MetaPurifier:面向中毒数据集的空频特征解耦干净样本分层分离方法

MetaPurifier:a Hierarchical Separation Method for Clean Samples Decoupled from Spatial Frequency Features for Poisoning Datasets

摘要

后门攻击通过在样本中嵌入特定触发器来操纵神经网络输出.在训练前防御阶段,传统异常值检测方法难以识别复杂后门样本,而主流深度学习方法仅能筛选出占比 5%的干净子集,难以满足防御需求.针对此问题,本文结合半监督学习与分阶段判别思想,提出一种面向中毒数据集的空频特征解耦干净样本分层分离方法(MetaPurifier).该方法首先借鉴 Meta-Sift 中中毒样本存在损失差异的核心思想,完成干净样本的初筛;随后引入半监督学习,构建空频双视角的中毒判别网络,对初筛子集进一步提纯,实现干净子集的二次扩充.在 4 种图像数据集、8 种后门攻击场景下的实验结果表明:中毒率为 10%时,MetaPurifier 在分离占比 15%的干净子集任务中,子集纯度可达 99%,且对不同中毒率具有良好的鲁棒性.

Abstract

Backdoor attacks manipulate neural network outputs by embedding specific triggers in samples.In the pre-training defense phase,traditional outlier detection methods struggle to identify complex backdoor samples,while mainstream deep learning methods can only filter out a clean subset of 5%,which is insufficient to meet defense requirements.To address this problem,this paper proposes a hierarchical separation method for clean samples by decoupling spatial-frequency features for poisoning datasets(MetaPurifier),combining semi-supervised learning and staged discrimination.This method first draws on the core idea of the difference in loss between poisoned samples in Meta-Sift to complete the initial screening of clean samples;then,semi-supervised learning is introduced to construct a poisoning discrimination network with a dual spatial and frequency perspective,which further purifies the initial screening subset and realizes the secondary expansion of the clean subset.Experimental results on 4 image datasets and 8 backdoor attack scenarios show that when the poisoning rate is 10%,MetaPurifier can achieve a subset purity of 99% in the task of separating a clean subset of 15%,and has good robustness to different poisoning rates.

关键词

数据中毒 / 干净子集筛选 / 半监督学习 / 数据清洗 / 空频特征融合

Key words

data poisoning / clean subset selection / semi-supervised learning / data cleaning / spatial-frequency feature fusion

[1] Brown T,Mann B,Ryder N,et al.Language models are few-shot learners[C]//Advances in Neural Information Processing Systems,2020:1877-1901.
[2] Ren M,Zeng W,Yang B,et al.Learning to reweight examples for robust deep learning[C]//International Conference on Machine Learning,PMLR,2018:4334-4343.
[3] Shafahi A,Huang W R,Najibi M,et al.Poison frogs! targeted clean-label poisoning attacks on neural networks[J].Advances in Neural Information Processing Systems,2018,31,doi:10.48550/arXiv.1804.00792.
[4] Zeng Y,Pan M,Just H A,et al.Narcissus:a practical clean-label backdoor attack with limited information[C]//Proceedings of the ACM SIGSAC Conference on Computer and Communications Security,2023:771-785.
[5] Gu T,Liu K,Dolan-Gavitt B,et al.Badnets:evaluating backdooring attacks on deep neural networks[J].IEEE Access,2019,7:47230-47244.
[6] WANG R J,WANG J B,ZHANG F L,et al.Feature map poisoning attack and dual defense mechanism for federated prototype learning[J].Journal of Software,2025,36(3):1355-1374
[7] Shi J,Li L,Zeng D.Towards a unified framework for imperceptible textual attacks[J].Applied Intelligence,2024,54(3):2798-2811.
[8] Wallace E,Zhao T,Feng S,et al.Concealed data poisoning attacks on NLP models[C]//Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics:Human Language Technologies,2021:139-150.
[9] Li Y,Lyu X,Koren N,et al.Anti-backdoor learning:training clean models on poisoned data[C]//Advances in Neural Information Processing Systems,2021:14900-14912.
[10] Wei S,Zha H,Wu B.Mitigating backdoor attack by injecting proactive defensive backdoor[C]//Advances in Neural Information Processing Systems,2024:80674-80705.
[11] Steinhardt J,Koh P W W,Liang P S.Certified defenses for data poisoning attacks[C]//Advances in Neural Information Processing Systems,2017,30,doi:10.48550/arXiv.1706.03691.
[12] Levine A,Feizi S.Deep partition aggregation:provable defense against general poisoning attacks[J].arXiv preprint arXiv:2006.14768,2020.
[13] Zeng Y,Chen S,Park W,et al.Adversarial unlearning of backdoors via implicit hypergradient[J].arXiv preprint arXiv:2110.03735,2021.
[14] Boukerche A,Zheng L,Alfandi O.Outlier detection:methods,models,and classification[J].ACM Computing Surveys(CSUR),2020,53(3):1-37.
[15] Zeng Y,Pan M,Jahagirdar H,et al.Meta-Sift:how to sift out a clean subset in the presence of data poisoning?[C]//32nd USENIX Security Symposium,2023:1667-1684.
[16] Hestness J,Narang S,Ardalani N,et al.Deep learning scaling is predictable, empirically[J].arXiv preprint arXiv:1712.00409, 2017.
[17] Hakkarainen R.Drift detection methods for data streams[D].Espoo: Aalto University,2023.
[18] Grubbs F E.Procedures for detecting outlying observations in samples[J].Technometrics,1969,11(1):1-21.
[19] Paudice A,Muñoz-González L,Gyorgy A,et al.Detection of adversarial training examples in poisoning attacks through anomaly detection[J].arXiv preprint arXiv:1802.03041,2018.
[20] Paudice A,Muñoz-González L,Lupu E C.Label sanitization against label flipping poisoning attacks[C]//Joint European Conference on Machine Learning and Knowledge Discovery in Databases,2018:5-15.
[21] Tran B,Li J,Madry A.Spectral signatures in backdoor attacks[J].Advances in Neural Information Processing Systems,2018,31,doi:10.48550/arXiv.1811.00636.
[22] Fredrikson M,Jha S,Ristenpart T.Model inversion attacks that exploit confidence information and basic countermeasures[C]//Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security,2015:1322-1333.
[23] Li Y,Lyu X,Koren N,et al.Anti-backdoor learning:training clean models on poisoned data[C]//Advances in Neural Information Processing Systems,2021:14900-14912.
[24] Seetharaman S,Malaviya S,Vasu R,et al.Influence based defense against data poisoning attacks in online learning[C]//14th International Conference on Communication Systems & Networks,2022:1-6.
[25] Xiao R,Dong Y,Wang H,et al.Promix:combating label noise via maximizing clean sample utility[J].arXiv preprint arXiv:2207.10276,2022.
[26] Xia H,Hong H,Wang R.CBPF:filtering poisoned data based on composite backdoor attack[J].arXiv preprint arXiv:2406.16125,2024.
[27] Wang T,Yao Y,Xu F,et al.Backdoor attack through frequency domain[J].arXiv preprint arXiv:2111.10991,2021.
[28] Hou R,Huang T,Yan H,et al.A stealthy and robust backdoor attack via frequency domain transform[J].World Wide Web,2023,26(5):2767-2783.
[29] Ma Q,Qin J,Yan K,et al.Stealthy frequency-domain backdoor attacks:fourier decomposition and fundamental frequency injection[J].IEEE Signal Processing Letters,2023,30:1677-1681.
[30] Krizhevsky A.Learning multiple layers of features from tiny images[D].Toronto:University of Toronto,2009.
[31] Stallkamp J,Schlipsing M,Salmen J,et al.Man vs.computer:benchmarking machine learning algorithms for traffic sign recognition[J].Neural Networks,2012,32:323-332.
[32] Vinyals O,Blundell C,Lillicrap T,et al.Matching networks for one shot learning[C]//Proceedings of the 30th International Conference on Neural Information Processing Systems,2016:3637-3645.
[33] Netzer Y,Wang T,Coates A,et al.Reading digits in natural images with unsupervised feature learning[C]//NIPS Workshop on Deep Learning and Unsupervised Feature Learning,2011.
[34] He K,Zhang X,Ren S,et al.Deep residual learning for image recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition,2016:770-778.
[35] Chen W,Wu B,Wang H.Effective backdoor defense by exploiting sensitivity of poisoned samples[C]//Advances in Neural Information Processing Systems,2022:9727-9737.
[36] Chen X,Liu C,Li B,et al.Targeted backdoor attacks on deep learning systems using data poisoning[J].arXiv preprint arXiv:1712.05526,2017.
[37] Barni M,Kallas K,Tondi B.A new backdoor attack in cnns by training set corruption without label poisoning[C]//IEEE International Conference on Image Processing(ICIP),2019:101-105.
[38] Nguyen A,Tran A.Wanet-imperceptible warping-based backdoor attack[J].arXiv preprint arXiv:2102.10369,2021.
附中文参考文献:
[6] 王瑞锦,王金波,张凤荔,等.联邦原型学习的特征图中毒攻击和双重防御机制[J].软件学报,2025,36(3):1355-1374.

基金资助

国家自然科学基金项目(62271128,U2333207)资助;成都市重点研发支持计划项目(2025-YF12-00029-RC,2026-YF11-00032-HZ)资助;四川省重大科技专项项目(2025ZDZX0093)资助;四川省科技计划项目(2025ZHRG0006)资助;四川省科技计划“揭榜挂帅”项目(2023YFG0374)资助;四川省区域创新合作项目(2025YFHZ0302)资助.