On the Effectiveness of Adversarial Training Against Backdoor Attacks

Area of Science:

• Machine Learning
• Artificial Intelligence Security
• Cybersecurity

Background:

• Adversarial training (AT) is a proposed defense against backdoor attacks in machine learning models.
• Existing AT methods have shown limited success and can sometimes worsen backdoor vulnerabilities.
• A significant gap exists between the expected and actual performance of AT against these threats.

Purpose of the Study:

• To comprehensively evaluate the effectiveness of adversarial training (AT) against backdoor attacks under diverse conditions.
• To identify the key factors influencing AT's success or failure in mitigating backdoor threats.
• To propose practical improvements and new directions for robust backdoor defense strategies.

Main Methods:

• Systematic empirical evaluation of adversarial training (AT) against various backdoor attack configurations.
• Analysis of the impact of different perturbation types and budgets within AT.
• Development and testing of novel defense mechanisms like relaxed adversarial perturbation and composite AT.

Main Results:

• Adversarial training's effectiveness is highly sensitive to the specific perturbations used and their budgets.
• Commonly used perturbations in AT are only effective against particular types of backdoor triggers.
• The study identified specific settings where AT can be vulnerable or even counterproductive.

Conclusions:

• Adversarial training (AT) is not a universally effective defense against all backdoor attacks.
• The choice of perturbation type and budget is critical for successful backdoor defense using AT.
• The findings provide a more nuanced understanding of AT's limitations and suggest avenues for enhanced, practical backdoor defense mechanisms.