BAN: Detecting Backdoors Activated by Adversarial Neuron Noise

TL;DR

This paper introduces BAN, a novel backdoor detection method that enhances feature inversion by leveraging adversarial neuron activation, resulting in more efficient and accurate detection of backdoored models.

Contribution

BAN improves backdoor feature inversion by incorporating adversarial neuron activation, reducing computational overhead and increasing detection accuracy over existing methods.

Findings

BAN is 1.37x more efficient on CIFAR-10

BAN is 5.11x more efficient on ImageNet200

BAN achieves 9.99% higher detection success rate

Abstract

Backdoor attacks on deep learning represent a recent threat that has gained significant attention in the research community. Backdoor defenses are mainly based on backdoor inversion, which has been shown to be generic, model-agnostic, and applicable to practical threat scenarios. State-of-the-art backdoor inversion recovers a mask in the feature space to locate prominent backdoor features, where benign and backdoor features can be disentangled. However, it suffers from high computational overhead, and we also find that it overly relies on prominent backdoor features that are highly distinguishable from benign features. To tackle these shortcomings, this paper improves backdoor feature inversion for backdoor detection by incorporating extra neuron activation information. In particular, we adversarially increase the loss of backdoored models with respect to weights to activate the backdoor effect, based on which we can easily differentiate backdoored and clean models. Experimental results demonstrate our defense, BAN, is 1.37$\times$ (on CIFAR-10) and 5.11$\times$ (on ImageNet200) more efficient with an average 9.99\% higher detect success rate than the state-of-the-art defense BTI-DBF. Our code and trained models are publicly available at~\url{https://github.com/xiaoyunxxy/ban}.