Backdoor Detection Defense

# Backdoor Detection & Defense

## Introduction & Motivation

Backdoor attacks: inject malicious behavior via data poisoning. Stealthy attacks on training. Applications: security, threat detection, robust training.

Motivation: Detect and defend against backdoor attacks.

Applications: Secure training, model verification, trusted AI.

---

## Core Concepts & Theory

### Backdoor Trigger

Hidden activation pattern.

### Trojan Attack

Malicious behavior on trigger.

### Detection Methods

Identify poisoned samples.

### Defense Strategies

Robust training, filtering.

---

## Mathematical Formulation

Triggered Misclassification:
$$y_{ ext{backdoor}} = t ext{ if } x' = x + \delta_{ ext{trigger}}$$

Backdoor Loss:
$$\mathcal{L}_{ ext{backdoor}} = \alpha \mathcal{L}_{ ext{clean}} + (1-\alpha) \mathcal{L}_{ ext{poison}}$$

---

## Advanced Theory & Extensions

### Invisible Backdoors

Imperceptible triggers.

### Multi-Target Attacks

Multiple classes affected.

### Defense via Activation Clustering

Detect outlier activations.

---

## Computational Considerations

Attack: O(n·D²).

Detection: O(n·D²).

Defense: Standard training + filtering.

---

## Practical Implementation Strategies

### Trigger Patterns

Choose specific patterns.

### Poisoning Rate

Small percentage enough.

### Detection Metrics

Activation analysis.

---

## Benchmark Datasets & Evaluation

CIFAR-10: Backdoor benchmark.

ImageNet: Large-scale attacks.

Custom metrics: Attack success rate.

---

## Key Challenges & Limitations

### Stealthy Attacks

Hard to detect.

### Adaptive Attacks

Evade defenses.

### Efficiency Trade-off

Defense cost.

---

## Hyperparameter Tuning

Poison rate: 0.01-0.1.

Trigger size: 4x4 to 32x32.

Learning rate: 1e-4 to 1e-3.

---

## Real-World Applications & Case Studies

Model Verification: Audit pretrained models.

Supply Chain: Detect poisoned data.

Security: Robust deployment.

---

## Integration with Other Methods

Backdoor defense + differential privacy; + secure aggregation.

---

## Summary & Key Takeaways

Backdoor defense protects model integrity.

Principles:
1. Attack: Inject hidden behavior.
2. Trigger: Activation pattern.
3. Detection: Identify anomalies.
4. Defense: Robust training, filtering.
5. Verification: Model auditing.

---

## Appendix: Practical Labs

### Lab 1: Create Backdoor Trigger

import numpy as np

def create_trigger(size=4, pattern='square'):
 """Create backdoor trigger pattern"""
 trigger = np.zeros((size, size, 3))
 
 if pattern == 'square':
 trigger[:, :] = [1, 0, 0] # Red square
 elif pattern == 'checkerboard':
 trigger[::2, ::2] = 1
 
 return trigger

trigger = create_trigger(4, 'square')
assert trigger.shape == (4, 4, 3)
print("✓ Trigger creation working")

### Lab 2: Activation Clustering Detection

import numpy as np

def detect_backdoor_via_clustering(activations, contamination=0.05):
 """Detect backdoored samples via activation clustering"""
 # Compute pairwise distances
 distances = np.linalg.norm(activations[:, np.newaxis] - activations[np.newaxis, :], axis=2)
 
 # Find outliers
 mean_dist = np.mean(distances, axis=1)
 threshold = np.percentile(mean_dist, (1-contamination)*100)
 outliers = mean_dist > threshold
 
 return outliers

np.random.seed(42)
act = np.random.randn(100, 256)
outliers = detect_backdoor_via_clustering(act, 0.1)
assert np.sum(outliers) <= 10
print(f"✓ Detected {np.sum(outliers)} backdoored samples")

### Lab 3: Poison the Model

import numpy as np

def poison_training(clean_data, labels, poison_rate=0.05, trigger_label=0):
 """Poison training data with backdoor"""
 num_poison = int(len(clean_data) * poison_rate)
 poison_indices = np.random.choice(len(clean_data), num_poison, replace=False)
 
 poisoned = clean_data.copy()
 for idx in poison_indices:
 poisoned[idx] += 0.1 # Add trigger
 labels[idx] = trigger_label
 
 return poisoned, labels

np.random.seed(42)
data = np.random.rand(100, 10)
labels = np.random.randint(0, 10, 100)
poisoned, p_labels = poison_training(data, labels, 0.05)
assert poisoned.shape == data.shape
print("✓ Data poisoning working")

### Lab 4: Defense: Activation Filtering

import numpy as np

def filter_by_activations(data, activations, threshold_percentile=5):
 """Filter suspicious samples by activation patterns"""
 # Compute activation variance
 variance = np.var(activations, axis=1)
 threshold = np.percentile(variance, threshold_percentile)
 
 # Remove outliers
 keep_mask = variance <= threshold
 clean_data = data[keep_mask]
 
 return clean_data

np.random.seed(42)
data = np.random.rand(100, 10)
act = np.random.rand(100, 256)
clean = filter_by_activations(data, act, 10)
assert len(clean) <= len(data)
print(f"✓ Filtered {len(data) - len(clean)} suspicious samples")

---