Backdoor Defense with Colored Patches for Machine Learning Models

In this paper, we propose defense methods with using colored patches against backdoor attacks to machine learning (ML) models such as convolutional neural network models. Considering that if the patch color used for defense is simply black, the Attack Success Rate (ASR) and classification accuracy may be affected. For exploring this issue, we introduce a new element that dynamically changes the color of the patches used for defense, such as the average color of the entire image or of the area near the location where the patches are applied. In this study, we conduct experiments using the CIFAR-10 dataset and the GTSRB dataset for the attack method, which is referred to as conditional Backdoor Generating Network (c-BaN) as the target attack method. The effectiveness is shown from ASR, accuracy before and after defense. These results show that the proposed method reduces the ASR and improves the classification accuracy, indicating that the use of colored patches for defense is an effective method for backdoor attack.