Defending Against Backdoor Attacks Using Ensembles of Weak Learners

Charles Jin, Melinda Sun, Martin Rinard

Keywords: data poisoning

Abstract: A recent line of work has shown that deep networks are susceptible to backdoor data poisoning attacks. Specifically, by injecting a small amount of malicious data into the training distribution, an adversary gains the ability to control the behavior of the model during inference. We propose an iterative training procedure for removing poisoned data from the training set. Our approach consists of two steps. We first train an ensemble of weak learners to automatically discover distinct subpopulations in the training set. We then leverage a boosting framework to exclude the poisoned data and recover the clean data. Our algorithm is based on a novel bootstrapped measure of generalization, which provably separates the clean from the dirty data under mild assumptions. Empirically, our method successfully defends against a state-of-the-art dirty label backdoor attack. We find that our approach significantly outperforms previous defenses.

One-sentence Summary: We present a defense against data poisoning based on novel theoretical concepts, and obtain state of the art performance against a strong dirty label backdoor adversary.