TY - JOUR
T1 - A defense method against backdoor attacks on neural networks
AU - Kaviani, Sara
AU - Shamshiri, Samaneh
AU - Sohn, Insoo
N1 - Publisher Copyright:
© 2022 Elsevier Ltd
PY - 2023/3/1
Y1 - 2023/3/1
N2 - Due to computational complexities of artificial neural networks (ANNs), there is an increasing demand for third parties and MLaaS (machine learning as a service) to take charge of the training procedure. Therefore, making ANNs robust against adversarial attacks has received a lot of attention. Backdoor attacks, which causes targeted mis-classification while the accuracy on clean data is not affected, are among the most efficient attacks. In this paper, we propose a method called link-pruning with scale-freeness (LPSF), in which the dormant threatening links from the neurons in the input layer to other neurons of feed-forward neural network are eliminated according to the information gained from a portion of clean input data and the essential links are strengthened by changing the fully-connected networks to scale-free structures. To the best of our knowledge, it is the first defense method that makes the network significantly robust against backdoor attack (BD) before the network is attacked. LPSF is evaluated on feed-forward neural networks and with malicious MNIST, FMNIST, handwritten Chinese characters and HODA datasets. Through LPSF strategy, we achieve a sufficiently high and stable accuracy on clean data and an exceeding reduction range of 50%−94% for attack success rate.
AB - Due to computational complexities of artificial neural networks (ANNs), there is an increasing demand for third parties and MLaaS (machine learning as a service) to take charge of the training procedure. Therefore, making ANNs robust against adversarial attacks has received a lot of attention. Backdoor attacks, which causes targeted mis-classification while the accuracy on clean data is not affected, are among the most efficient attacks. In this paper, we propose a method called link-pruning with scale-freeness (LPSF), in which the dormant threatening links from the neurons in the input layer to other neurons of feed-forward neural network are eliminated according to the information gained from a portion of clean input data and the essential links are strengthened by changing the fully-connected networks to scale-free structures. To the best of our knowledge, it is the first defense method that makes the network significantly robust against backdoor attack (BD) before the network is attacked. LPSF is evaluated on feed-forward neural networks and with malicious MNIST, FMNIST, handwritten Chinese characters and HODA datasets. Through LPSF strategy, we achieve a sufficiently high and stable accuracy on clean data and an exceeding reduction range of 50%−94% for attack success rate.
KW - Backdoor attacks
KW - Feed-forward neural networks
KW - Scale-free networks
UR - http://www.scopus.com/inward/record.url?scp=85140061018&partnerID=8YFLogxK
U2 - 10.1016/j.eswa.2022.118990
DO - 10.1016/j.eswa.2022.118990
M3 - Article
AN - SCOPUS:85140061018
SN - 0957-4174
VL - 213
JO - Expert Systems with Applications
JF - Expert Systems with Applications
M1 - 118990
ER -