Distilling Cognitive Backdoor Patterns within an Image
Keywords: Backdoor sample detection, Backdoor defence
TL;DR: A novel method effectively and robustly detect backdoor samples in the dataset.
Abstract: This paper proposes a simple method to distill and detect backdoor patterns within an image: \emph{Cognitive Distillation} (CD). The idea is to extract the ``minimal essence" from an input image responsible for the model's prediction. CD optimizes an input mask to extract a small pattern from the input image that can lead to the same model output (i.e., logits or deep features). The extracted pattern can help understand the cognitive mechanism of a model on clean vs. backdoor images and is thus called a \emph{Cognitive Pattern} (CP). Using CD and the distilled CPs, we uncover an interesting phenomenon of backdoor attacks: despite the various forms and sizes of trigger patterns used by different attacks, the CPs of backdoor samples are all surprisingly and suspiciously small.
One thus can leverage the learned mask to detect and remove backdoor examples from poisoned training datasets.
We conduct extensive experiments to show that CD can robustly detect a wide range of advanced backdoor attacks.
We also show that CD can potentially be applied to help detect potential biases from face datasets.
Code is available at https://github.com/HanxunH/CognitiveDistillation.
Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.
Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics
Submission Guidelines: Yes
Please Choose The Closest Area That Your Submission Falls Into: Deep Learning and representational learning
Supplementary Material: zip
Community Implementations: [ 1 code implementation](https://www.catalyzex.com/paper/arxiv:2301.10908/code)
23 Replies
Loading