Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data
Technical University of Darmstadt（达姆施塔特工业大学）；Centre for Cognitive Science（认知科学中心）；German Research Center for Artificial Intelligence (DFKI)（德国人工智能研究中心（DFKI））；Hessian Center for AI (hessian.AI)（黑森人工智能中心（hessian.AI））
Lukas Struppek, Martin B. Hentschel, Clifton Poth, Dominik Hintersdorf, Kristian Kersting
备注：
Published at NeurIPS 2023 Workshop on Backdoors in Deep Learning: The Good, the Bad, and the Ugly
Backdoor attacks pose a serious security threat for training neural networks as they surreptitiously introduce hidden functionalities into a model. Such backdoors remain silent during inference on clean inputs, evading detection due to inconspicuous behavior. However, once a specific trigger pattern appears in the input data, the backdoor activates, causing the model to execute its concealed function. Detecting such poisoned samples within vast datasets is virtually impossible through manual inspection. To address this challenge, we propose a novel approach that enables model training on potentially poisoned datasets by utilizing the power of recent diffusion models. Specifically, we create synthetic variations of all training samples, leveraging the inherent resilience of diffusion models to potential trigger patterns in the data. By combining this generative approach with knowledge distillation, we produce student models that maintain their general performance on the task while exhibiting robust resistance to backdoor triggers.
A Tale of Evil Twins: Adversarial Inputs versus Poisoned Models
Pennsylvania State University（宾夕法尼亚州立大学）；Zhejiang University（浙江大学）；Ant Financial（蚂蚁金服）；Washington University in St. Louis（圣路易斯华盛顿大学）；Hong Kong Polytechnic University（香港理工大学）；Ant Financia（蚂蚁金服）
Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning
Nanyang Technological University（南洋理工大学）；Hong Kong University of Science and Technology（香港科技大学）；Jinan University（暨南大学）；Sony Research（索尼研究院）；Zhejiang University（浙江大学）；Beijing Institute of Technology（北京理工大学）
CSC: Turning the Adversary's Poison against Itself
Faculty of Data Science, City University of Macau, Taipa, Macau（数据科学学院，澳门城市大学，氹仔，澳门）；Faculty of Engineering and Information Technology, University of Technology Sydney, New South Wales, Australia（工程与信息技术学院，悉尼科技大学，新南威尔士州，澳大利亚）；Information Technology, University of Technology Sydney, New South Wales, Australia（信息技术，悉尼科技大学，新南威尔士州，澳大利亚）
Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
University of Alberta（阿尔伯塔大学）；Michigan State University（密歇根州立大学）；Illinois Institute of Technology（伊利诺伊理工学院）；DSO National Laboratories（新加坡国防科技局国家实验室）；MIT-IBM Watson AI Lab, IBM Research（IBM研究院MIT-IBM沃森人工智能实验室）
DBIA: Data-free Backdoor Injection Attack against Transformer Networks
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Boston University（波士顿大学）
Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models
University of Maryland, College Park（马里兰大学帕克分校）；University of Illinois Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Salesforce Research（Salesforce研究院）；Apple（苹果公司）；Netflix（网飞公司）；Eyeline Studios（Eyeline工作室）；University of Waterloo（滑铁卢大学）
Shortcuts Arising from Contrast: Effective and Covert Clean-Label Attacks in Prompt-Based Learning
School of Electronic Engineering（电子工程学院）；Beijing University of Posts and Telecommunications（北京邮电大学）；Centre for Frontier AI Research (CFAR)（前沿人工智能研究中心）；Institute of High Performance Computing (IHPC)（高性能计算研究所）；Agency for Science Technology and Research (A*STAR)（新加坡科技研究局）；School of Information and Communication（信息与通信学院）
Towards Understanding How Self-training Tolerates Data Backdoor Poisoning
University of Alberta（阿尔伯塔大学）；Illinois Institute of Technology（伊利诺伊理工学院）；Michigan State University（密歇根州立大学）
最近对模型训练中的后门攻击的研究表明，污染一小部分训练数据就足以在中毒的测试时间数据上产生不正确的操纵预测，同时在下游任务中保持高的干净精度。后门攻击的隐蔽性给当今的机器学习范式带来了巨大的防御挑战。在本文中，我们探索了通过额外的未标记数据进行自我训练以减轻后门攻击的潜力。我们首先进行了一项试点研究，以表明香草自我训练在后门缓解中无效。受此启发，我们建议通过在自训练伪标签阶段利用强大但适当的数据增强来防御后门攻击。我们发现，新的自我训练机制在很大程度上有助于抵御后门攻击。通过在CIFAR-10和CIFAR-10与额外的未标记的500 K TinyImages数据集的组合上针对不同后门触发器的实验，证明了其有效性。最后，我们探索了将自我监督表示学习与自我训练相结合的方向，以进一步改进后门防御。
