Cracking the Code of Backdoor Attacks With Confidence Consistency

It is widely believed that increasing the amount of training data enhances the intelligence of deep learning models, which in turn heightens dependence on external datasets. However, these datasets are susceptible to adversarial poisoning, allowing attackers to insert backdoors that trigger misclassifications. Although various defense strategies have been suggested, training-phase defenses (TPDs) appear most promising, as they can significantly lower the attack success rate (ASR) without greatly impacting model performance. Nevertheless, creating TPDs that achieve both high accuracy and low ASR is challenging due to two main issues: 1) Many solutions require additional clean samples that match the distribution of the poisoned dataset, which is not always practical in real-world scenarios; 2) most existing solutions have high computational costs, sometimes requiring five to ten times the expense of standard training, which severely limits their practical use. To tackle these challenges, we introduce Confidence Consistency Detection (CCD), an efficient and lightweight training-phase backdoor detection method. CCD is particularly advantageous in situations where clean data is scarce or unavailable, as it completely eliminates the need for external clean samples. Moreover, CCD significantly reduces computational costs to just 25% to 50% of existing solutions (1.7 times the standard training time), providing a notable improvement over current TPD methods. The core innovation of CCD lies in its ability to utilize the high confidence shown by backdoor samples during the early stages of model training for precise detection. Specifically, we initially train a model on a poisoned dataset for a few epochs, followed by intra-class loss fine-tuning to increase sensitivity to poisoned samples. We then create preliminary sets of poisoned and clean samples by assessing the consistency of confidence variations before and after fine-tuning. These sets guide the model training, enabling the detection of high-confidence poisoned samples. Extensive experiments demonstrate that CCD effectively reduces the attack success rate (ASR) to 1.43%, while having a negligible impact on the model’s clean accuracy. In detecting poisoned samples, CCD achieves a 99% true positive rate (TPR) and a 0.033% false positive rate (FPR), setting a new benchmark in the field.