Neural networks are vulnerable to backdoor poisoning attacks, where the attackers maliciously poison the training set and insert triggers into the test input to change the prediction of the victim model. Existing defenses for backdoor attacks either provide no formal guarantees or come with expensive-to-compute and ineffective probabilistic guarantees. We present PECAN, an efficient and certified approach for defending against backdoor attacks. The key insight powering PECAN is to apply off-the-shelf test-time evasion certification techniques on a set of neural networks trained on disjoint partitions of the data. We evaluate PECAN on image classification and malware detection datasets. Our results demonstrate that PECAN can (1) significantly outperform the state-of-the-art certified backdoor defense, both in defense strength and efficiency, and (2) on real back-door attacks, PECAN can reduce attack success rate by order of magnitude when compared to a range of baselines from the literature.

翻译：神经网络容易受到后门投毒攻击的影响，攻击者恶意污染训练集并将触发器插入测试输入中，以改变受害者模型的预测结果。现有的后门攻击防御方法要么无法提供形式化保证，要么依赖于计算成本高昂且效果欠佳的概率性保证。我们提出PECAN，一种高效且经过认证的后门攻击防御方法。PECAN的核心思路是对在数据不相交划分上训练的多个神经网络，直接采用现成的测试时逃避认证技术。我们在图像分类和恶意软件检测数据集上对PECAN进行了评估。实验结果表明，PECAN能够：（1）在防御强度和效率上显著优于当前最先进的认证后门防御方法；（2）针对真实后门攻击，与文献中的一系列基线方法相比，PECAN可将攻击成功率降低一个数量级。