Deep learning models have recently shown to be vulnerable to backdoor
poisoning, an insidious attack where the victim model predicts clean images
correctly but classifies the same images as the target class when a trigger
poison pattern is added. This poison pattern can be embedded in the training
dataset by the adversary. Existing defenses are effective under certain
conditions such as a small size of the poison pattern, knowledge about the
ratio of poisoned training samples or when a validated clean dataset is
available. Since a defender may not have such prior knowledge or resources, we
propose a defense against backdoor poisoning that is effective even when those
prerequisites are not met. It is made up of several parts: one to extract a
backdoor poison signal, detect poison target and base classes, and filter out
poisoned from clean samples with proven guarantees. The final part of our
defense involves retraining the poisoned model on a dataset augmented with the
extracted poison signal and corrective relabeling of poisoned samples to
neutralize the backdoor. Our approach has shown to be effective in defending
against backdoor attacks that use both small and large-sized poison patterns on
nine different target-base class pairs from the CIFAR10 dataset.

提出了一种有效的对抗性样本（backdoor）防御方法，它由多个子模块组成，能够在检测到 backdoor 的同时进行筛选清洗，并通过提取毒信号的方式中和攻击。该防御方法在 CIFAR10 数据集上针对 9 种不同的目标基类配对均表现出较好的效果。