RTS: A Training-time Backdoor Defense Strategy Based on Weight Residual Tendency

The backdoor attack, caused by malicious samples in the training dataset, has been proven to be a significant threat to the security of deep learning models. The victim model would perform wrongly to the inputs with the trigger. When deployed models in sensitive domains such as facial recognition or autonomous vehicles, the backdoor could lead to potentially disastrous outcomes, like passing the authentication mechanisms and causing traffic accidents. Most of the previous defense works first train the model on the suspicious training dataset and then filter suspicious samples by focusing on the different features in the representation vectors of inputs. The model must be retrained on the filtered training dataset to clear the potential backdoor, bringing in inconvenience and extra computation overhead. This work proposes a training-time sample filtering defense scheme named RTS, with which the model would only be trained once and the potential backdoor could be defended. A pivotal observation is that the target label samples contain richer backdoor-related information compared to other samples, which would result in more adjustments in the model’s weights. Therefore, we filter the poison data with an adaption strategy based on the model’s weight residual tendency in the training process. After all training iterations, we can filter all suspicious samples and obtain a benign model.To demonstrate the effectiveness of the RTS, we conduct experiments on 4 image classification datasets with different model structures at 3 different poison rates (0.01, 0.05, 0.1). Taking the poison rate of 0.05 as an example, the attack success rates on them are decreased to 6.53% (MNIST), 11.88% (CIFAR10), 36.17% (GTSRB), and 12.14% (STL10), while the accuracies of them achieve 96.92% (MNIST), 80.27% (CIFAR10), 83.05% (GTSRB), and 74.9% (STL10). We also find that the effectiveness would not be affected by the target label and suggest the value of σ be in (0.1, 0.4]. About 1% of the training data would be enough for the shadow dataset to decrease the ASR to lower than 20% robustly. These above ablation experiments demonstrate the robustness of RTS.