Backdoor defenses have been studied to alleviate the threat of deep neural networks (DNNs) being backdoor attacked and thus maliciously altered. Since DNNs usually adopt some external training data from an untrusted third party, a robust backdoor defense strategy during the training stage is of importance. We argue that the core of training-time defense is to select poisoned samples and to handle them properly. In this work, we summarize the training-time defenses from a unified framework as splitting the poisoned dataset into two data pools. Under our framework, we propose an adaptively splitting dataset-based defense (ASD). Concretely, we apply loss-guided split and meta-learning-inspired split to dynamically update two data pools. With the split clean data pool and polluted data pool, ASD successfully defends against backdoor attacks during training. Extensive experiments on multiple benchmark datasets and DNN models against six state-of-the-art backdoor attacks demonstrate the superiority of our ASD. Our code is available at https://github.com/KuofengGao/ASD.

翻译：后门防御旨在缓解深度神经网络（DNN）遭受后门攻击并被恶意篡改的威胁。由于DNN通常采用来自不可信第三方的外部训练数据，因此在训练阶段制定鲁棒的后门防御策略至关重要。本文认为训练阶段防御的核心在于筛选中毒样本并对其进行妥善处理。为此，我们通过统一框架将现有训练阶段防御方法归纳为将中毒数据集分割成两个数据池。基于该框架，我们提出一种自适应数据集分割防御方法（ASD）。具体而言，我们应用损失引导分割和元学习启发分割动态更新两个数据池。通过分割出的干净数据池和污染数据池，ASD能够在训练过程中成功防御后门攻击。在多个基准数据集和DNN模型上针对六种最先进后门攻击的大量实验证明了我们ASD方法的优越性。我们的代码开源在https://github.com/KuofengGao/ASD。