Data-poisoning backdoor attacks are serious security threats to machine
learning models, where an adversary can manipulate the training dataset to
inject backdoors into models. In this paper, we focus on in-training backdoor
defense, aiming to train a clean model even when the dataset may be potentially
poisoned. Unlike most existing methods that primarily detect and remove/unlearn
suspicious samples to mitigate malicious backdoor attacks, we propose a novel
defense approach called PDB (Proactive Defensive Backdoor). Specifically, PDB
leverages the "home field" advantage of defenders by proactively injecting a
defensive backdoor into the model during training. Taking advantage of
controlling the training process, the defensive backdoor is designed to
suppress the malicious backdoor effectively while remaining secret to
attackers. In addition, we introduce a reversible mapping to determine the
defensive target label. During inference, PDB embeds a defensive trigger in the
inputs and reverses the model's prediction, suppressing malicious backdoor and
ensuring the model's utility on the original task. Experimental results across
various datasets and models demonstrate that our approach achieves
state-of-the-art defense performance against a wide range of backdoor attacks.

这篇论文提出了一种名为 PDB（Proactive Defensive Backdoor）的新颖防御方法，通过在训练过程中主动注入防御型后门，有效地抑制恶意后门，保持对攻击者的秘密，并在原始任务上确保模型的实用性。实验结果表明，我们的方法在各种数据集和模型上实现了最先进的防御性能。