[Paper Review] Backdoor Defense via Adaptively Splitting Poisoned Dataset

Kuofeng Gao, Yang Bai+3 more|arXiv (Cornell University)|Mar 23, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Adaptive Splitting Defense (ASD), a novel training-time backdoor defense that adaptively splits a poisoned dataset into clean and polluted data pools using loss-guided and meta-learning-inspired splitting. ASD achieves state-of-the-art robustness against six SOTA backdoor attacks while preserving high clean accuracy across multiple benchmarks, outperforming existing methods in both defense effectiveness and efficiency.

ABSTRACT

Backdoor defenses have been studied to alleviate the threat of deep neural networks (DNNs) being backdoor attacked and thus maliciously altered. Since DNNs usually adopt some external training data from an untrusted third party, a robust backdoor defense strategy during the training stage is of importance. We argue that the core of training-time defense is to select poisoned samples and to handle them properly. In this work, we summarize the training-time defenses from a unified framework as splitting the poisoned dataset into two data pools. Under our framework, we propose an adaptively splitting dataset-based defense (ASD). Concretely, we apply loss-guided split and meta-learning-inspired split to dynamically update two data pools. With the split clean data pool and polluted data pool, ASD successfully defends against backdoor attacks during training. Extensive experiments on multiple benchmark datasets and DNN models against six state-of-the-art backdoor attacks demonstrate the superiority of our ASD. Our code is available at https://github.com/KuofengGao/ASD.

Motivation & Objective

• To address the critical challenge of backdoor attacks in deep neural networks trained on untrusted third-party data.
• To improve upon existing training-time defenses by enabling adaptive, dynamic splitting of poisoned datasets into clean and polluted pools.
• To reduce the risk of poisoning contamination and preserve model performance by leveraging semi-supervised learning on split data pools.
• To develop a fast, end-to-end defense that avoids costly retraining and minimizes backdoor leakage during training.
• To demonstrate superior robustness against diverse backdoor attacks while maintaining high clean accuracy across multiple datasets and models.

Proposed method

• Proposes a unified framework for training-time backdoor defense by splitting the poisoned dataset into two pools: clean (labeled) and polluted (unlabeled).
• Introduces a fast, loss-guided splitting method to initialize the data pools based on sample loss magnitudes.
• Develops a novel meta-learning-inspired splitting (meta-split) technique to better identify and isolate clean hard samples from poisoned ones.
• Employs semi-supervised learning on the two split pools: supervised training on the clean pool and self-training on the polluted pool to preserve semantic features.
• Uses only 10 clean seed samples per class for initialization, enabling transfer-based extension and reducing reliance on large clean data.
• Adapts pool composition dynamically during training through both loss-guided and meta-split updates to improve separation and robustness.

Experimental results

Research questions

• RQ1 Can a unified framework for training-time backdoor defense be established by splitting poisoned datasets into clean and polluted pools?
• RQ2 How can clean hard samples—difficult to distinguish by loss alone—be effectively separated from poisoned samples?
• RQ3 Can adaptive splitting strategies improve defense robustness while maintaining high clean accuracy?
• RQ4 How does the proposed ASD method compare to existing defenses like ABL and DBD in terms of accuracy and attack success rate?
• RQ5 Can the defense be implemented efficiently and end-to-end without requiring expensive retraining or prior knowledge of clean data?

Key findings

• ASD achieves state-of-the-art defense performance across six SOTA backdoor attacks on CIFAR-10, GTSRB, ImageNet, and VGGFace2.
• On CIFAR-10, ASD maintains 93.8% clean accuracy against BadNets and 90.9% against Blend, significantly outperforming ABL and DBD.
• Against WaNet on VGGFace2, ASD achieves 53.0% clean accuracy and only 3.1% ASR, demonstrating strong robustness.
• The meta-split component successfully separates clean hard samples from poisoned ones, as shown in loss distribution comparisons with ABL and DBD.
• ASD reduces the risk of backdoor leakage by avoiding direct unlearning and instead using semi-supervised learning on the polluted pool.
• The defense is efficient and scalable, requiring only 10 clean seed samples per class, making it practical for real-world deployment.