SSL-ABD : An Adversarial Defense Method Against Backdoor Attacks in Self-supervised Learning

Recent research work has shown that self-supervised training encoders are susceptible to backdoor attacks. When the attacker is an untrusted service provider or a malicious third party, the attacker can manipulate the training process of the encoder at will. By adding specific patches or noise to the training dataset, the attacker successfully injects a backdoor into the image encoder and shares the backdoored encoder with downstream clients. While there have been many existing works on backdoor removal for supervised learning, most of them require labeled datasets and are not suitable for self-supervised training scenarios. Our work considers how to successfully remove the backdoor from the backdoored encoder when the defender has limited available training data. In this work, we propose SSL-ABD. The key idea behind our method is to formulate it as a min-max optimization problem: first, adversarially simulate the trigger pattern, and then remove the backdoor from the backdoored encoder through feature embedding distillation. We conducted experiments against various self-supervised attack algorithms such as CTRL [1] and SSL-Backdoor [2], and successfully removed the backdoor.