Effective Defense Research Articles

Audio-deepfake detection: Adversarial attacks and countermeasures

Audio has always been a powerful resource for biometric authentication: thus, numerous AI-based audio authentication systems (classifiers) have been proposed. While these classifiers are effective in identifying legitimate human-generated input their security, to the best of our knowledge, has not been explored thoroughly when confronted with advanced attacks that leverage AI-generated deepfake audio. This issue presents a serious concern regarding the security of these classifiers because, e.g., samples generated using adversarial attacks might fool such classifiers, resulting in incorrect classification. In this study, we prove the point: we demonstrate that state-of-the-art audio deepfake classifiers are vulnerable to adversarial attacks. In particular, we design two adversarial attacks on a state-of-the-art audio-deepfake classifier, i.e., the Deep4SNet classification model, which achieves 98.5% accuracy in detecting fake audio samples. The designed adversarial attacks11The code of the attacks will be released open-source in the camera ready. leverage a generative adversarial network architecture and reduce the detector’s accuracy to nearly 0%. In particular, under graybox attack scenarios, we demonstrate that when starting from random noise, we can reduce the accuracy of the state-of-the-art detector from 98.5% to only 0.08%. To mitigate the effect of adversarial attacks on audio-deepfake detectors, we propose a highly generalizable, lightweight, simple, and effective add-on defense mechanism that can be implemented in any audio-deepfake detector. Finally, we discuss promising research directions.

Iterative and mixed-spaces image gradient inversion attack in federated learning

As a distributed learning paradigm, federated learning is supposed to protect data privacy without exchanging users’ local data. Even so, the gradient inversion attack, in which the adversary can reconstruct the original data from shared training gradients, has been widely deemed as a severe threat. Nevertheless, most existing researches are confined to impractical assumptions and narrow range of applications. To mitigate these shortcomings, we propose a comprehensive framework for gradient inversion attack, with well-designed algorithms for image and label reconstruction. For image reconstruction, we fully utilize the generative image prior, which derives from wide-used generative models, to improve the reconstructed results, by additional means of iterative optimization on mixed spaces and gradient-free optimizer. For label reconstruction, we design an adaptive recovery algorithm regarding real data distribution, which can adjust previous attacks to more complex scenarios. Moreover, we incorporate a gradient approximation method to efficiently fit our attack for FedAvg scenario. We empirically verify our attack framework using benchmark datasets and ablation studies, considering loose assumptions and complicated circumstances. We hope this work can greatly reveal the necessity of privacy protection in federated learning, while urge more effective and robust defense mechanisms.

Omega-3 and omega-6 polyunsaturated fatty acids and their potential therapeutic role in protozoan infections.

Protozoa exert a serious global threat of growing concern to human, and animal, and there is a need for the advancement of novel therapeutic strategies to effectively treat or mitigate the impact of associated diseases. Omega polyunsaturated fatty acids (ω-PUFAs), including Omega-3 (ω-3) and omega-6 (ω-6), are constituents derived from various natural sources, have gained significant attention for their therapeutic role in parasitic infections and a variety of essential structural and regulatory functions in animals and humans. Both ω-3 and ω-6 decrease the growth and survival rate of parasites through metabolized anti-inflammatory mediators, such as lipoxins, resolvins, and protectins, and have both in vivo and in vitro protective effects against various protozoan infections. The ω-PUFAs have been shown to modulate the host immune response by a commonly known mechanism such as (inhibition of arachidonic acid (AA) metabolic process, production of anti-inflammatory mediators, modification of intracellular lipids, and activation of the nuclear receptor), and promotion of a shift towards a more effective immune defense against parasitic invaders by regulation the inflammation like prostaglandins, leukotrienes, thromboxane, are involved in controlling the inflammatory reaction. The immune modulation may involve reducing inflammation, enhancing phagocytosis, and suppressing parasitic virulence factors. The unique properties of ω-PUFAs could prevent protozoan infections, representing an important area of study. This review explores the clinical impact of ω-PUFAs against some protozoan infections, elucidating possible mechanisms of action and supportive therapy for preventing various parasitic infections in humans and animals, such as toxoplasmosis, malaria, coccidiosis, and chagas disease. ω-PUFAs show promise as a therapeutic approach for parasitic infections due to their direct anti-parasitic effects and their ability to modulate the host immune response. Additionally, we discuss current treatment options and suggest perspectives for future studies. This could potentially provide an alternative or supplementary treatment option for these complex global health problems.

Efficient adversarial training with multi-fidelity optimization for robust neural network

Adversarial examples (AEs) pose a significant threat to the security and reliability of deep neural networks. Adversarial training (AT) is one of the effective defense methods, involving the integration of a number of generated AEs into the training process to enhance model robustness. However, the computational cost associated with AE generation is unbearable, particularly for large-scale tasks. In pursuit of fast AT, many algorithms generate AEs by adopting a simple attack strategy, but they often sacrifice the quality of AEs and suffer from catastrophic overfitting, resulting in suboptimal model robustness. To address these issues, our approach incorporates multi-fidelity optimization, which employs a dynamic attack strategy to generate AEs with varying fidelity within a suitable range. Furthermore, we introduce a surrogate-assisted fidelity estimation module at the beginning of our proposed algorithm, allowing for the adaptive determination of the fidelity range tailored to specific tasks. Comparative experiments with seven state-of-the-art algorithms on three networks and three datasets demonstrate that the proposed algorithm obtains a competitive robust accuracy but spends only 50% of the training time of the projected gradient descent algorithm.

Analisis Penyebab Stagnansi ASEAN Defense Industrial Collaboration (ADIC)

An independent defense capability is an aspiration and a crucial need for nations. Achieving this will ensure the state’s independence from the possible influence of weapon-producing states. To attain this goal, countries worldwide, including those in the ASEAN region, have endeavored to advance their weapon technologies through national defense industries. The ASEAN Defense Industrial Collaboration (ADIC), established in 2011, was conceived to emulate the success of European consortiums in producing diverse weapon technologies. Regrettably, after 11 years, ADIC has not produced or initiated the development of any weapon technology. The analysis in this article is conducted by synthesizing the perspectives of four key prerequisites for the success of defense industry cooperation: constructivist, institutionalist, liberal, and realist. The research method employed in this article is Causal Process Tracing (CPT), specifically aimed at identifying the prerequisites that lead to specific events. This article concludes that the failure of ADIC is attributed to five factors. Firstly, diverse economic systems among ADIC members create challenges. Secondly, equivalent defense industry capacities lead to competition and hinder collaboration. Thirdly, low spill-over effects from successful cooperation in other sectors impede progress. Fourthly, persistent distrust among ADIC member countries poses a barrier. Lastly, the absence of a defense alliance results in a strong consideration of relative gains. In essence, these factors underscore the complexity and challenges in achieving effective international defense collaboration.

Wave run-up characteristic on armour layer breakwater using the smoothed particle hydrodynamics (SPH) method

Coastal structures, such as breakwater, play a critical role in protecting shorelines from the erosive forces of waves and currents. Understanding the wave run-up phenomenon on these structures is essential for designing effective coastal defense systems. This research aims to investigate the wave run-up characteristics on an armour layer breakwater using the Smoothed Particle Hydrodynamics (SPH) method (Meshless particle method based on the Lagrangian formulation), a numerical method that captures complex fluid-structure interactions. The SPH method’s inherent ability to handle free-surface flows and dynamic interactions makes it particularly suited for simulating wave run-up. The research employs numerical testing and modelling of a non-overtopping breakwater using the smoothed particle hydrodynamics method simulated with the DualSPHysics program. The wave characteristic data used in this research are the waves on the south coast of Java. The results of this research indicate that the correlation between wave run-up characteristics (Ru/H) and the Iribarren number, both using the numerical SPH method and theory, tends to exhibit a similar pattern. Remarkably, the results from both approaches exhibit a striking similarity, revealing that as the Iribarren number increases, the incremental growth of Ru/H diminishes, eventually stabilizing at a critical threshold. The Coefficient of Determination (R2) between wave run-up characteristics (Ru/H) obtained from numerical simulations using the SPH method and Günbak’s theory is 0.8824.

Data poisoning attacks on traffic state estimation and prediction

Data has become ubiquitous nowadays in transportation, including vehicular data and infrastructure-generated data. The growing reliance on data poses potential cybersecurity issues to transportation systems, among which the so-called “data poisoning” attacks by adversaries are becoming increasingly critical. Such attacks aim to compromise a system’s performance by adding systematic and malicious noises, perturbations, or deviations to the dataset used by the system. Formal investigations of data poisoning attacks are essential for understanding the attacks and developing effective defense methods. This study develops a general data poisoning attack model for traffic state estimation and prediction (TSEP) that is a basic application in transportation. We first formulate data poisoning attacks as a general sensitivity analysis of parameterized optimization problems over parameter changes (i.e., data perturbations) and study the Lipschitz continuity property of the solution with the presence of general (equality and inequality) constraints. Then, we develop attack models that fit a broader spectrum of learning applications (such as TSEP) by extending existing models that only focus on learning problems with no or equality constraints (widely used in the cybersecurity field). Since the solution of such general problems is often continuous but not differentiable with data changes, we apply the generalized implicit function theorem to compute the semi-derivatives that express how the TSEP solution responds to data perturbations. The semi-derivatives enable us to evaluate TSEP models’ vulnerability (at each data point) and solve the proposed attack model. We demonstrate the generality and effectiveness of the proposed method on two TSEP models using mobile sensing data.

ANALYSIS OF THE PROCEDURE FOR ORDERING RESEARCH AND DEVELOPMENT PROCUREMENT (R&D) IN THE INTERESTS OF THE ARMED FORCES OF UKRAINE ON THE TERRITORY OF UKRAINE AND ABROAD

Research and development (R&D) orders have a significant impact on the production and modernization of weapons and military equipment in Ukraine, and given the nature of current threats and strategic challenges, continued investment in research and development is key to maintaining effective defense and national security. R&D is an integral part of the unified innovation process "from idea to implementation", during which the results of R&D or acquired knowledge and experience are implemented in technical documentation to create prototypes of products that precede their mass production. However, the analysis of the regulatory framework of the current legislation on the organization of ordering R&D in the interests of the Armed Forces of Ukraine shows that currently there is no effective algorithm for ordering R&D abroad in the interests of the Armed Forces of Ukraine, and cases of ordering R&D are an exception and, as a rule, do not have a clear justification and implementation mechanism. Therefore, the issue requires cooperation at different levels and with different structures within the Ministry of Defense of Ukraine and the Armed Forces of Ukraine. In order to establish cooperation with foreign partners in the field of scientific and technical cooperation, there is an urgent need to harmonize national regulations on military products with international and NATO standards. In addition, coordination should be carried out systematically with the involvement of all stakeholders to ensure the successful ordering of R&D and the fulfillment of tasks, taking into account the requirements of other countries or partners, which is a key aspect of effective coordination at the international level. Therefore, there is a need to develop legal and regulatory documents that would regulate the ordering procedure and interaction of participants in the process of ordering and performing R&D in the interests of the Armed Forces of Ukraine abroad, to improve legislation and other regulations to a single conceptual, structural, functional and substantive understanding of the essence of the procedure for ordering R&D abroad.
 The article analyzes the legal framework of the process of ordering R&D in the interests of the Armed Forces of Ukraine, analyzes the scheme of ordering R&D in Ukraine, and provides proposals for organizing the ordering of R&D in the interests of the Armed Forces of Ukraine abroad.

The Role of AI and Machine Learning in Enhancing Cloud Security

Cloud computing has transformed how organizations store, process, and manage data, offering unparalleled flexibility and scalability. However, the rise in cyber threats presents significant challenges to maintaining robust cloud security. This chapter explores the crucial role that Artificial Intelligence (AI) and Machine Learning (ML) play in enhancing cloud security. By leveraging AI and ML capabilities, organizations can proactively detect, mitigate, and respond to evolving cyber threats, ultimately strengthening their cloud infrastructure. AI-driven techniques enable security systems to recognize patterns, anomalies, and potential threats within vast datasets. ML algorithms, learning from historical attack data, can predict future threats and develop more effective defense mechanisms. Furthermore, AI-enhanced authentication and access control mechanisms bolster identity management, reducing the risk of unauthorized access and data breaches.

Modelling metabolic fluxes of tomato stems reveals that nitrogen shapes central metabolism for defence against Botrytis cinerea.

Among plant pathogens, the necrotrophic fungus Botrytis cinerea is one of the most prevalent, leading to severe crop damage. Studies related to its colonization of different plant species have reported variable host metabolic responses to infection. In tomato, high N availability leads to decreased susceptibility. Metabolic flux analysis can be used as an integrated method to better understand which metabolic adaptations lead to effective host defence and resistance. Here, we investigated the metabolic response of tomato infected by B. cinerea in symptomless stem tissues proximal to the lesions for 7 d post-inoculation, using a reconstructed metabolic model constrained by a large and consistent metabolic dataset acquired under four different N supplies. An overall comparison of 48 flux solution vectors of Botrytis- and mock-inoculated plants showed that fluxes were higher in Botrytis-inoculated plants, and the difference increased with a reduction in available N, accompanying an unexpected increase in radial growth. Despite higher fluxes, such as those involved in cell wall synthesis and other pathways, fluxes related to glycolysis, the tricarboxylic acid cycle, and amino acid and protein synthesis were limited under very low N, which might explain the enhanced susceptibility. Limiting starch synthesis and enhancing fluxes towards redox and specialized metabolism also contributed to defence independent of N supply.

Redox Regulation by Priming Agents Toward a Sustainable Agriculture.

Plants are sessile organisms that are often subjected to a multitude of environmental stresses, with the occurrence of these events being further intensified by global climate change. Crop species therefore require specific adaptations to tolerate climatic variability for sustainable food production. Plant stress results in excess accumulation of reactive oxygen species leading to oxidative stress and loss of cellular redox balance in the plant cells. Moreover, enhancement of cellular oxidation as well as oxidative signals has been recently recognized as crucial players in plant growth regulation under stress conditions. Multiple roles of redox regulation in crop production have been well documented, and major emphasis has focused on key redox-regulated proteins and non-protein molecules, such as NAD(P)H, glutathione, peroxiredoxins, glutaredoxins, ascorbate, thioredoxins and reduced ferredoxin. These have been widely implicated in the regulation of (epi)genetic factors modulating growth and health of crop plants, with an agricultural context. In this regard, priming with the employment of chemical and biological agents has emerged as a fascinating approach to improve plant tolerance against various abiotic and biotic stressors. Priming in plants is a physiological process, where prior exposure to specific stressors induces a state of heightened alertness, enabling a more rapid and effective defense response upon subsequent encounters with similar challenges. Priming is reported to play a crucial role in the modulation of cellular redox homeostasis, maximizing crop productivity under stress conditions and thus achieving yield security. By taking this into consideration, the present review is an up-to-date critical evaluation of promising plant priming technologies and their role in the regulation of redox components toward enhanced plant adaptations to extreme unfavorable environmental conditions. The challenges and opportunities of plant priming are discussed, with an aim of encouraging future research in this field toward effective application of priming in stress management in crops including horticultural species.

Predict and Optimize Financial Services Risk Using AI-driven Technology

With the rapid development of internet technology, many industries have embarked on a digital transformation. However, while the Internet has brought convenience to users, it has also become a breeding ground for criminals to commit fraud. On the one hand, a large number of users on the Internet more or less left data, criminals can use this information to practice accurate fraud users, improve the success rate of fraud; On the other hand, online financial transactions such as banking and e-commerce also provide more opportunities for criminals to commit fraud. Therefore, all kinds of fraud methods emerge in an endless flow, through the telephone, information, fishing and other means of fraud, not only to bring hundreds of millions of losses to society every year, but also to the security of people's lives have a huge threat. Monitoring and preventing online fraud is an important part of the cybersecurity industry. For known network fraud, based on the domain name of the phishing site, the account number and mobile phone number that send fraudulent information, simple and effective monitoring and defence can be carried out through the blacklist. However, it is difficult for traditional means to effectively defend against undocumented fraud. With the development of machine learning technology, it is the main research direction of fraud detection methods to discover the information sources and characteristics of information content through machine learning technology, and make real-time and continuous accurate judgments. This paper realises credit fraud detection by generating adversarial network technology, so as to prevent network security risks.

ERdj5-mediated regulation of proliferation and differentiation in colon organoids under inflammatory stress

Background: Endoplasmic reticulum (ER) stress is resolved by ERdj5, which functions as a disulfide reductase. In a previous study, we confirmed that ERdj5 was not indispensable for the formation of intestinal epithelial cells in mice. However, studies evaluating the association of ERdj5 and growth factors are limited. In the present study, we observed changes in the proliferation of colon organoids cultured from intestinal crypts obtained from wild-type (WT) and ERdj5 knockout (KO) mice.Methods: We cultured colon organoids from WT and ERdj5 KO mice, and we then assessed differentiation- and proliferation-related markers after exposure to various stimuli, such as irradiation and the Toll-like receptor (TLR) 2 ligand Pam3CSK4.Results: Over 15 days of organoid culture, ERdj5 KO colon organoids demonstrated a similar increase in leucine-rich repeat-containing G-protein-coupled receptor 5 (Lgr5) expression as WT colon organoids. However, in response to Pam3CSK4-induced stress, the ERdj5 KO organoids exhibited decreased Lgr5 expression and increased C/EBP homologous protein (CHOP) levels. Moreover, after irradiation-induced stress, ERdj5 downregulated epithelial-related genes, including Lgr5, Villin 1, and Prominin 1.Conclusion: Inflammation through irradiation or TLR2-induced mild or severe ER stress in both groups, whereas ERdj5 deficiency eventually led to the downregulation of Lgr5. In summary, these findings suggest that colon organoids lack the ability to mount an effective defense against various inflammatory stimuli when there is a deficiency in the ERdj5-related ER stress resolution pathway.

Thai-language chatbot security: Detecting instruction attacks with XLM-RoBERTa and Bi-GRU

Instruction attack is a malicious attempt to manipulate a chatbot by providing misleading or harmful prompts to achieve unintended outcomes. Detecting instruction attacks is crucial to protect the integrity and safety of chatbot interactions. In this study, we focus on identifying different types of instruction attacks which includes Goal Hijacking, Prompt Leaking, Reverse Exposure, Role Play Instruction and Unsafe Instruction Topic. Given the widening threat scope and the lack of research thus far in this field in a Thai language-oriented context, our intentions are to develop an effective defence system. We suggest an innovative approach: combining XLM-RoBERTa, a state-of-the art language model, with a Bidirectional Gated Recurrent Unit (Bi-GRU). By combining rigorous experimentation and comprehensive evaluation, our method provides outstanding accuracy of 96.52% , precision 96.50% , Recall and F1-score 96.41%. This research contributes to creating a safer and more trustworthy environment for chatbot-mediated interactions in the Thai language context.

Natural streamflow reconstruction and quantification of hydrological drought in the Soan River basin, Pakistan

AbstractClimate change and rapid socioeconomic development have exacerbated the damage caused by hydrological droughts. To ensure effective drought defense and infrastructure development, it is essential to investigate variations in hydrological droughts. The primary objective of this study is to reconstruct the natural streamflow by using Soil and Water Assessment Tool (SWAT) hydrological modeling. The hydrological drought at different time scales (1, 3, 6, and 12 months) were measured using the streamflow drought index (SDI). The statistical parameters, including Nash–Sutcliffe Efficiency and the Coefficient of Determination, which yielded values of 0.84 and 0.82 during the calibration period and 0.78 and 0.76 during the validation period, respectively, showed a satisfactory SWAT model performance. Additionally, the Pettit test was used to identify a change point in streamflow within the 1991–2015 timeframe, leading to the division of the study period into two distinct phases: an undisturbed period (1991–1998) and a disturbed period (1999–2015). The SDI index‐based analysis revealed 9.39% moderate drought and 3.13% severe drought during the undisturbed period, while 11.76% moderate drought and 7.35% severe drought may happen due to the human influences that occurred in the disturbed period. These findings enhance the understanding of the hydrological drought variations in the Soan River basin for optimizing the water resources management system and effectively preventing and mitigating drought‐related damages.

Concealing Sensitive Samples against Gradient Leakage in Federated Learning

Federated Learning (FL) is a distributed learning paradigm that enhances users' privacy by eliminating the need for clients to share raw, private data with the server. Despite the success, recent studies expose the vulnerability of FL to model inversion attacks, where adversaries reconstruct users’ private data via eavesdropping on the shared gradient information. We hypothesize that a key factor in the success of such attacks is the low entanglement among gradients per data within the batch during stochastic optimization. This creates a vulnerability that an adversary can exploit to reconstruct the sensitive data. Building upon this insight, we present a simple, yet effective defense strategy that obfuscates the gradients of the sensitive data with concealed samples. To achieve this, we propose synthesizing concealed samples to mimic the sensitive data at the gradient level while ensuring their visual dissimilarity from the actual sensitive data. Compared to the previous art, our empirical evaluations suggest that the proposed technique provides the strongest protection while simultaneously maintaining the FL performance. Code is located at https://github.com/JingWu321/DCS-2.

Detection and Defense of Unlearnable Examples

Privacy preserving has become increasingly critical with the emergence of social media. Unlearnable examples have been proposed to avoid leaking personal information on the Internet by degrading the generalization abilities of deep learning models. However, our study reveals that unlearnable examples are easily detectable. We provide theoretical results on linear separability of certain unlearnable poisoned dataset and simple network-based detection methods that can identify all existing unlearnable examples, as demonstrated by extensive experiments. Detectability of unlearnable examples with simple networks motivates us to design a novel defense method. We propose using stronger data augmentations coupled with adversarial noises generated by simple networks, to degrade the detectability and thus provide effective defense against unlearnable examples with a lower cost. Adversarial training with large budgets is a widely-used defense method on unlearnable examples. We establish quantitative criteria between the poison and adversarial budgets, which determine the existence of robust unlearnable examples or the failure of the adversarial defense.

Taxonomy Driven Fast Adversarial Training

Adversarial training (AT) is an effective defense method against gradient-based attacks to enhance the robustness of neural networks. Among them, single-step AT has emerged as a hotspot topic due to its simplicity and efficiency, requiring only one gradient propagation in generating adversarial examples. Nonetheless, the problem of catastrophic overfitting (CO) that causes training collapse remains poorly understood, and there exists a gap between the robust accuracy achieved through single- and multi-step AT. In this paper, we present a surprising finding that the taxonomy of adversarial examples reveals the truth of CO. Based on this conclusion, we propose taxonomy driven fast adversarial training (TDAT) which jointly optimizes learning objective, loss function, and initialization method, thereby can be regarded as a new paradigm of single-step AT. Compared with other fast AT methods, TDAT can boost the robustness of neural networks, alleviate the influence of misclassified examples, and prevent CO during the training process while requiring almost no additional computational and memory resources. Our method achieves robust accuracy improvement of 1.59%, 1.62%, 0.71%, and 1.26% on CIFAR-10, CIFAR-100, Tiny ImageNet, and ImageNet-100 datasets, when against projected gradient descent PGD10 attack with perturbation budget 8/255. Furthermore, our proposed method also achieves state-of-the-art robust accuracy against other attacks. Code is available at https://github.com/bookman233/TDAT.

A Simple and Yet Fairly Effective Defense for Graph Neural Networks

Graph Neural Networks (GNNs) have emerged as the dominant approach for machine learning on graph-structured data. However, concerns have arisen regarding the vulnerability of GNNs to small adversarial perturbations. Existing defense methods against such perturbations suffer from high time complexity and can negatively impact the model's performance on clean graphs. To address these challenges, this paper introduces NoisyGNNs, a novel defense method that incorporates noise into the underlying model's architecture. We establish a theoretical connection between noise injection and the enhancement of GNN robustness, highlighting the effectiveness of our approach. We further conduct extensive empirical evaluations on the node classification task to validate our theoretical findings, focusing on two popular GNNs: the GCN and GIN. The results demonstrate that NoisyGNN achieves superior or comparable defense performance to existing methods while minimizing added time complexity. The NoisyGNN approach is model-agnostic, allowing it to be integrated with different GNN architectures. Successful combinations of our NoisyGNN approach with existing defense techniques demonstrate even further improved adversarial defense results. Our code is publicly available at: https://github.com/Sennadir/NoisyGNN.

Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift

Diffusion models (DM) have become state-of-the-art generative models because of their capability of generating high-quality images from noises without adversarial training. However, they are vulnerable to backdoor attacks as reported by recent studies. When a data input (e.g., some Gaussian noise) is stamped with a trigger (e.g., a white patch), the backdoored model always generates the target image (e.g., an improper photo). However, effective defense strategies to mitigate backdoors from DMs are underexplored. To bridge this gap, we propose the first backdoor detection and removal framework for DMs. We evaluate our framework Elijah on over hundreds of DMs of 3 types including DDPM, NCSN and LDM, with 13 samplers against 3 existing backdoor attacks. Extensive experiments show that our approach can have close to 100% detection accuracy and reduce the backdoor effects to close to zero without significantly sacrificing the model utility.