This work corroborates a run-time Trojan detection method exploiting STRong
Intentional Perturbation of inputs, is a multi-domain Trojan detection defence
across Vision, Text and Audio domains---thus termed as STRIP-ViTA.
Specifically, STRIP-ViTA is the first confirmed Trojan detection method that is
demonstratively independent of both the task domain and model architectures. We
have extensively evaluated the performance of STRIP-ViTA over: i) CIFAR10 and
GTSRB datasets using 2D CNNs, and a public third party Trojaned model for
vision tasks; ii) IMDB and consumer complaint datasets using both LSTM and 1D
CNNs for text tasks; and speech command dataset using both 1D CNNs and 2D CNNs
for audio tasks. Experimental results based on 28 tested Trojaned models
demonstrate that STRIP-ViTA performs well across all nine architectures and
five datasets. In general, STRIP-ViTA can effectively detect Trojan inputs with
small false acceptance rate (FAR) with an acceptable preset false rejection
rate (FRR). In particular, for vision tasks, we can always achieve a 0% FRR and
FAR. By setting FRR to be 3%, average FAR of 1.1% and 3.55% are achieved for
text and audio tasks, respectively. Moreover, we have evaluated and shown the
effectiveness of STRIP-ViTA against a number of advanced backdoor attacks
whilst other state-of-the-art methods lose effectiveness in front of one or all
of these advanced backdoor attacks.

本研究提出了一种名为 STRIP-ViTA 的多域特洛伊防御方法，通过对输入数据进行 STRong Intentional Perturbation，实现了跨视觉、文本和音频三个领域的特洛伊检测，并成功实现了任务域和模型结构的独立。实验结果表明，STRIP-ViTA 对九种不同的结构和五个数据集的检测性能表现良好，可以有效检测具有小误拒率（FRR）的特洛伊输入。