EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry

Understand

Backdoor attack injects malicious behavior to models such that inputs embedded with triggers are misclassified to a target label desired by the attacker.

• However, natural features may behave like triggers, causing misclassification once embedded.
• While they are inevitable, mis-recognizing them as injected triggers causes false warnings in backdoor scanning.
• A prominent challenge is hence to distinguish natural features and injected backdoors.