通过变分防御封闭您的后门

我们提出了 VIBE，一个面向模型的框架，用于训练抗后门攻击的分类器。我们方法的关键概念是将恶意输入和受感染标签视为观测随机变量，而实际干净标签则为潜在变量。VIBE 然后通过变分推断恢复相应的潜在干净标签后验。 resulting training procedure follows the expectation-maximization (EM) algorithm. The E-step infers the clean pseudolabels by solving an entropy-regularized optimal transport problem, while the M-step updates the classifier parameters via gradient descent. Being modular, VIBE can seamlessly integrate with recent advancements in self-supervised representation learning, which enhance its ability to resist backdoor attacks. We experimentally validate the method effectiveness against contemporary backdoor attacks on standard datasets, a large-scale setup with 1$k$ classes, and a dataset poisoned with multiple attacks. VIBE consistently outperforms previous defenses across all tested scenarios.