Backdoor inversion, the process of finding a backdoor trigger inserted into a machine learning model, has become the pillar of many backdoor detection and defense methods. Previous works on backdoor inversion often recover the backdoor through an optimization process to flip a support set of clean images into the target class. However, it is rarely studied and understood how large this support set should be to recover a successful backdoor. In this work, we show that one can reliably recover the backdoor trigger with as few as a single image. Specifically, we propose the SmoothInv method, which first constructs a robust smoothed version of the backdoored classifier and then performs guided image synthesis towards the target class to reveal the backdoor pattern. SmoothInv requires neither an explicit modeling of the backdoor via a mask variable, nor any complex regularization schemes, which has become the standard practice in backdoor inversion methods. We perform both quantitaive and qualitative study on backdoored classifiers from previous published backdoor attacks. We demonstrate that compared to existing methods, SmoothInv is able to recover successful backdoors from single images, while maintaining high fidelity to the original backdoor. We also show how we identify the target backdoored class from the backdoored classifier. Last, we propose and analyze two countermeasures to our approach and show that SmoothInv remains robust in the face of an adaptive attacker. Our code is available at https://github.com/locuslab/smoothinv .

翻译：后门反转，即寻找插入至机器学习模型中的后门触发器的过程，已成为众多后门检测与防御方法的支柱。以往的后门反转工作通常通过优化过程恢复后门，将一组干净图像的支持集翻转至目标类别。然而，关于该支持集应有多大才能成功恢复后门的研究与理解尚不充分。在本文中，我们表明仅需单张图像即可可靠地恢复后门触发器。具体而言，我们提出SmoothInv方法，该方法首先构建一个后门分类器的鲁棒平滑版本，然后执行朝向目标类别的引导图像合成以揭示后门模式。SmoothInv无需通过掩码变量显式建模后门，也不依赖任何复杂的正则化方案，而这已成为后门反转方法的标准实践。我们对先前已发表后门攻击中的后门分类器进行了定量与定性研究。结果表明，与现有方法相比，SmoothInv能够从单张图像中成功恢复后门，同时保持对原始后门的高保真度。我们还展示了如何从后门分类器中识别目标后门类别。最后，我们提出并分析了针对我们方法的两种对策，并表明SmoothInv在面对自适应攻击者时仍保持鲁棒性。我们的代码已开源至https://github.com/locuslab/smoothinv。