Fighting Fire with Fire: Medical AI Models Defend Against Backdoor Attacks via Self-learning

The efficacy of medical artificial intelligence (AI) models significantly hinges on the voluminous training data collected from various medical service organizations. However, the data acquisition process might inadvertently accumulate maliciously crafted, poisonous data, which could embed backdoors into the trained models. These backdoors, when triggered, could lead to incorrect diagnoses, thereby endangering patient health. Although various strategies exist to defend against backdoor attacks, they predominantly focus on preventing poisoned data from being categorized into target classes. These methods often overlook the fact that even if backdoors are eliminated, the triggers within poisoned data, acting as perturbations, can still cause misclassifications. In light of this, we propose a novel defense mechanism that not only eradicates backdoors but also ensures the accurate classification of data containing triggers. Initially, we filter the training data using the characteristics of the triggers to identify and isolate potential backdoor instances. Subsequently, we retrain the model using the remaining clean data. Thereafter, we employ a self-training approach iterated multiple times to predict the identified backdoor data and retrain the model using pseudo-labels with high confidence. The experimental results show that the robustness of the model against backdoor data has been significantly improved through self-learning models, and the accuracy of the main task has also been enhanced.