REFINE: Inversion-Free Backdoor Defense via Model Reprogramming

TL;DR

REFINE introduces an inversion-free backdoor defense leveraging model reprogramming, combining input transformation and output remapping with contrastive loss to effectively neutralize backdoors without trigger inversion.

Contribution

This work presents a novel inversion-free backdoor defense method called REFINE that uses model reprogramming, improving robustness and utility over existing input transformation and trigger inversion techniques.

Findings

Effective backdoor mitigation demonstrated on benchmark datasets.

Resistant to adaptive backdoor attacks.

Maintains high model utility while defending against backdoors.

Abstract

Backdoor attacks on deep neural networks (DNNs) have emerged as a significant security threat, allowing adversaries to implant hidden malicious behaviors during the model training phase. Pre-processing-based defense, which is one of the most important defense paradigms, typically focuses on input transformations or backdoor trigger inversion (BTI) to deactivate or eliminate embedded backdoor triggers during the inference process. However, these methods suffer from inherent limitations: transformation-based defenses often fail to balance model utility and defense performance, while BTI-based defenses struggle to accurately reconstruct trigger patterns without prior knowledge. In this paper, we propose REFINE, an inversion-free backdoor defense method based on model reprogramming. REFINE consists of two key components: \textbf{(1)} an input transformation module that disrupts both benign and backdoor patterns, generating new benign features; and \textbf{(2)} an output remapping module that redefines the model's output domain to guide the input transformations effectively. By further integrating supervised contrastive loss, REFINE enhances the defense capabilities while maintaining model utility. Extensive experiments on various benchmark datasets demonstrate the effectiveness of our REFINE and its resistance to potential adaptive attacks.