Strong evasive backdoor attacks and an ensemble defense

Abstract

Various defenses have been proposed to counter backdoors in deep neural network classifiers, but due to the diverse mechanisms through which backdoor triggers can be incorporated into data samples, no single defense is universally effective. We introduce an ensemble defense that consolidates the complementary strengths of individual detectors, making the detection system more backdoor mechanism‐agnostic, and also providing backdoor inversion, which offers insights into the nature of the detected attack. Our ensemble defense achieves superior detection performance and more robust, accurate backdoor inversion compared to individual detectors. We also employ mixed clean/dirty‐label backdoor poisoning, a recent X‐to‐X backdoor attack that is more surgical, evasive, and harder to detect than traditional dirty‐label attacks.