Contrastive Neuron Pruning for Backdoor Defense.

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Deep Neural Networks

Background:

• Deep neural networks (DNNs) are vulnerable to backdoor attacks, where malicious triggers are embedded via poisoned training data.
• Identifying and pruning neurons responsible for these backdoors is crucial but challenging with current methods, often requiring labeled clean data.

Purpose of the Study:

• To propose a novel defense strategy, Contrastive Neuron Pruning (CNP), to mitigate DNN backdoor attacks.
• To address the limitations of existing neuron pruning techniques, particularly their reliance on labeled clean data.

Main Methods:

• CNP leverages the feature space clustering of poisoned samples in backdoored models.
• It uses contrastive learning on generated benign-benign and benign-poisoned feature pairs to enhance feature separation.
• Neurons in Batch Normalization layers with significant response differences to these pairs are identified and pruned.

Main Results:

• CNP effectively defends against backdoor attacks by pruning a small percentage (approx. 1%) of neurons.
• The method demonstrates robustness and efficacy across various benchmarks.
• It improves the separation between benign and poisoned features in the model's feature space.

Conclusions:

• Contrastive Neuron Pruning (CNP) offers an effective and efficient defense against DNN backdoor attacks.
• The approach mitigates attacks by targeting specific neurons without requiring labeled clean data.
• CNP presents a significant advancement in securing deep learning models against adversarial threats.