Table - PMC

Skip to main content

View full-text article in PMC

. 2023 Jan 23;25(2):220. doi: 10.3390/e25020220

Algorithm 1 Offline poisoned training sample detection

Input :
Suspicious training data $D_{0}$ , local poisoned data $D_{p}$ , local benign data $D_{c}$ , DNN model f.

1:
Train f using $D_{0}$ , $D_{p}$ , and $D_{c}$
2:
for all $x \in D_{p}$ do
3:
$A_{x}$ ← Deep features of the poisoned data extracted by model f
4:
Add $A_{x}$ to the backdoor feature set $A_{p}$
5:
end for
6:
for all $x \in D_{c}$ do
7:
$A_{x}$ ← Deep features of the benign data extracted by model f
8:
Add $A_{x}$ to the benign feature set $A_{c}$
9:
end for
10:
Train $f_{c}$ using $A_{p}$ and $A_{c}$
11:
for all $x \in D_{0}$ do
12:
$A_{x}$ ← Deep features extracted by model f
13:
if $f_{c} (A_{x}) = b e n i g n$ then
14:
Retention
15:
else
16:
Delete x from $D_{0}$
17:
end if
18:
end for
19:
Train f with the cleaned $D_{0}$ to obtain a no-backdoor DNN model.