Partially training, isolating and unlearning, mitigating backdoor attack

Neural networks are widely known to be vulnerable to backdoor attacks, witch are full of threats, a method that poisons a portion of the training data to make the target model perform well on normal data sets, while outputting attacker-specified or random categories on the poisoned samples. Nowadays, poisoned samples are becoming more and more similar to corresponding normal samples, even the human eye cannot easily distinguish them and the accuracy of models carrying backdoors on normal samples is no different from that of clean models witch also leads to the inability to determine whether a model carries a backdoor based on its accuracy. In this article, by observing the characteristics of backdoor attacks, We provide a new model training method, Partial Training(PT), that freezes part of the model to train a model that can isolate suspicious samples. Then, on this basis, a clean model is fine-tune to resist backdoor attacks. We used three datasets and four backdoor attack methods to conduct our experiments. The experiments showed that PT performed very well in defending against backdoor attacks mentioned above.