# Anti-Backdoor Learning: Training Clean Models on Poisoned Data

**Authors:** Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, Xingjun Ma  
**arXiv:** [2110.11571](https://arxiv.org/abs/2110.11571)  
**Date:** 2021-10-22  
**Summary page:** https://www.summarizepaper.com/en/paper/2110.11571v3/

## Key points

- Backdoor attacks pose a significant security threat to deep neural networks (DNNs)
- Current defense methods have shown promise in detecting and removing backdoors
- Uncertainty remains regarding whether robust training techniques can prevent the injection of backdoor triggers into trained models
- The proposed approach called "anti-backdoor learning" (ABL) trains clean models using data poisoned with backdoors
- ABL frames the learning process as a dual-task, aiming to simultaneously learn the clean and backdoor portions of the data
- Models learn backdoored data faster than clean data, with stronger attacks leading to quicker convergence on backdoored data
- The backdoor task is tied to a specific class known as the backdoor target class
- ABL introduces a general learning scheme that automatically prevents backdoor attacks during training by incorporating a two-stage gradient ascent mechanism into standard training
- Extensive experiments are conducted on multiple benchmark datasets against ten state-of-the-art attacks to evaluate ABL's effectiveness
- Models trained using ABL on backdoor-poisoned data achieve performance comparable to models trained on purely clean data
- ABL offers a promising solution for enhancing model security and maintaining performance integrity

## Summary

Backdoor attacks pose a significant security threat to deep neural networks (DNNs). Current defense methods have shown promise in detecting and removing backdoors; however, it remains uncertain whether robust training techniques can prevent the injection of backdoor triggers into trained models. To address this issue, this paper proposes a novel approach called "anti-backdoor learning" (ABL) to train clean models using data that has been poisoned with backdoors. The ABL framework frames the learning process as a dual-task, aiming to simultaneously learn the clean and backdoor portions of the data. The authors identify two inherent weaknesses of backdoor attacks: 1) models learn backdoored data faster than clean data, with stronger attacks leading to quicker convergence on backdoored data; and 2) the backdoor task is tied to a specific class known as the backdoor target class. Based on these weaknesses, ABL introduces a general learning scheme that automatically prevents backdoor attacks during training. It incorporates a two-stage gradient ascent mechanism into standard training. In the early stage, this mechanism helps isolate backdoor examples while in the later stage it breaks the correlation between backdoor examples and the target class. To evaluate ABL's effectiveness, extensive experiments are conducted on multiple benchmark datasets against ten state-of-the-art attacks. The results demonstrate that models trained using ABL on backdoor-poisoned data achieve performance comparable to models trained on purely clean data. Overall, this paper presents an innovative approach for mitigating the risks posed by backdoor attacks in DNNs by effectively preventing their injection during training. ABL offers a promising solution for enhancing model security and maintaining performance integrity; its code is available at https://github.com/bboylyg/ABL.