defense.sau

class sau(args)[source]

Bases: defense

Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

basic sturcture for defense method:

  1. basic setting: args

  2. attack result(model, train data, test data)

  3. sau defense:

    1. get some clean data

    2. SAU:

      1. generate the shared adversarial examples

      2. unlearn the backdoor model by the pertubation

  4. test the result and get ASR, ACC, RC

parser = argparse.ArgumentParser(description=sys.argv[0])
sau.add_arguments(parser)
args = parser.parse_args()
sau_method = sau(args)
if "result_file" not in args.__dict__:
    args.result_file = 'defense_test_badnet'
elif args.result_file is None:
    args.result_file = 'defense_test_badnet'
result = sau_method.defense(args.result_file)

Note

@inproceedings{wei2023shared, title={Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples}, author={Wei, Shaokui and Zhang, Mingda and Zha, Hongyuan and Wu, Baoyuan}, booktitle={Thirty-seventh Conference on Neural Information Processing Systems}, year={2023}}

Parameters:

  • args (baisc) – in the base class

  • n_rounds (str) – type of outer loop optimizer utilized

  • outer_steps (int) – the maximum number of unelarning rounds

  • lmd_1 (int) – steps for outer loop, the number of unlearning rounds

  • lmd_2 (float) – clean acc, L_cl

  • lmd_3 (float) – AT acc. By default, lmd_2 = 0 and AT is not used.

  • beta_1 (float) – shared adv risk, L_sar

  • beta_2 (float) – L_adv

  • trigger_norm (float) – L_share

  • pgd_init (float) – threshold for PGD. Larger may not be good.

  • norm_type (str) – init type for pgd. zero|random|max|min

  • adv_lr (str) – type of norm used for generating perturbation. L1|L2|L_inf|Reg

  • adv_steps (float) – lr for pgd

  • train_mode (bool) – number of steps for pgd