Deep Neural Networks (DNN) are susceptible to backdoor attacks where malicious attackers manipulate the model's predictions via data poisoning. It is hence imperative to develop a strategy for training a clean model using a potentially poisoned dataset. Previous training-time defense mechanisms typically employ an one-time isolation process, often leading to suboptimal isolation outcomes. In this study, we present a novel and efficacious defense method, termed Progressive Isolation of Poisoned Data (PIPD), that progressively isolates poisoned data to enhance the isolation accuracy and mitigate the risk of benign samples being misclassified as poisoned ones. Once the poisoned portion of the dataset has been identified, we introduce a selective training process to train a clean model. Through the implementation of these techniques, we ensure that the trained model manifests a significantly diminished attack success rate against the poisoned data. Extensive experiments on multiple benchmark datasets and DNN models, assessed against nine state-of-the-art backdoor attacks, demonstrate the superior performance of our PIPD method for backdoor defense. For instance, our PIPD achieves an average True Positive Rate (TPR) of 99.95% and an average False Positive Rate (FPR) of 0.06% for diverse attacks over CIFAR-10 dataset, markedly surpassing the performance of state-of-the-art methods.

翻译：深度神经网络（DNN）易受后门攻击，恶意攻击者通过数据中毒操纵模型预测。因此，亟需开发一种利用潜在中毒数据集训练清洁模型的策略。以往的训练时防御机制通常采用一次性隔离过程，往往导致次优的隔离效果。本研究提出一种新颖且有效的防御方法——渐进式中毒数据隔离（PIPD），该方法通过逐步隔离中毒数据来提高隔离精度，并降低良性样本被误判为中毒样本的风险。一旦识别出数据集中的中毒部分，我们引入选择性训练过程来训练清洁模型。通过实施这些技术，我们确保训练后的模型对中毒数据的攻击成功率显著降低。在多个基准数据集和DNN模型上的大量实验，针对九种最先进的后门攻击进行评估，证明了我们的PIPD方法在后门防御中的优越性能。例如，在CIFAR-10数据集中，我们的PIPD针对多种攻击实现了平均真阳性率（TPR）达99.95%、平均假阳性率（FPR）为0.06%，显著超越了现有最先进方法的表现。