Back-door attack poses a severe threat to deep learning systems. It injects hidden malicious behaviors to a model such that any input stamped with a special pattern can trigger such behaviors. Detecting back-door is hence of pressing need. Many existing defense techniques use optimization to generate the smallest input pattern that forces the model to misclassify a set of benign inputs injected with the pattern to a target label. However, the complexity is quadratic to the number of class labels such that they can hardly handle models with many classes. Inspired by Multi-Arm Bandit in Reinforcement Learning, we propose a K-Arm optimization method for backdoor detection. By iteratively and stochastically selecting the most promising labels for optimization with the guidance of an objective function, we substantially reduce the complexity, allowing to handle models with many classes. Moreover, by iteratively refining the selection of labels to optimize, it substantially mitigates the uncertainty in choosing the right labels, improving detection accuracy. At the time of submission, the evaluation of our method on over 4000 models in the IARPA TrojAI competition from round 1 to the latest round 4 achieves top performance on the leaderboard. Our technique also supersedes three state-of-the-art techniques in terms of accuracy and the scanning time needed.

翻译：后门攻击对深层学习系统构成了严重的威胁。 它向一个模型注入隐藏的恶意行为, 使得任何带有特殊模式的输入都能够触发这种行为。 检测后门是迫切需要的。 许多现有的国防技术使用优化来生成最小的输入模式, 迫使模型错误地分类用图案注入目标标签的一组良性投入。 但是, 复杂性对于等级标签的数量来说是四面形的, 以至于它们无法处理许多类的模型。 在加强学习中的多Arm Bandit 的启发下, 我们提议了K- Arm优化方法, 用于后门检测。 通过反复和随机选择最有希望的标签, 以客观功能为指南优化。 我们大幅降低复杂性, 允许处理许多类型的模型。 此外, 通过反复地改进标签的选择, 大大减轻了选择正确标签的不确定性, 提高了检测的准确性。 在提交时, 我们评估了4000多个模型在 IARPA TrojAI 竞争中采用的方法, 从一轮的1到最新一轮4级的升级技术。