A Textual Backdoor Defense Method Based on Deep Feature Classification

. 2023 Jan 23;25(2):220. doi: 10.3390/e25020220

Algorithm 2 Online attacked sample detection

Input :
Local poisoned data $D_{p}$ , local benign data $D_{c}$ , suspicious pre-trained DNN model f.

1:
Use $D_{p}$ and $D_{c}$ to fine-tune the f
2:
for all $x \in D_{p}$ do
3:
$A_{x}$ ← Deep features of the poisoned data extracted by model f
4:
Add $A_{x}$ to the backdoor feature set $A_{p}$
5:
end for
6:
for all $x \in D_{c}$ do
7:
$A_{x}$ ← Deep features of the benign data extracted by model f
8:
Add $A_{x}$ to the benign feature set $A_{c}$
9:
end for
10:
Train $f_{c}$ using $A_{p}$ and $A_{c}$
11:
$A_{x}$ ←Deep features of the input sample x extracted by the online deployment model f
12:
if $f_{c} (A_{x}) = b e n i g n$ then
13:
Permission x input f
14:
else
15:
Reject x input f
16:
end if