[Paper Review] Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencoder

Tong Sun, Lu Pang+3 more|arXiv (Cornell University)|Mar 27, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Blind Defense with Masked Autoencoder (BDMAE), a test-time defense for black-box models that detects and removes backdoor triggers without access to model weights or clean data. By leveraging masked autoencoder reconstruction in token space and refining trigger detection via structural similarity and label consistency, BDMAE purifies images on-the-fly, achieving high clean accuracy and low attack success rate across diverse triggers.

ABSTRACT

Deep neural networks are vulnerable to backdoor attacks, where an adversary manipulates the model behavior through overlaying images with special triggers. Existing backdoor defense methods often require accessing a few validation data and model parameters, which is impractical in many real-world applications, e.g., when the model is provided as a cloud service. In this paper, we address the practical task of blind backdoor defense at test time, in particular for local attacks and black-box models. The true label of every test image needs to be recovered on the fly from a suspicious model regardless of image benignity. We consider test-time image purification that incapacitates local triggers while keeping semantic contents intact. Due to diverse trigger patterns and sizes, the heuristic trigger search can be unscalable. We circumvent such barrier by leveraging the strong reconstruction power of generative models, and propose Blind Defense with Masked AutoEncoder (BDMAE). BDMAE detects possible local triggers using image structural similarity and label consistency between the test image and MAE restorations. The detection results are then refined by considering trigger topology. Finally, we fuse MAE restorations adaptively into a purified image for making prediction. Extensive experiments under different backdoor settings validate its effectiveness and generalizability.

Motivation & Objective

• Address the challenge of defending against backdoor attacks in real-world black-box scenarios where model parameters and clean data are unavailable.
• Develop a test-time defense that operates on-the-fly without modifying the model, ensuring practical deployment in cloud services.
• Enable trigger detection and image purification without prior knowledge of trigger patterns, sizes, or model architecture.
• Maintain high accuracy on clean images while effectively neutralizing backdoor triggers of various complexities.
• Generalize across diverse trigger types and image distributions without retraining or access to validation data.

Proposed method

• Use masked autoencoders (MAE) to reconstruct masked image patches, leveraging their strong generative capability to detect anomalies in the token space.
• Compute two trigger scores per patch: one based on image structural similarity between input and MAE restoration, and another based on label prediction consistency between input and restored image.
• Refine trigger scores using trigger topology awareness, generating topology-aware MAE masks that better cover suspected trigger regions.
• Adaptively fuse multiple MAE restorations using thresholded trigger scores to produce a purified image for final prediction.
• Iteratively refine scores and masks through feedback between detection and restoration to improve precision in trigger localization.
• Operate entirely in a blind setting—no access to model parameters, clean data, or ground-truth labels is required.

Experimental results

Research questions

• RQ1 Can a test-time defense be effective for black-box models without access to model parameters or clean data?
• RQ2 Can masked autoencoders be used to detect diverse backdoor triggers in the token space without prior knowledge of trigger patterns?
• RQ3 How can structural similarity and label consistency between original and restored images be leveraged to improve trigger detection?
• RQ4 Can topology-aware refinement of trigger scores enhance detection accuracy and reduce false positives?
• RQ5 Does adaptive fusion of multiple MAE restorations improve robustness and preserve semantic content in purified images?

Key findings

• BDMAE achieves a clean accuracy (CA) of 76.4% and backdoor accuracy (BA) of 78.7% on ImageNet100 with large triggers, significantly outperforming PatchCleanser and other baselines.
• For 1×1-color triggers, BDMAE maintains a CA of 73.2% and BA of 76.3%, demonstrating strong generalization across trigger types.
• On the most challenging large-trigger settings, BDMAE reduces attack success rate (ASR) to 0.2% while preserving 76.4% clean accuracy, indicating high robustness.
• The method achieves near-zero ASR (0.1–0.2%) across all trigger types and sizes, even under strong data transformations like blur and shrink-pad.
• BDMAE maintains high performance across diverse datasets and trigger patterns, showing strong generalization without retraining or data access.
• The adaptive fusion of multiple MAE restorations with thresholded scores leads to superior image purification, preserving semantics while removing triggers.