Chessboard Masked AutoEncoder Against Hidden Backdoor Attacks
TL;DR
A novel real-time backdoor defense framework, the Chessboard Masked AutoEncoder (CBMAE), which can reconstruct images and neutralize hidden triggers at runtime, regardless of access to the model’s architecture, parameters, or soft output.
Abstract
Attackers can embed malicious behaviors into Deep Learning (DL) models and make these contaminated models publicly available. The malfunction of backdoored models does not raise suspicion unless the attacker activates the malicious behavior by triggering it with an embedded trigger in the input data during inference. Unaware users may integrate these contaminated models into their applications, thereby exposing their systems to adversarial attacks with potentially severe outcomes. In many real-world deep learning applications that rely on publicly available or third-party models, existing backdoor detection methods are often impractical because they typically require access to the original training data, the target model’s internal weights, or the confidence scores of its predictions. This paper introduces a novel real-time backdoor defense framework, the Chessboard Masked AutoEncoder (CBMAE), which can reconstruct images and neutralize hidden triggers at runtime, regardless of access to the model’s architecture, parameters, or soft output. We evaluated our framework on benchmark datasets such as CIFAR-10, GTSRB, and ImageNet-16, showing strong resistance to backdoor attacks. While existing defense methods can significantly reduce attack success rates (ASR), they often do so at the cost of substantial accuracy drops on clean or purified data. In contrast, although our method may not reduce ASR as aggressively as some specialized defenses, it strikes a strong balance by effectively lowering ASR while preserving high accuracy on clean and recovered poisoned data. Our source code is available at https://github.com/hvorya/Backdoor