Outsourced training and machine learning as a service have resulted in novel attack vectors like backdoor attacks. Such attacks embed a secret functionality in a neural network activated when the trigger is added to its input. In most works in the literature, the trigger is static, both in terms of location and pattern. The effectiveness of various detection mechanisms depends on this property. It was recently shown that countermeasures in image classification, like Neural Cleanse and ABS, could be bypassed with dynamic triggers that are effective regardless of their pattern and location. Still, such backdoors are demanding as they require a large percentage of poisoned training data. In this work, we are the first to show that dynamic backdoor attacks could happen due to a global average pooling layer without increasing the percentage of the poisoned training data. Nevertheless, our experiments in sound classification, text sentiment analysis, and image classification show this to be very difficult in practice.
State Key Laboratory of Integrated Services Networks (ISN)（综合业务网理论及关键技术国家重点实验室）；Shaanxi Key Laboratory of Network and System Security, Xidian University（西安电子科技大学陕西省网络与系统安全重点实验室）；School of Data Science and Engineering, East China Normal University（华东师范大学数据科学与工程学院）；Ant Group（蚂蚁集团）；College of Computer and Data Science, Fuzhou University（福州大学计算机与数据科学学院）
CodePurify: Defend Backdoor Attacks on Neural Code Models via Entropy-based Purification
Institute of Software Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beihang University（北京航空航天大学）；York University（约克大学）；Lassonde School of Engineering（拉桑德工程学院）
Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
University of Alberta（阿尔伯塔大学）；Michigan State University（密歇根州立大学）；Illinois Institute of Technology（伊利诺伊理工学院）；DSO National Laboratories（新加坡国防科技局国家实验室）；MIT-IBM Watson AI Lab, IBM Research（IBM研究院MIT-IBM沃森人工智能实验室）
Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
University of West Florida（西佛罗里达大学）；Florida Institute For Human and Machine Cognition (IHMC)（佛罗里达人机认知研究所）；Center for Cybersecurity, University of West Florida（西佛罗里达大学网络安全中心）
Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork
University of Texas at Austin（德克萨斯大学奥斯汀分校）；Michigan State University（密歇根州立大学）；Amazon Web Services（亚马逊云科技）
深度神经网络（DNN）容易受到后门攻击。以前的工作已经表明，从网络中消除不需要的后门行为是非常具有挑战性的，因为整个网络都可能受到后门样本的影响。在本文中，我们提出了一个全新的后门防御策略，这使得它更容易从模型中删除后门样本的有害影响。我们的防御战略，\emph{Trap and Replace}，包括两个阶段。在第一阶段，我们在一个小而容易替换的子网中诱饵和陷阱后门。具体来说，我们在与轻量分类头共享的干网络之上添加辅助图像重建头。直觉是，辅助图像重建任务鼓励干网络保持足够的难以学习但语义正确的低级视觉特征，而不是过度拟合易于学习但语义不正确的后门相关性。因此，当在后门数据集上训练时，后门很容易被引诱到未受保护的分类头，因为它比共享的主干更容易受到攻击，使得主干网络几乎不会中毒。在第二阶段，我们用一个未污染的分类头替换中毒的轻量级分类头，只在一个具有干净样本的小数据集上从头开始重新训练它，同时修复干网络。因此，最终网络中的主干和分类头几乎不受后门训练样本的影响。我们评估我们的方法对十种不同的后门攻击。我们的方法在CIFAR 10、GTSRB和ImageNet-12上的攻击成功率和平均$3.14\%$、$1.80\%$和$1.21\%$干净分类准确率分别高达$20.57\%$、$9.80\%$和$13.72\%$，优于之前最先进的方法。代码可在线获取。
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning
Dept. of Computer Science Faculty of Engineering University of Manchester Manchester, United Kingdom；Dept. of Computer Science Faculty of Engineering University of Manchester \& MBZUAI Abu Dhabi, United Arab Emirates；Dept. of Computer Science Faculty of Engineering University of Manchester \& KU Leuven Manchester, United Kingdom
College of Artificial Intelligence, Nanjing University of Aeronautics and Astronautics（南京航空航天大学人工智能学院）；Shenzhen Research Institute of Northwestern Polytechnical University（西北工业大学深圳研究院）；School of Software, Northwestern Polytechnical University（西北工业大学软件学院）；School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）；School of Cybersecurity, Northwestern Polytechnical University（西北工业大学网络安全学院）
Towards Stealthy and Effective Backdoor Attacks on Lane Detection: A Naturalistic Data Poisoning Approach
State Key Laboratory of Intelligent Vehicle Safety Technology, Changan Automobile（长安汽车智能车辆安全技术国家重点实验室）；National University of Singapore (Chongqing) Research Institute, Chongqing（新加坡国立大学（重庆）研究院）；Hong Kong University of Science and Technology (Guangzhou), Guangzhou（香港科技大学（广州））；National University of Singapore, Singapore（新加坡国立大学）；Ningbo University, Ningbo（宁波大学）；Sun Yat-Sen University, Guangzhou（中山大学）；Chongqing Changan Automobile Co., Ltd., Chongqing（重庆长安汽车有限公司）
BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasets
University of Virginia（弗吉尼亚大学）；Singapore Management University（新加坡管理大学）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；Rutgers University（罗格斯大学）；North Carolina State University（北卡罗来纳州立大学）
Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical World
NanJing University of Science and Technology（南京理工大学）；University of Adelaide（阿德莱德大学）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织Data61）；Sungkyunkwan University（成均馆大学）
CBPF: Filtering Poisoned Data Based on Composite Backdoor Attack
School of Computer Science and Technology, Zhejiang Gongshang University（浙江工商大学计算机科学与技术学院）；School of Mathematical and Computational Sciences, Massey University（梅西大学数学与计算科学学院）
INK: Inheritable Natural Backdoor Attack Against Model Distillation
Institute of Computer Application, China Academy of Engineering Physics（中国工程物理研究院计算机应用研究所）；Faculty of Electronic and Information Engineering, Xi’an Jiaotong University（西安交通大学电子与信息工程学院）；School of Cyberspace Security, Beijing University of Posts and Telecommunications（北京邮电大学网络空间安全学院）
针对可信数据集蒸馏可阻断传统投毒后门的问题，本文提出 INK，以自然图像方差为触发器，在无训练数据访问权时实现可从教师迁移到学生的干净图像、干净标签攻击，蒸馏后 ASR 仍超 98%。
Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigation
School of Cyber Science and Technology（网络安全科学与技术学院）；Harbin Institute of Technology（哈尔滨工业大学）；Peng Cheng Laboratory（鹏城实验室）；University of Luxembourg（卢森堡大学）
