[Paper Review] IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency

Linshan Hou, Ruili Feng+4 more|arXiv (Cornell University)|May 16, 2024

Medical Imaging Techniques and ApplicationsMedicine3 citations

TL;DR

This paper proposes IBD-PSC, a novel input-level backdoor detection method that exploits parameter-oriented scaling consistency (PSC) in batch normalization layers to detect poisoned inputs. By scaling BN parameters and measuring prediction confidence stability, IBD-PSC identifies malicious samples with high accuracy and efficiency, outperforming prior methods like SCALE-UP, especially on images with extreme pixel values, and demonstrates strong resistance to adaptive attacks on benchmark datasets.

ABSTRACT

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where adversaries can maliciously trigger model misclassifications by implanting a hidden backdoor during model training. This paper proposes a simple yet effective input-level backdoor detection (dubbed IBD-PSC) as a `firewall' to filter out malicious testing images. Our method is motivated by an intriguing phenomenon, i.e., parameter-oriented scaling consistency (PSC), where the prediction confidences of poisoned samples are significantly more consistent than those of benign ones when amplifying model parameters. In particular, we provide theoretical analysis to safeguard the foundations of the PSC phenomenon. We also design an adaptive method to select BN layers to scale up for effective detection. Extensive experiments are conducted on benchmark datasets, verifying the effectiveness and efficiency of our IBD-PSC method and its resistance to adaptive attacks. Codes are available at \href{https://github.com/THUYimingLi/BackdoorBox}{BackdoorBox}.

Motivation & Objective

• To address the limitations of existing input-level backdoor detection methods, particularly their failure on benign samples with extreme pixel values (e.g., black/white pixels).
• To identify a new, robust detection signal that is independent of pixel value constraints by leveraging model parameter scaling.
• To develop a practical, efficient, and effective detection framework suitable for real-time inference in third-party model deployments.
• To theoretically justify the observed parameter-oriented scaling consistency (PSC) phenomenon in poisoned vs. benign samples.
• To evaluate the method’s robustness against diverse backdoor attacks and adaptive evasion strategies.

Proposed method

• The method detects backdoors by scaling the running statistics of batch normalization (BN) layers in the deployed model, starting from the final layer and progressively increasing the number of scaled layers.
• For each suspicious input, IBD-PSC computes a PSC score as the average prediction confidence across multiple parameter-scaled model versions on the label predicted by the original model.
• A higher PSC score indicates greater consistency in predictions across scaled models, signaling a higher likelihood of the input being poisoned.
• An adaptive algorithm selects the optimal number of BN layers to scale by evaluating the impact on benign sample performance, ensuring detection sensitivity without degrading normal inference.
• The method is designed to be memory-efficient, requiring only one copy of the original model and generating scaled models on-the-fly during inference.
• Theoretical analysis proves that under standard learning assumptions, scaling BN parameters can always expose latent backdoors, ensuring the PSC phenomenon is not accidental.

Experimental results

Research questions

• RQ1 Can parameter scaling in batch normalization layers reveal a consistent detection signal for backdoored inputs that is robust to pixel value limitations?
• RQ2 Is there a theoretical foundation that guarantees the existence of a scaling factor that exposes backdoors in any attacked model?
• RQ3 Can an adaptive layer selection strategy improve detection performance while minimizing computational overhead?
• RQ4 How does IBD-PSC perform against a wide range of backdoor attacks, including adaptive and sophisticated ones?
• RQ5 Can IBD-PSC be effectively applied to detect poisoned samples in the training data, not just during inference?

Key findings

• IBD-PSC achieves 100% true positive rate (TPR) and near 100% AUROC in detecting poisoned training samples across multiple attacks, with a false positive rate (FPR) close to 0%.
• The method significantly outperforms SCALE-UP on images with extreme pixel values, such as black and white pixels, where SCALE-UP fails due to pixel saturation during amplification.
• IBD-PSC maintains high detection performance across 13 representative backdoor attacks, demonstrating strong resistance to adaptive evasion techniques.
• Theoretical analysis confirms that a scaling factor exists to expose backdoors in any attacked model under standard assumptions in learning theory.
• When applied to training data, IBD-PSC successfully identifies and filters poisoned samples, reducing the attack success rate (ASR) of retrained models to less than 0.5% on CIFAR-10.
• The method is effective in real-time inference scenarios, functioning as a lightweight firewall for third-party models without requiring retraining or access to the original training data.