DLP:towards active defense against backdoor attacks with decoupled learning process  

作　　者：Zonghao Ying Bin Wu 

机构地区：[1]State Key Laboratory of Information Security,Institute of Information Engineering,Chinese Academy of Sciences,Beijing,China [2]School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China

出　　处：《Cybersecurity》2024年第1期122-134,共13页网络空间安全科学与技术（英文）

基　　金：supported by the National Nature Science Foundation of China under Grant No.62272007;National Nature Science Foundation of China under Grant No.U1936119;Major Technology Program of Hainan,China(ZDKJ2019003)。

摘　　要：Deep learning models are well known to be susceptible to backdoor attack,where the attacker only needs to provide a tampered dataset on which the triggers are injected.Models trained on the dataset will passively implant the backdoor,and triggers on the input can mislead the models during testing.Our study shows that the model shows different learning behaviors in clean and poisoned subsets during training.Based on this observation,we propose a general training pipeline to defend against backdoor attacks actively.Benign models can be trained from the unreli-able dataset by decoupling the learning process into three stages,i.e.,supervised learning,active unlearning,and active semi-supervised fine-tuning.The effectiveness of our approach has been shown in numerous experiments across various backdoor attacks and datasets.

关 键 词：Deep learning Backdoor attack Active defense 

分 类 号：TP393.081[自动化与计算机技术—计算机应用技术]