the victim model. Here, the trigger pattern recovery problem is equivalent to the one of extracting an unknown noise distribution from the victim model, which can be easily resolved by the entropy maximization based generative model. Subsequently, BAERASER leverages these recovered trigger patterns to reverse the backdoor injection procedure and induce the victim model to erase the polluted memories through a newly designed gradient ascent based machine unlearning method. Compared with the previous machine unlearning solutions, the proposed approach gets rid of the reliance on the full access to training data for retraining and shows higher effectiveness on backdoor erasing than existing fine-tuning or pruning methods. Moreover, experiments show that BAERASER can averagely lower the attack success rates of three kinds of state-of-the-art backdoor attacks by 99% on four benchmark datasets.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
As of now, some relevant applications have emerged.
“As of now, some relevant applications have emerged [53, 112].”
From Machine Unlearning: A Survey (2024) · cites this paper as [112]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 28 · Cited by 95
Research works printed but not linked: 26
- H. Zhong, C. Liao, A. C. Squicciarini, S. Zhu, and D. Miller, "Back- door embedding in convolutional neural network models via invisible perturbation," in Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, 2020, pp. 97-108.
- B. Tran, J. Li, and A. Madry, "Spectral signatures in backdoor attacks," Advances in neural information processing systems, no. 31, 2018.
- Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, "Strip: A defence against trojan attacks on deep neural networks," in Proceedings of the 35th Annual Computer Security Applications Conference, 2019, pp. 113-125.
- S. Huang, W. Peng, Z. Jia, and Z. Tu, "One-pixel signature: Character- izing cnn models for backdoor detection," in European Conference on Computer Vision. Springer, 2020, pp. 326-341.
- K. Liu, B. Dolan-Gavitt, and S. Garg, "Fine-pruning: Defending against backdooring attacks on deep neural networks," in International Sympo- sium on Research in Attacks, Intrusions, and Defenses. Springer, 2018, pp. 273-294.
- Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, "Neural attention distillation: Erasing backdoor triggers from deep neural networks," International Conference on Learning Representations, 2021.
- R. Wang, G. Zhang, S. Liu, P.-Y. Chen, J. Xiong, and M. Wang, "Practical detection of trojan neural networks: Data-limited and data- free cases," European Conference on Computer Vision, 2020.
- B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, "Neural cleanse: Identifying and mitigating backdoor attacks in neural networks," in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 707-723.
- S. Neel, A. Roth, and S. Sharifi-Malvajerdi, "Descent-to-delete: Gradient-based methods for machine unlearning," in Algorithmic Learn- ing Theory. PMLR, 2021, pp. 931-962.
- Y. Liu, Z. Ma, X. Liu, J. Liu, Z. Jiang, J. Ma, P. Yu, and K. Ren, "Learn to forget: Memorization elimination for neural networks," arXiv preprint arXiv:2003.10933, 2020. · arXiv
- X. Qiao, Y. Yang, and H. Li, "Defending neural backdoors via generative distribution modeling," NeurIPS, 2019.
- L. Zhu, R. Ning, C. Wang, C. Xin, and H. Wu, "Gangsweep: Sweep out neural backdoors by gan," in Proceedings of the 28th ACM International Conference on Multimedia, 2020, pp. 3173-3181.
- M. I. Belghazi, A. Baratin, S. Rajeswar, S. Ozair, Y. Bengio, A. Courville, and R. D. Hjelm, "Mine: mutual information neural esti- mation," Proceedings of International Conference on Machine Learning, 2018.
- T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnera- bilities in the machine learning model supply chain," arXiv preprint arXiv:1708.06733, 2017. · arXiv
- S. Li, M. Xue, B. Zhao, H. Zhu, and X. Zhang, "Invisible backdoor attacks on deep neural networks via steganography and regularization," IEEE Transactions on Dependable and Secure Computing, 2020.
- J. Chen, H. Zheng, M. Su, T. Du, C. Lin, and S. Ji, "Invisible poisoning: Highly stealthy targeted poisoning attack," in International Conference on Information Security and Cryptology. Springer, 2019, pp. 173-198.
- S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, "Universal litmus patterns: Revealing backdoor attacks in cnns," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 301-310.
- M. Du, R. Jia, and D. Song, "Robust anomaly detection and backdoor at- tack detection via differential privacy," arXiv preprint arXiv:1911.07116, 2019. · arXiv
- E. Chou, F. Tramèr, and G. Pellegrino, "Sentinet: Detecting localized universal attacks against deep learning systems," in 2020 IEEE Security and Privacy Workshops (SPW). IEEE, 2020, pp. 48-54.
- M. Chen, Z. Zhang, T. Wang, M. Backes, M. Humbert, and Y. Zhang, "Graph unlearning," arXiv preprint arXiv:2103.14991, 2021. · arXiv
- Y. Liu, Z. Ma, X. Liu, Z. Wang, S. Ma, and K. Ren, "Revocable federated learning: A benchmark of federated forest," arXiv preprint arXiv:1911.03242, 2019. · arXiv
- J. Sun, Y. Cao, Q. A. Chen, and Z. M. Mao, "Towards robust lidar-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures," in 29th {USENIX} Security Symposium ({USENIX} Security 20), 2020, pp. 877-894.
- K. Liu, B. Dolan-Gavitt, and S. Garg, "Fine-pruning: Defending against backdooring attacks on deep neural networks," in International Sympo- sium on Research in Attacks, Intrusions, and Defenses. Springer, 2018, pp. 273-294.
- Y. Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, "Neural attention distillation: Erasing backdoor triggers from deep neural networks," arXiv preprint arXiv:2101.05930, 2021. · arXiv
- T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnera- bilities in the machine learning model supply chain," arXiv preprint arXiv:1708.06733, 2017. · arXiv
- R. Pang, H. Shen, X. Zhang, S. Ji, Y. Vorobeychik, X. Luo, A. Liu, and T. Wang, "A tale of evil twins: Adversarial inputs versus poisoned models," in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, 2020, pp. 85-99.
- Authors
- Liu, Y., Fan, M., Chen, C., Liu, X., Ma, Z., Wang, L., & Ma, J.
- Affiliations
- Xidian University (CN)
- Fuzhou University (CN)
- East China Normal University (CN)
- State Key Laboratory of Integrated Services Networks (ISN)
- Ant Group (China) (CN)
- Venue
- IEEE INFOCOM 2022 - IEEE Conference on Computer Communications
- Publisher
- IEEE
- Published
- 2022-05-02
- Pages
- 280-289
- OpenAlex
- W4225750584
- Cited by
- 95
- References
- 28
- Citations by year
- 2026: 16 · 2025: 39 · 2024: 28 · 2023: 8 · 2022: 4
- FWCI
- 10.92
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- IEEE Conference on Computer Communications (INFOCOM) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by-nc-nd)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China
- Natural Science Foundation of Fujian Province
- Xidian University
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- backdoor attacks, backdoor defense, machine unlearning, entropy maximization, generative models, gradient ascent, neural network security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
