Anti-Backdoor Learning Quiz

Why would filtering out low-loss examples become 'significantly inaccurate' after many training epochs (e.g., beyond epoch 20)?

• Because by that stage, backdoor examples start to have high training loss.

• Because by that stage, many correctly learned clean examples also have low training loss, making them indistinguishable from backdoor examples on this metric alone.

• Because the model will have completely forgotten the backdoor by epoch 20.

• Because the definition of 'low loss' changes after epoch 20.

The strategy of removing low-loss examples early in training is ineffective partly because some powerful attacks can succeed even with a very small number of backdoor examples.

In the ABL method, what is 'gradient ascent' used for?

• To train the model normally on the clean set of data.

• To isolate the data with the lowest loss values.

• To actively 'unlearn' the suspected backdoored data by maximizing its loss function.

• To initialize the model's weights.

The ABL method requires the defender to know the exact poisoning rate to set the isolation rate p.

According to the table, how does ABL (Ours) perform on the 'SIG' attack type?

• It achieves 0.09% Attack Success Rate (ASR) and 88.27% Clean Accuracy (CA).

• It fails to defend, resulting in 99.46% ASR.

• It results in the lowest CA of all defenses.

• It performs worse than 'No Defense'.

Based on the 'Average' results, ABL achieves both the lowest average Attack Success Rate and the highest average Clean Accuracy compared to the other defenses listed.

What is the trade-off shown in the graphs when setting the isolation rate p?

• Using a higher isolation rate perfectly defends against attacks with no negative side effects.

• A higher isolation rate better defends against attacks (lower ASR) but at the cost of harming the model's accuracy on clean data (lower CA).

• A higher isolation rate improves clean accuracy but weakens the defense against attacks.

• The isolation rate has no effect on either ASR or CA.

The 'Zoom In View' on the right graph shows that clean accuracy is monotonically increasing with the isolation rate.

Why might the 'Blend' attack be harder for ABL to defend against than 'BadNets'?

• The BadNets trigger is more complex and easier to isolate.

• The Blend attack uses another image as a trigger, which mixes patterns with the background. This may cause ABL to misidentify clean data that shares similar natural patterns as poisoned, making isolation less accurate.

• The Blend attack poisons a smaller percentage of the data.

• ABL's algorithm is specifically designed only for BadNets.

The table shows that ABL is completely ineffective when the poisoning rate is 50% or higher.