Multidomain active defense: Detecting multidomain backdoor poisoned samples via ALL-to-ALL decoupling training without clean datasets

Abstract

Deep learning is vulnerable to backdoor poisoning attacks in which an attacker can easily embed a hidden backdoor into a trained model by injecting poisoned samples into the training set. Many prior state-of-the-art techniques for detecting backdoor poisoning attacks are based on a potential separability assumption. However, current adaptive poisoning strategies can significantly reduce ’distinguishable behavior’, making most prior state-of-the-art techniques less effective. In addition, we note that existing detection methods are not practical for multidomain datasets and may leak user privacy because they require and collect clean samples. To address the above issues, we propose a multidomain active defense approach that does not use clean datasets. The proposed approach can generate diverse clean samples from different domains and decouple neural networks round by round using clean samples to disassociate features and labels, making backdoor poisoned samples easier to detect without fitting clean samples. We demonstrate the advantage of our approach through an extensive evaluation of CIFAR10, CelebA, MNIST & MNIST-M, MNIST & USPS & MNIST-M, MNIST & USPS & SVHN and CIFAR10 & Tiny-ImageNet.