Abstract
We propose a novel algorithm, Salient Conditional Diffusion (Sancdifi), a state-of-the-art defense against backdoor attacks. Sancdifi uses a denoising diffusion probabilistic model (DDPM) to degrade an image with noise and then recover said image using the learned reverse diffusion. Critically, we compute saliency map-based masks to condition our diffusion, allowing for stronger diffusion on the most salient pixels by the DDPM. As a result, Sancdifi is highly effective at diffusing out triggers in data poisoned by backdoor attacks. At the same time, it reliably recovers salient features when applied to clean data. This performance is achieved without requiring access to the model parameters of the Trojan network, meaning Sancdifi operates as a black-box defense.
Abstract (translated)
我们提出了一种新算法,即显著条件扩散算法(Sancdifi),这是一种先进的防御措施,抵御插入式攻击。Sancdifi使用一种去噪扩散概率模型(DDPM)来降低带有噪声的图像,然后使用学习到的逆扩散算法来恢复该图像。重要的是,我们计算基于显著性映射的掩膜来Condition我们的扩散,使DDPM能够在最显著像素上执行更强的扩散。因此,Sancdifi能够有效地从数据被插入式攻击所毒化中 diffusion out触发器。同时,它在清洁数据中的应用中可靠地恢复显著特征。这无需访问木马网络模型参数,因此Sancdifi作为一个黑盒防御运行。
URL
https://arxiv.org/abs/2301.13862
