This paper proposes a data-efficient detection method for deep neural networks against backdoor attacks under a black-box scenario. The proposed approach is motivated by the intuition that features corresponding to triggers have a higher influence in determining the backdoored network output than any other benign features. To quantitatively measure the effects of triggers and benign features on determining the backdoored network output, we introduce five metrics. To calculate the five-metric values for a given input, we first generate several synthetic samples by injecting the input's partial contents into clean validation samples. Then, the five metrics are computed by using the output labels of the corresponding synthetic samples. One contribution of this work is the use of a tiny clean validation dataset. Having the computed five metrics, five novelty detectors are trained from the validation dataset. A meta novelty detector fuses the output of the five trained novelty detectors to generate a meta confidence score. During online testing, our method determines if online samples are poisoned or not via assessing their meta confidence scores output by the meta novelty detector. We show the efficacy of our methodology through a broad range of backdoor attacks, including ablation studies and comparison to existing approaches. Our methodology is promising since the proposed five metrics quantify the inherent differences between clean and poisoned samples. Additionally, our detection method can be incrementally improved by appending more metrics that may be proposed to address future advanced attacks.

翻译：本文提出一种数据高效的深度神经网络后门检测方法，适用于黑盒场景下的后门攻击检测。该方法基于以下直觉：在决定后门网络输出时，触发器对应特征的影响力高于任何良性特征。为定量测量触发器与良性特征对后门网络输出的影响程度，我们引入五个度量指标。为计算给定输入的这五个度量值，首先通过将输入的部分内容注入干净验证样本生成多个合成样本，随后利用对应合成样本的输出标签计算五维度量。本工作的贡献之一在于仅需使用极小的干净验证数据集。基于计算得到的五维度量，从验证数据集中训练五个新颖性检测器。元新颖性检测器融合五个训练好的新颖性检测器的输出，生成元置信度分数。在线测试阶段，本方法通过评估元新颖性检测器输出的元置信度分数，判断在线样本是否被投毒。我们通过涵盖消融研究与现有方法对比的广泛后门攻击实验，验证了该方法的有效性。本方法具有前景，因为所提出的五维度量量化了干净样本与投毒样本之间的固有差异。此外，通过附加未来可能提出的针对高级攻击的度量指标，本检测方法可实现渐进式改进。