Recently, self-supervised learning (SSL) was shown to be vulnerable to
patch-based data poisoning backdoor attacks. It was shown that an adversary can
poison a small part of the unlabeled data so that when a victim trains an SSL
model on it, the final model will have a backdoor that the adversary can
exploit. This work aims to defend self-supervised learning against such
attacks. We use a three-step defense pipeline, where we first train a model on
the poisoned data. In the second step, our proposed defense algorithm
(PatchSearch) uses the trained model to search the training data for poisoned
samples and removes them from the training set. In the third step, a final
model is trained on the cleaned-up training set. Our results show that
PatchSearch is an effective defense. As an example, it improves a model's
accuracy on images containing the trigger from 38.2% to 63.7% which is very
close to the clean model's accuracy, 64.6%. Moreover, we show that PatchSearch
outperforms baselines and state-of-the-art defense approaches including those
using additional clean, trusted data. Our code is available at
this https URL

本文研究针对自监督学习中的数据投毒后门攻击，提出了一种三步防御管道，其中包括使用训练模型搜索被毒害的样本并将其从训练集中移除的防御算法 PatchSearch。研究结果表明，PatchSearch 是一种有效的防御，其表现优于基线和最先进的防御方法（包括使用额外的干净、可靠数据的方法），可以将模型在包含触发器的图像上的准确性从 38.2% 提高到 63.7%，接近于干净模型的准确性 64.6%。