Multidomain active defense: Detecting multidomain backdoor poisoned samples via ALL-to-ALL decoupling training...

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Deep Learning

Background:

• Deep learning models are susceptible to backdoor poisoning attacks, where attackers insert hidden vulnerabilities via poisoned training data.
• Existing detection methods often rely on data separability assumptions, which are undermined by adaptive poisoning strategies.
• Current defenses are impractical for multidomain datasets and raise privacy concerns due to the need for clean samples.

Purpose of the Study:

• To develop a robust, privacy-preserving defense against backdoor poisoning attacks in deep learning.
• To create a practical solution for detecting backdoors in multidomain datasets without requiring clean samples.
• To overcome the limitations of existing detection methods that fail against adaptive poisoning strategies.

Main Methods:

• Proposed a multidomain active defense approach that generates diverse clean samples from various domains.
• Implemented a round-by-round decoupling of neural networks using generated clean samples.
• Disassociated features and labels to make backdoor poisoned samples more detectable without fitting clean data.

Main Results:

• The proposed defense effectively detects backdoor poisoned samples.
• The approach demonstrates practicality and effectiveness across multiple diverse datasets including CIFAR10, CelebA, MNIST, MNIST-M, USPS, SVHN, and Tiny-ImageNet.
• Successfully addressed limitations of prior methods regarding adaptive poisoning and multidomain applicability.

Conclusions:

• The developed multidomain active defense is a significant advancement in securing deep learning models against sophisticated backdoor attacks.
• The method offers a practical, privacy-conscious solution for real-world applications involving diverse data.
• Future work could explore further optimizations and applications in varied deep learning architectures.