Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a
training time attack that injects a trigger pattern into a small proportion of
training data so as to control the model’s prediction at the test time.
Backdoor attacks are notably dangerous since they do not affect the model’s
performance on clean examples, yet can fool the model to make incorrect
prediction whenever the trigger pattern appears during testing. In this paper,
we propose a novel defense framework Neural Attention Distillation (NAD) to
erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to
guide the finetuning of the backdoored student network on a small clean subset
of data such that the intermediate-layer attention of the student network
aligns with that of the teacher network. The teacher network can be obtained by
an independent finetuning process on the same clean subset. We empirically
show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase
the backdoor triggers using only 5% clean training data without causing
obvious performance degradation on clean examples.