NBA:defensive distillation for backdoor removal via neural behavior alignment

作     者：Zonghao Ying Bin Wu Zonghao Ying;Bin Wu

作者机构：State Key Laboratory of Information SecurityInstitute of Information EngineeringChinese Academy of SciencesBeijingChina School of Cyber SecurityUniversity of Chinese Academy of SciencesBeijingChina 

出 版 物：《Cybersecurity》 (网络空间安全科学与技术（英文）)

年 卷 期：2023年第6卷第4期

页      面：76-87页

核心收录：

学科分类：0710[理学-生物学] 1205[管理学-图书情报与档案管理] 08[工学] 081104[工学-模式识别与智能系统] 0811[工学-控制科学与工程] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：This work was supported by the National Natural Science Foundation of China under Grant No.62272007 the National Natural Science Foundation of China under Grant No.U1936119 the Major Science and Technology Project of Hainan Province under Grant No.ZDKJ2019003. 

主　　题：Deep neural network Backdoor removal Knowledge distillation 

摘      要：Recently,deep neural networks have been shown to be vulnerable to backdoor attacks.A backdoor is inserted into neural networks via this attack paradigm,thus compromising the integrity of the network.As soon as an attacker presents a trigger during the testing phase,the backdoor in the model is activated,allowing the network to make specific wrong predictions.It is extremely important to defend against backdoor attacks since they are very stealthy and dangerous.In this paper,we propose a novel defense mechanism,Neural Behavioral Alignment(NBA),for backdoor removal.NBA optimizes the distillation process in terms of knowledge form and distillation samples to improve defense performance according to the characteristics of backdoor defense.NBA builds high-level representations of neural behavior within networks in order to facilitate the transfer of knowledge.Additionally,NBA crafts pseudo samples to induce student models exhibit backdoor neural behavior.By aligning the backdoor neural behavior from the student network with the benign neural behavior from the teacher network,NBA enables the proactive removal of backdoors.Extensive experiments show that NBA can effectively defend against six different backdoor attacks and outperform five state-of-the-art defenses.