Backdoor Inversion in Neural-Activation Space

There are a variety of defenses against backdoor attacks planted in deep neural network (DNN) classifiers via poisoning of the training set. Backdoor-agnostic methods seek to detect and/or mitigate backdoors irrespective of the incorporation mechanism used by the attacker, while inversion methods explicitly assume one. We describe a new detector that: relies on embedded feature representations (neural-activation space) to estimate (invert) the backdoor and to identify its target class; can operate without access to the training set; and is highly effective for various incorporation mechanisms. Our approach is evaluated - and found favorable - in comparison with an array of published defenses for a variety of attacks.