Fine-Tuning Is All You Need to Mitigate Backdoor Attacks

1. I am somewhat worried about the claim in this paper "Fine-Tuning Is All You Need to Mitigate Backdoor Attacks". IMHO, it is a little bit overclaimed. At a high level, the authors only evaluate against vision models. Whether fine-tuning is enough for NLP models is not evaluated. For this point of view, we cannot say that fine-tuning is enough for mitigating backdoor attacks.

2. The proposed method needs better justification. Some design choices need to be justified. 2.1 Not sure the reason why the lr changes linearly in each phase, can we use another annealing method? 2.2 Not sure whether having two phases is the optimal choice; what if we only have phase 1 or phase 2, or can we have three phases? These questions may be able to be addressed with ablations studies, but not included in the current ablations study. 2.3 I assume the fine-tuning is using only the clean data, but this is not explicitly specified.

3. As mentioned in the paper, the defense efficacy depends largely on the learning rates, and it is very sensitive to the learning rate. With that said, I am worried about how to select the proper learning rate for different models. The tuning process might be tricky and requires a lot of effort and trials.

4. The evaluation is not comprehensive: 4.1 it is not sure whether changing trigger pattern and size will affect the fine-tuning process. Actually, the paper does not specify what type of triggers are used. 4.2 The evaluation does not have large-scale datasets, like imagenet 4.3 The evaluation misses some important baselines that also conduct fine-tuning [1,2,3]

[1] Adversarial neuron pruning purifies backdoored deep models [2] Adversarial unlearning of backdoors via implicit hypergradient [3] One-shot neural backdoor erasing via adversarial weight masking

1. The authors should evaluate their method under more complicated datasets, such as ImageNet or its subset.
2. There is no discussion about the resistance to potential adaptive attacks. What if the attackers know this defense? Can they design an adaptive method to bypass this defense easily?
3. I think the authors should compare their method with more advanced backdoor-removal defenses. All compared baseline defenses are at least two years before and their performance is still some way from the SOTA methods.
4. The authors should provide more in-depth discussions about how to design a better learning rate schedule and why the current one is good.

PS: Please place the appendix to your paper after the main contents rather than a separate document in the supplementary materials.

1. The number of studied attacks is still not sufficient to show that fine-tuning IS ALL YOU NEED. The authors should include more attacks to make the claim more convincing;

2. The amount of clean data available for the defender is too idealistic. Most defense research assumes that the defender only has a SMALL amount of clean data for fine-tuning, as otherwise, the defender can just train-from-scratch to get a clean model rather than downloading a pre-trained (and backdoored) model. So, the authors should test when 0.5%-1% clean data is available (e.g., 500 images for CIFAR-10).

3. The more challenging scenario is the standalone scenario which should be tested more thoroughly. Several attacks fails the the transfer learning scenario even without defense, so it is hard to believe it is the proposed method that works.

4. In the standalone scenario, in Figure 4, the Inputaware-GTSRB subplot, the ASR of super-fine-tuning is above 40%, but this was not analyzed in the paper? In Figure 3, the ASR of super-fine-tuning is only around 20%, which means the defense performance is not as strong as claimed in the text, i.e., the attacker can still succeed in 5 shots. This was also not analyzed.

5. The effectiveness and efficiency comparison missed the pruning-based methods, like [1,3], which I believe achieved the SOTA defense performance and efficiency. The advantage of the fine-tuning based method is not clear when compared with pruning-based methods which also leverage fine-tuning.

6. In the second last paragraph of Section 5.3, it says "super-fine-tuning can decrease the ASR of Blended backdoor from 0.998 to 0.081," whoever, 0.081 is 8.1% which is still quite high, when compared to other defense methods.

7. Missing the consideration of adaptive attacks, i.e., what if the adversary knows the adaptive learning rate scheduler and adapt its trigger injection to evade the meta-fine-tuning, could it be possible?

[1] Li, Yige, et al. "Reconstructive Neuron Pruning for Backdoor Defense." ICML, 2023. [2] Huang, Hanxun, et al. "Distilling Cognitive Backdoor Patterns within an Image." ICLR, 2023. [3] Wu, Dongxian, and Yisen Wang. "Adversarial neuron pruning purifies backdoored deep models." NeurIPS, 2021.

• I understand that in the transfer-based scenario, super-fine-tuning demonstrates its better capability in mitigating backdoor than the conventional fine-tuning method, but how super-fine-tuning works in encoder-based scenario remains unstudied.
• It is a strong statement to say that "Fine-tuning and super-fine-tuning is sufficient in most cases" in Conclusion. I believe more experiments in different model architectures are required to conclude this statement since currently only ResNet18 is being utilized.
• It seems like the epoch of both phases in super-fine-tuning is a variable that is worth discussing. Experiments on how the number of epochs of the First Phase affects the performance of mitigation might be necessary.

• In a transfer learning scenario, does the proposed defense recommend to freeze the feature extraction layers during fine-tuning? Typically, in transfer learning, it's common practice to freeze the feature extraction layers and fine-tune only the classification layers. However, the authors assert that their defense approach comes with zero computational cost in the context of transfer learning. It is important to clarify whether, in this zero-cost defense, users should still freeze the feature extraction layers and only fine-tune the classification layers. If not, it implies that this defense may not truly have zero computational cost in the general case of transfer learning scenarios.
• It seems that there are related works that perform fine-tuning with varying learning rates while utilizing a smaller validation set in contrast to the entire training dataset employed in the proposed defense. For instance, "NNoculation: Catching BadNets in the Wild."
• How did the authors determine the base learning rate, maximum learning rate, and the number of fine-tuning steps? Providing insight into the rationale behind these choices, along with a framework for tuning the hyperparameters of the defense, would significantly enhance the paper's generalizability. Without such guidance, the proposed hyperparameter values in the paper may not be universally applicable to all datasets and model architectures. For example, setting the maximum learning rate to 0.01, as suggested in the ResNet paper, may limit the defense's effectiveness when applied to different model architectures. It's essential to include the computational costs associated with hyperparameter tuning in the evaluation of the defense.
• The intuition behind super-fine-tuning is not entirely clear to me. By employing an exceedingly high learning rate, the model appears to discard not only the backdoor but also the utility it previously learned. Subsequently, using a smaller learning rate aids in relearning the utility. In essence, this process seems equivalent to training a model from scratch with randomly initialized weights in the standalone scenario. It would be helpful to provide further clarification on this point, perhaps by comparing the proposed defense to training the entire model from scratch with randomly initialized weights while utilizing the same computational resources and ensuring proper hyperparameter tuning.
• Kindly discuss the limitation of the proposed defense. It's worth noting that backdooring can still be a threat in situations where a user has ample computational resources but lacks access to high-quality, clean training data. This might be due to privacy concerns or the prohibitive costs of labeling data. In such cases, it's important to discuss the applicability of the proposed defense, especially since it assumes access to the entire clean training dataset.