@inproceedings{
struppek2024leveraging,
title={Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data},
author={Lukas Struppek and Martin Hentschel and Clifton Poth and Dominik Hintersdorf and Kristian Kersting},
booktitle={NeurIPS 2023 Workshop on Backdoors in Deep Learning - The Good, the Bad, and the Ugly},
year={2024},
url={https://openreview.net/forum?id=SVchy5VlnI}
}
Backdoor attacks pose a serious security threat for training neural networks as they surreptitiously introduce hidden functionalities into a model. Such backdoors remain silent during inference on clean inputs, evading detection due to inconspicuous behavior. However, once a specific trigger pattern appears in the input data, the backdoor activates, causing the model to execute its concealed function. Detecting such poisoned samples within vast datasets is virtually impossible through manual inspection. To address this challenge, we propose a novel approach that enables model training on potentially poisoned datasets by utilizing the power of recent diffusion models. Specifically, we create synthetic variations of all training samples, leveraging the inherent resilience of diffusion models to potential trigger patterns in the data. By combining this generative approach with knowledge distillation, we produce student models that maintain their general performance on the task while exhibiting robust resistance to backdoor triggers.
Leveraging Diffusion-Based Image Variations for Robust Training on Poisoned Data
Lukas Struppek Martin Hentschel Clifton Poth Dominik Hintersdorf Kristian Kersting