Countering Backdoor Attacks in Image Recognition: A Survey and Evaluation of Mitigation Strategies

TL;DR

This paper surveys and benchmarks various mitigation strategies against backdoor attacks in image recognition, revealing that many methods offer limited protection and highlighting the need for more effective defenses.

Contribution

It provides a comprehensive review and extensive benchmarking of 16 mitigation approaches against 8 backdoor attacks, analyzing their effectiveness and limitations.

Findings

Many mitigation methods offer limited protection.

Most newer approaches do not outperform seminal methods.

Performance varies significantly across different settings.

Abstract

The widespread adoption of deep learning across various industries has introduced substantial challenges, particularly in terms of model explainability and security. The inherent complexity of deep learning models, while contributing to their effectiveness, also renders them susceptible to adversarial attacks. Among these, backdoor attacks are especially concerning, as they involve surreptitiously embedding specific triggers within training data, causing the model to exhibit aberrant behavior when presented with input containing the triggers. Such attacks often exploit vulnerabilities in outsourced processes, compromising model integrity without affecting performance on clean (trigger-free) input data. In this paper, we present a comprehensive review of existing mitigation strategies designed to counter backdoor attacks in image recognition. We provide an in-depth analysis of the theoretical foundations, practical efficacy, and limitations of these approaches. In addition, we conduct an extensive benchmarking of sixteen state-of-the-art approaches against eight distinct backdoor attacks, utilizing three datasets, four model architectures, and three poisoning ratios. Our results, derived from 122,236 individual experiments, indicate that while many approaches provide some level of protection, their performance can vary considerably. Furthermore, when compared to two seminal approaches, most newer approaches do not demonstrate substantial improvements in overall performance or consistency across diverse settings. Drawing from these findings, we propose potential directions for developing more effective and generalizable defensive mechanisms in the future.