Recently, self-supervised learning (SSL) was shown to be vulnerable to patch-based data poisoning backdoor attacks. It was shown that an adversary can poison a small part of the unlabeled data so that when a victim trains an SSL model on it, the final model will have a backdoor that the adversary can exploit. This work aims to defend self-supervised learning against such attacks. We use a three-step defense pipeline, where we first train a model on the poisoned data. In the second step, our proposed defense algorithm (PatchSearch) uses the trained model to search the training data for poisoned samples and removes them from the training set. In the third step, a final model is trained on the cleaned-up training set. Our results show that PatchSearch is an effective defense. As an example, it improves a model's accuracy on images containing the trigger from 38.2% to 63.7% which is very close to the clean model's accuracy, 64.6%. Moreover, we show that PatchSearch outperforms baselines and state-of-the-art defense approaches including those using additional clean, trusted data. Our code is available at https://github.com/UCDvision/PatchSearch
Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning
Southeast University（东南大学）；University of Queensland（昆士兰大学）；Nanyang Technological University（南洋理工大学）；Zhejiang University（浙江大学）；National University of Singapore（新加坡国立大学）
Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork
University of Texas at Austin（德克萨斯大学奥斯汀分校）；Michigan State University（密歇根州立大学）；Amazon Web Services（亚马逊云科技）
深度神经网络（DNN）容易受到后门攻击。以前的工作已经表明，从网络中消除不需要的后门行为是非常具有挑战性的，因为整个网络都可能受到后门样本的影响。在本文中，我们提出了一个全新的后门防御策略，这使得它更容易从模型中删除后门样本的有害影响。我们的防御战略，\emph{Trap and Replace}，包括两个阶段。在第一阶段，我们在一个小而容易替换的子网中诱饵和陷阱后门。具体来说，我们在与轻量分类头共享的干网络之上添加辅助图像重建头。直觉是，辅助图像重建任务鼓励干网络保持足够的难以学习但语义正确的低级视觉特征，而不是过度拟合易于学习但语义不正确的后门相关性。因此，当在后门数据集上训练时，后门很容易被引诱到未受保护的分类头，因为它比共享的主干更容易受到攻击，使得主干网络几乎不会中毒。在第二阶段，我们用一个未污染的分类头替换中毒的轻量级分类头，只在一个具有干净样本的小数据集上从头开始重新训练它，同时修复干网络。因此，最终网络中的主干和分类头几乎不受后门训练样本的影响。我们评估我们的方法对十种不同的后门攻击。我们的方法在CIFAR 10、GTSRB和ImageNet-12上的攻击成功率和平均$3.14\%$、$1.80\%$和$1.21\%$干净分类准确率分别高达$20.57\%$、$9.80\%$和$13.72\%$，优于之前最先进的方法。代码可在线获取。
German Research Center for Artificial Intelligence（德国人工智能研究中心）；Technical University of Darmstadt（达姆施塔特工业大学）；TU Dortmund University（多特蒙德工业大学）；Center for Trustworthy Data Science and Security, University Alliance Ruhr（鲁尔大学联盟可信数据科学与安全中心）；Hessian Center for AI (hessian.AI)（黑森州人工智能中心）；Centre for Cognitive Science TU Darmstadt（达姆施塔特工业大学认知科学中心）
Towards Backdoor Attacks and Defense in Robust Machine Learning Models
Interdisciplinary Centre for Security, Reliability and Trust (SnT), University of Luxembourg（卢森堡大学跨学科安全、可靠性与信任中心（SnT））；Singapore University of Technology and Design（新加坡科技设计大学）
PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification
Institute for AI Industry Research (AIR), Tsinghua University（清华大学人工智能产业研究院）；Shanghai Jiao Tong University（上海交通大学）；Wuhan University（武汉大学）；Shanghai AI Laboratory（上海人工智能实验室）
Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decomposition
Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）；School of Software, Tsinghua University（清华大学软件学院）；School of Computer and Communication Engineering, University of Science and Technology Beijing（北京科技大学计算机与通信工程学院）；Institute for AI, BNRist, IDG/McGovern Institute for Brain Research, Tsinghua University（清华大学人工智能研究院、北京信息科学与技术国家研究中心、IDG/麦戈文脑科学研究院）；Chinese Institute for Brain Research (CIBR)（北京脑科学与类脑研究中心）
A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
Singapore Management University（新加坡管理大学）；China University of Mining and Technology（中国矿业大学）；The University of Melbourne（墨尔本大学）；Anhui University（安徽大学）；Xi’an Jiaotong University（西安交通大学）；Sun Yat-sen University（中山大学）
Invisible Backdoor Attack against Self-supervised Learning
Zhejiang University（浙江大学）；Rutgers University（罗格斯大学）；Nanyang Technological University（南洋理工大学）；Nanjing University（南京大学）；New Jersey Institute of Technology（新泽西理工学院）；University of Massachusetts Amherst（马萨诸塞大学阿默斯特分校）
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
University of Maryland（马里兰大学）；Massachussetts Institute of Technology（麻省理工学院）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；University of California, Berkeley（加利福尼亚大学伯克利分校）
RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance
Old Dominion University（旧 Dominion 大学）；University of Texas at El Paso（德克萨斯大学埃尔帕索分校）；University of Central Florida（中央佛罗里达大学）；Iowa State University（爱荷华州立大学）；University of Arizona（亚利桑那大学）
Is It Possible to Backdoor Face Forgery Detection with Natural Triggers?
School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；CRIPAC & MAIS, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所模式识别国家重点实验室与多模态人工智能系统实验室）；Nanjing University of Information Science and Technology（南京信息工程大学）
Leiden University（莱顿大学）；Radboud University（拉德堡德大学）；IBM Research（IBM研究院）；University of Zagreb Faculty of Electrical Engineering and Computing（Zagreb大学电子工程与计算学院）
