Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencoder

Understand

Deep neural networks are vulnerable to backdoor attacks, where an adversary manipulates the model behavior through overlaying images with special triggers.

• Existing backdoor defense methods often require accessing a few validation data and model parameters, which is impractical in many real-world applications, e.g., when the model is provided as a cloud service.
• In this paper, we address the practical task of blind backdoor defense at test time, in particular for local attacks and black-box models.
• The true label of every test image needs to be recovered on the fly from a suspicious model regardless of image benignity.