Machine Learning (ML) has automated a multitude of our day-to-day decision
making domains such as education, employment and driving automation. The
continued success of ML largely depends on our ability to trust the model we
are using. Recently, a new class of attacks called Backdoor Attacks have been
developed. These attacks undermine the user's trust in ML models. In this work,
we present NEO, a model agnostic framework to detect and mitigate such backdoor
attacks in image classification ML models. For a given image classification
model, our approach analyses the inputs it receives and determines if the model
is backdoored. In addition to this feature, we also mitigate these attacks by
determining the correct predictions of the poisoned images. An appealing
feature of NEO is that it can, for the first time, isolate and reconstruct the
backdoor trigger. NEO is also the first defence methodology, to the best of our
knowledge that is completely blackbox.
We have implemented NEO and evaluated it against three state of the art
poisoned models. These models include highly critical applications such as
traffic sign detection (USTS) and facial detection. In our evaluation, we show
that NEO can detect $\approx$88% of the poisoned inputs on average and it is as
fast as 4.4 ms per input image. We also reconstruct the poisoned input for the
user to effectively test their systems.

该论文提出了一个名为 NEO 的模型无关框架，用于检测和缓解图像分类机器学习模型中的后门攻击，并评估了其在三种被污染的模型中的表现。

机器学习中不依赖特定模型的防御后门攻击方法

Model Agnostic Defence against Backdoor Attacks in Machine Learning

We propose a new conflict-driven program synthesis technique that is capable
of learning from past mistakes. Given a spurious program that violates the
desired specification, our synthesis algorithm identifies the root cause of the
conflict and learns new lemmas that can prevent similar mistakes in the future.
Specifically, we introduce the notion of equivalence modulo conflict and show
how this idea can be used to learn useful lemmas that allow the synthesizer to
prune large parts of the search space. We have implemented a general-purpose
CDCL-style program synthesizer called Neo and evaluate it in two different
application domains, namely data wrangling in R and functional programming over
lists. Our experiments demonstrate the substantial benefits of conflict-driven
learning and show that Neo outperforms two state-of-the-art synthesis tools,
Morpheus and Deepcoder, that target these respective domains.

该研究提出一种新的冲突驱动程序合成技术，并介绍了冲突的等价性模块以及学习如何规避类似问题的可用引理，该技术的性能实验证明优于两个针对数据整理和函数式编程的最先进的合成工具。