Modern machine learning increasingly requires training on a large collection
of data from multiple sources, not all of which can be trusted. A particularly
concerning scenario is when a small fraction of poisoned data changes the
behavior of the trained model when triggered by an attacker-specified
watermark. Such a compromised model will be deployed unnoticed as the model is
accurate otherwise. There have been promising attempts to use the intermediate
representations of such a model to separate corrupted examples from clean ones.
However, these defenses work only when a certain spectral signature of the
poisoned examples is large enough for detection. There is a wide range of
attacks that cannot be protected against by the existing defenses. We propose a
novel defense algorithm using robust covariance estimation to amplify the
spectral signature of corrupted data. This defense provides a clean model,
completely removing the backdoor, even in regimes where previous methods have
no hope of detecting the poisoned examples. Code and pre-trained models are
available at this https URL .

提出一个使用鲁棒协方差估计来放大数据污染的光谱特征的新型防御算法，从而完全消除后门，即使在先前的方法无法检测到污染样例的情况下，也能提供一个净模型。

使用鲁棒统计方法防御后门攻击的 SPECTRE 技术

SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics

In statistics and machine learning, people are often interested in the
eigenvectors (or singular vectors) of certain matrices (e.g. covariance
matrices, data matrices, etc). However, those matrices are usually perturbed by
noises or statistical errors, either from random sampling or structural
patterns. One usually employs Davis-Kahan $\sin \theta$ theorem to bound the
difference between the eigenvectors of a matrix $A$ and those of a perturbed
matrix $\widetilde{A} = A + E$, in terms of $\ell_2$ norm. In this paper, we
prove that when $A$ is a low-rank and incoherent matrix, the $\ell_{\infty}$
norm perturbation bound of singular vectors (or eigenvectors in the symmetric
case) is smaller by a factor of $\sqrt{d_1}$ or $\sqrt{d_2}$ for left and right
vectors, where $d_1$ and $d_2$ are the matrix dimensions. The power of this new
perturbation result is shown in robust covariance estimation, particularly when
random variables have heavy tails. There, we propose new robust covariance
estimators and establish their asymptotic properties using the newly developed
perturbation bound. Our theoretical results are verified through extensive
numerical experiments.

该论文针对矩阵扰动中的特征向量进行了研究，证明了当矩阵是低秩和不相干的时候，奇异向量的（或对称情况下的特征向量）l∞范数扰动界限比 l2 范数扰动界限更小一个因子。作者在稳健协方差估计方面提出了新的建模方法，并利用所开发的扰动界限确立其渐近性质。