Reproduce “DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Jiachen Zhou, Peizhuo Lv, Yibing Lan, Guozhu Meng, Kai Chen, Hualong Ma
DATAELIXIR introduces a four-stage dataset sanitization method that leverages diffusion models to purify poisoned training datasets, effectively mitigating backdoor attacks. It achieves average attack success rates as low as 0.37% across diverse attacks and datasets while maintaining high benign accuracy and restoring ground-truth labels for poisoned samples.
Key insights
- Diffusion models can effectively 'purify' poisoned images by first corrupting them with noise to eliminate triggers, then denoising back to a benign data distribution to restore original features.
- Analyzing the 'label transitions' of intermediate diffusion steps (from poisoned to benign predictions) within a victim model allows for reliable identification of poisoned samples and their true labels.
- Aggregating candidate set predictions and quantifying label distribution discrepancies enables accurate, black-box detection of the target label(s) of a backdoor attack.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.