Prototype-Guided Robust Learning against Backdoor Attacks

1. Problem Statement

Backdoor attacks compromise Deep Neural Networks (DNNs) by poisoning the training dataset. The resulting model behaves normally on clean inputs but misclassifies inputs containing a specific "trigger" pattern into an attacker-chosen target class.

• The Challenge: Defending against these attacks is difficult, particularly when the defender has limited access to clean data (only a small validation set).
• Limitations of Existing Defenses: Current robust learning methods rely on restrictive assumptions that fail in specific scenarios:
  • Group G1 (Early-Backdoor-Learning): Assumes poisoned samples are learned faster (lower loss) than benign ones. This fails against weak backdoors (e.g., small triggers, low poisoning ratios, or attacks using "cover samples" that confuse the model), where the model learns benign data first.
  • Group G2 (Low-Supervision/Self-Supervised): Assumes removing labels breaks the trigger-target association. This fails against clean-label attacks, where triggers are injected into genuine target-class samples, reinforcing the trigger-target link even without label corruption.
  • Hybrid Methods: Often inherit the weaknesses of both G1 and G2, failing against either weak corrupted-label attacks or clean-label attacks.

2. Methodology: Prototype-Guided Robust Learning (PGRL)

The authors propose PGRL, a defense framework that requires only a small set of verified benign samples (e.g., 10 per class) and integrates two complementary components during fine-tuning. The approach adapts based on the strength of the backdoor attack.

Core Components

1. Label Consistency Verification (LCV) – For Weak Backdoors:

   • Mechanism: Uses the current model to generate pseudo-labels for training samples based on their proximity to class prototypes (derived from the clean validation set).
   • Logic: In weak backdoor scenarios (with cover samples), the model learns benign features first. Consequently, the pseudo-labels for poisoned samples will likely differ from their original (poisoned) labels.
   • Action: Samples where the pseudo-label matches the original label are trusted; others are filtered out. This effectively removes poisoned samples that the model has not yet "learned" to associate with the trigger.
   • Technical Detail: To prevent pseudo-label collapse (where all samples map to one class), PGRL uses Optimal Transport (OT) to enforce a uniform distribution of pseudo-labels across classes, combining cosine similarity with dataset uniformity.

2. Feature Distance Estimation (FDE) – For Strong Backdoors:

   • Mechanism: Calculates a weight for each training sample based on its feature distance from the clean validation samples in the feature space (using a Multivariate Normal distribution).
   • Logic: In strong backdoor scenarios (no cover samples), poisoned samples are distinct outliers in the feature space compared to benign data.
   • Action: Samples far from the clean distribution receive negative weights, forcing the model to "unlearn" them. Samples close to the clean distribution receive positive weights.
   • Technical Detail: Feature dimensions are reduced via UMAP to avoid the curse of dimensionality. Weights are updated via momentum to ensure stability.

Workflow

The model is first warmed up on the clean validation set. During fine-tuning on the potentially poisoned dataset:

• LCV filters samples based on label consistency.
• FDE assigns weights to samples based on feature distance.
• The final loss function is a weighted cross-entropy, where samples with negative weights are actively unlearned.

3. Key Contributions

• Unified Defense Framework: PGRL is the first robust learning method to effectively defend against both strong backdoors (via FDE) and weak backdoors (via LCV), overcoming the "assumption gap" of previous methods.
• Prototype-Guided Mechanism: Introduces a novel use of class prototypes from a small clean validation set to guide both pseudo-labeling (LCV) and feature distance estimation (FDE).
• Optimal Transport Integration: Incorporates Optimal Transport into the pseudo-labeling process to ensure robustness against label collapse during early training stages.
• Minimal Clean Data Requirement: Achieves high robustness using only a tiny clean validation set (10 samples per class), making it practical for real-world scenarios where clean data is scarce.

4. Experimental Results

The authors evaluated PGRL against eight state-of-the-art defenses (including ABL, ASD, DBD, ESTI, etc.) across diverse datasets (CIFAR-10, ImageNette, Speech Commands) and architectures (ResNet, VGG, DenseNet, ViT).

• Effectiveness:
  • PGRL consistently achieved Accuracy (ACC) > 0.90 and Attack Success Rate (ASR) < 0.1 across all tested attacks (Pattern, AdapBlend, Freq, Ultrasonic, Wanet, Combat, Lotus).
  • In contrast, baseline defenses failed on at least one attack type, often resulting in ASR > 0.6.
  • Specifically, LCV excelled against cover-sample attacks (AdapBlend), while FDE excelled against non-cover-sample attacks (Pattern, Freq). The combination (PGRL) handled all cases.
• Efficiency:
  • PGRL incurred a 1.15× training time overhead compared to naive training. This is comparable to other defenses (e.g., ABL, ESTI) and significantly faster than methods like DBD (which uses SimCLR).
• Generalization:
  • The method proved robust across different model architectures (VGG16, DenseNet121, ViT-B-16) and against four additional advanced attacks (Ultrasonic, Wanet, Combat, Lotus).
• Ablation Studies:
  • Removing Optimal Transport caused performance to collapse (ASR jumped from 0.01 to 0.99), confirming its necessity for stable pseudo-labeling.
  • The method remained effective even with very small validation sets (down to 10 samples total).

5. Significance

This paper establishes a new standard for practical and generalizable backdoor defense. By moving away from rigid assumptions about attack strength or label corruption, PGRL provides a flexible, single-framework solution that adapts to the specific characteristics of the poisoning. Its ability to function with minimal clean data makes it highly deployable in real-world scenarios where data sanitization is difficult. The authors also outline future work to extend this framework to complex tasks like object detection, segmentation, and Large Language Models (LLMs).