Deep Neural Networks (DNNs) are susceptible to backdoor attacks during training. The model corrupted in this way functions normally, but when triggered by certain patterns in the input, produces a predefined target label. Existing defenses usually rely on the assumption of the universal backdoor setting in which poisoned samples share the same uniform trigger. However, recent advanced backdoor attacks show that this assumption is no longer valid in dynamic backdoors where the triggers vary from input to input, thereby defeating the existing defenses. In this work, we propose a novel technique, Beatrix (backdoor detection via Gram matrix). Beatrix utilizes Gram matrix to capture not only the feature correlations but also the appropriately high-order information of the representations. By learning class-conditional statistics from activation patterns of normal samples, Beatrix can identify poisoned samples by capturing the anomalies in activation patterns. To further improve the performance in identifying target labels, Beatrix leverages kernel-based testing without making any prior assumptions on representation distribution. We demonstrate the effectiveness of our method through extensive evaluation and comparison with state-of-the-art defensive techniques. The experimental results show that our approach achieves an F1 score of 91.1% in detecting dynamic backdoors, while the state of the art can only reach 36.9%.

本研究提出了一种新的技术，Beatrix（基于 Gram 矩阵的后门检测），利用 Gram 矩阵来捕捉特征相关性和适当的高阶信息，通过学习正常样本的激活模式来捕捉异常来识别被污染的样本，进一步提高了识别目标标签的性能，实验结果表明，我们的方法在检测动态后门方面达到了91.1%的F1得分，而现有技术只能达到36.9%。

通过 Gram 矩阵实现强韧性后门检测的 "Beatrix" 复活