[Paper Review] SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics

Jonathan Hayase, Weihao Kong+2 more|arXiv (Cornell University)|Apr 22, 2021

Adversarial Robustness in Machine Learning51 references12 citations

TL;DR

SPECTRE proposes a robust defense against backdoor attacks by amplifying the spectral signature of poisoned data using robust covariance estimation and whitening, enabling effective detection and removal of backdoors even in low-poison regimes where prior methods fail. It achieves complete backdoor removal across diverse attack types, significantly outperforming state-of-the-art defenses.

ABSTRACT

Modern machine learning increasingly requires training on a large collection of data from multiple sources, not all of which can be trusted. A particularly concerning scenario is when a small fraction of poisoned data changes the behavior of the trained model when triggered by an attacker-specified watermark. Such a compromised model will be deployed unnoticed as the model is accurate otherwise. There have been promising attempts to use the intermediate representations of such a model to separate corrupted examples from clean ones. However, these defenses work only when a certain spectral signature of the poisoned examples is large enough for detection. There is a wide range of attacks that cannot be protected against by the existing defenses. We propose a novel defense algorithm using robust covariance estimation to amplify the spectral signature of corrupted data. This defense provides a clean model, completely removing the backdoor, even in regimes where previous methods have no hope of detecting the poisoned examples. Code and pre-trained models are available at https://github.com/SewoongLab/spectre-defense .

Motivation & Objective

• To address the critical gap in existing defenses that fail when only a small number of data points are poisoned.
• To improve detection of backdoor examples in scenarios where spectral signatures are weak or misaligned with principal components.
• To develop a robust, general-purpose defense that works across diverse backdoor attack types and strengths.
• To ensure complete removal of backdoors without compromising clean data accuracy.

Proposed method

• Estimate the mean and covariance of clean data using robust statistical estimators to reduce contamination from poisoned examples.
• Whiten the intermediate representations of training data using the robustly estimated covariance to amplify the spectral differences between clean and poisoned samples.
• Apply robust PCA to the whitened representations to identify the top principal component aligned with the direction separating poisoned from clean data.
• Use a novel outlier scoring method, QUantum Entropy (QUE), to rank samples based on their deviation from the clean subspace.
• Remove the top-ranked samples (those with highest QUE scores) to filter out poisoned data before retraining.
• Retrain the model on the filtered data to produce a clean, backdoor-free model.

Experimental results

Research questions

• RQ1 Can robust covariance estimation effectively amplify the spectral signature of poisoned data in low-poison regimes?
• RQ2 Does robust whitening improve the alignment of the top PCA direction with the true separation between clean and poisoned data?
• RQ3 Can a single defense framework generalize across diverse backdoor attack types and strengths?
• RQ4 How does the choice of outlier scoring method affect detection performance in varying attack conditions?
• RQ5 To what extent does SPECTRE outperform existing defenses in terms of backdoor removal and clean accuracy?

Key findings

• SPECTRE successfully removes backdoors in all tested regimes, including those where prior defenses like PCA fail (e.g., 125 poisoned examples in CIFAR-10).
• The defense achieves 0% attack accuracy after retraining, indicating complete backdoor removal, even when the number of poisoned samples is as low as 64.
• Robust whitening significantly improves the alignment of the top PCA direction with the true data separation, enabling reliable detection.
• QUE outlier scoring outperforms standard squared norm and projected norm scoring across diverse attack types, including 1-way and 3-way pixel attacks.
• Ablation studies confirm that each component—robust estimation, whitening, and QUE scoring—is essential for the defense’s success.
• The method is robust to variations in the number of samples removed, maintaining high performance across different removal thresholds.