---
abstract: 'Backdoor attacks have been shown to be a serious security threat against deep learning models, and detecting whether a given model has been backdoored becomes a crucial task. Existing defenses are mainly built upon the observation that the backdoor trigger is usually of small size or affects the activation of only a few neurons. However, the above observations are violated in many cases especially for advanced backdoor attacks, hindering the performance and applicability of the existing defenses. In this paper, we propose a backdoor defense <span><span><span style="font-variant:small-caps;">DTInspector</span></span></span>built upon a new observation. That is, an effective backdoor attack usually requires high prediction confidence on the poisoned training samples, so as to ensure that the trained model exhibits the targeted behavior with a high probability. Based on this observation, <span><span><span style="font-variant:small-caps;">DTInspector</span></span></span>first learns a patch that could change the predictions of most high-confidence data, and then decides the existence of backdoor by checking the ratio of prediction changes after applying the learned patch on the low-confidence data. Extensive evaluations on five backdoor attacks, four datasets, and three advanced attacking types demonstrate the effectiveness of the proposed defense.'
author:
- 'Tong Wang$^1$, Yuan Yao$^1$, Feng Xu$^1$ Miao Xu$^2$, Shengwei An$^3$, Ting Wang$^4$'
bibliography:
- 'backdoor.bib'
title: 'Confidence Matters: Inspecting Backdoors in Deep Neural Networks via Distribution Transfer'
---

Introduction
============

Threat Model and Key Observation
================================

The Proposed Defense
====================

Evaluation
==========

Related Work
============

Conclusion
==========

In this paper, we have proposed a new backdoor defense <span><span><span style="font-variant:small-caps;">DTInspector</span></span></span>. Our key insight is that an effective backdoor attack usually results in high prediction confidence on the poisoned training data, so as to ensure high ASR on poisoning inputs. We provide both theoretical and empirical evidence for this observation, and then propose a distribution transfer technique to distinguish trojaned models from clean ones, by using the shortcut nature of triggers. Extensive experiments demonstrate that the proposed defense: 1) can accurately detect the trojaned model as well as the infected label, and 2) outperforms existing defenses in terms of robustness to trigger size and effectiveness against advanced attacks and unseen triggers. In the future, we plan to extend our idea into natural language models and more computer vision tasks.

{'source': 'arXiv_out/2208'}