{"id":"https://openalex.org/W4396790450","doi":"https://doi.org/10.1109/satml59370.2024.00021","title":"REStore: Exploring a Black-Box Defense against DNN Backdoors using Rare Event Simulation","display_name":"REStore: Exploring a Black-Box Defense against DNN Backdoors using Rare Event Simulation","publication_year":2024,"publication_date":"2024-04-09","ids":{"openalex":"https://openalex.org/W4396790450","doi":"https://doi.org/10.1109/satml59370.2024.00021"},"language":"en","primary_location":{"id":"doi:10.1109/satml59370.2024.00021","doi":"https://doi.org/10.1109/satml59370.2024.00021","is_oa":false,"landing_page_url":"https://doi.org/10.1109/satml59370.2024.00021","pdf_url":null,"source":{"id":"https://openalex.org/S7407087861","display_name":"IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hal.science/hal-04485197/document","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015656596","display_name":"Quentin Le Roux","orcid":"https://orcid.org/0009-0006-8983-0415","observed_orcids":["https://orcid.org/0009-0006-8983-0415"]},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]},{"id":"https://openalex.org/I4210133778","display_name":"Centre Inria de l'Universit\u00e9 de Rennes","ror":"https://ror.org/04040yw90","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"id":"https://openalex.org/I4210140930","display_name":"Thales (France)","ror":"https://ror.org/04emwm605","country_code":"FR","type":"company","lineage":["https://openalex.org/I4210140930"]},{"id":"https://openalex.org/I4405258575","display_name":"LINKMEDIA: Creating and exploiting explicit links between multimedia fragments","ror":"https://ror.org/00xkg0532","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210133778","https://openalex.org/I4210159245","https://openalex.org/I4405258575","https://openalex.org/I56067802"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Quentin Le Roux","raw_affiliation_strings":["Thales DIS,La Ciotat,France","INRIA, Rennes, France","LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)","THALES [France] (France)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Thales DIS,La Ciotat,France","institution_ids":["https://openalex.org/I4210140930"]},{"raw_affiliation_string":"INRIA, Rennes, France","institution_ids":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"raw_affiliation_string":"LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)","institution_ids":["https://openalex.org/I4405258575"]},{"raw_affiliation_string":"THALES [France] (France)","institution_ids":["https://openalex.org/I4210140930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046279472","display_name":"Kassem Kallas","orcid":"https://orcid.org/0000-0001-7689-4125","observed_orcids":["https://orcid.org/0000-0001-7689-4125"]},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]},{"id":"https://openalex.org/I4210133778","display_name":"Centre Inria de l'Universit\u00e9 de Rennes","ror":"https://ror.org/04040yw90","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"id":"https://openalex.org/I4405258575","display_name":"LINKMEDIA: Creating and exploiting explicit links between multimedia fragments","ror":"https://ror.org/00xkg0532","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210133778","https://openalex.org/I4210159245","https://openalex.org/I4405258575","https://openalex.org/I56067802"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Kassem Kallas","raw_affiliation_strings":["INRIA, Rennes, France","LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRIA, Rennes, France","institution_ids":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"raw_affiliation_string":"LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)","institution_ids":["https://openalex.org/I4405258575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5062906790","display_name":"Teddy Furon","orcid":"https://orcid.org/0000-0002-1565-765X","observed_orcids":["https://orcid.org/0000-0002-1565-765X"]},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]},{"id":"https://openalex.org/I4210133778","display_name":"Centre Inria de l'Universit\u00e9 de Rennes","ror":"https://ror.org/04040yw90","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"id":"https://openalex.org/I4405258575","display_name":"LINKMEDIA: Creating and exploiting explicit links between multimedia fragments","ror":"https://ror.org/00xkg0532","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210133778","https://openalex.org/I4210159245","https://openalex.org/I4405258575","https://openalex.org/I56067802"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Teddy Furon","raw_affiliation_strings":["INRIA, Rennes, France","LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRIA, Rennes, France","institution_ids":["https://openalex.org/I1326498283","https://openalex.org/I4210133778"]},{"raw_affiliation_string":"LinkMedia - Creating and exploiting explicit links between multimedia fragments (Campus de Beaulieu 35042 Rennes cedex - France)","institution_ids":["https://openalex.org/I4405258575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4686,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.82551721,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"Proceedings of the 2nd IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","issue":null,"first_page":"286","last_page":"308"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.9139999747276306},{"id":"https://openalex.org/keywords/black-box-defense","display_name":"black-box defense","score":0.75},{"id":"https://openalex.org/keywords/rare-event-simulation","display_name":"rare event simulation","score":0.8870000243186951},{"id":"https://openalex.org/keywords/importance-splitting","display_name":"importance splitting","score":0.8619999885559082},{"id":"https://openalex.org/keywords/sequential-monte-carlo","display_name":"sequential Monte Carlo","score":0.9039999842643738},{"id":"https://openalex.org/keywords/deep-neural-network-security","display_name":"deep neural network security","score":0.7390000224113464},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":0.6600000262260437}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9321194887161255},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.777457594871521},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.6122618913650513},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.5878342390060425},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5021483898162842},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.49858522415161133},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4608025550842285},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.457767516374588},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.44690579175949097},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.43583187460899353},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33726346492767334},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/satml59370.2024.00021","doi":"https://doi.org/10.1109/satml59370.2024.00021","is_oa":false,"landing_page_url":"https://doi.org/10.1109/satml59370.2024.00021","pdf_url":null,"source":{"id":"https://openalex.org/S7407087861","display_name":"IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML)","raw_type":"proceedings-article"},{"id":"pmh:oai:HAL:hal-04485197v1","doi":null,"is_oa":true,"landing_page_url":"https://hal.science/hal-04485197","pdf_url":"https://hal.science/hal-04485197/document","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4405252976","host_organization_name":"Centre pour la Communication Scientifique Directe","host_organization_lineage":["https://openalex.org/I4405252976"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"SaTML 2024 - 2nd IEEE Conference on Secure and Trustworthy Machine Learning, Apr 2024, Toronto, Canada. pp.286-308","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:HAL:hal-05111082v1","doi":null,"is_oa":true,"landing_page_url":"https://hal.science/hal-05111082","pdf_url":null,"source":{"id":"https://openalex.org/S4306402512","display_name":"HAL","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4405252976","host_organization_name":"Centre pour la Communication Scientifique Directe","host_organization_lineage":["https://openalex.org/I4405252976"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), Apr 2024, Toronto, France. pp.286-308, ⟨10.1109/SaTML59370.2024.00021⟩","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:HAL:hal-04485197v1","doi":null,"is_oa":true,"landing_page_url":"https://hal.science/hal-04485197","pdf_url":"https://hal.science/hal-04485197/document","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4405252976","host_organization_name":"Centre pour la Communication Scientifique Directe","host_organization_lineage":["https://openalex.org/I4405252976"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"SaTML 2024 - 2nd IEEE Conference on Secure and Trustworthy Machine Learning, Apr 2024, Toronto, Canada. pp.286-308","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G8415268695","display_name":"Security of AI for Defense Applications","funder_award_id":"ANR-20-CHIA-0011","funder_id":"https://openalex.org/F4320320883","funder_display_name":"Agence Nationale de la Recherche"}],"funders":[{"id":"https://openalex.org/F4320320883","display_name":"Agence Nationale de la Recherche","ror":"https://ror.org/00rbzpz17"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4396790450.pdf","grobid_xml":"https://content.openalex.org/works/W4396790450.grobid-xml"},"referenced_works_count":49,"referenced_works":["https://openalex.org/W1509966554","https://openalex.org/W1932198206","https://openalex.org/W1945616565","https://openalex.org/W2003223892","https://openalex.org/W2063066676","https://openalex.org/W2112796928","https://openalex.org/W2543927648","https://openalex.org/W2616247523","https://openalex.org/W2748789698","https://openalex.org/W2753783305","https://openalex.org/W2774423163","https://openalex.org/W2784874046","https://openalex.org/W2807363941","https://openalex.org/W2898759955","https://openalex.org/W2915783303","https://openalex.org/W2916360674","https://openalex.org/W2934843808","https://openalex.org/W2951884431","https://openalex.org/W2956034423","https://openalex.org/W2965527544","https://openalex.org/W2966104011","https://openalex.org/W2966689772","https://openalex.org/W2971661634","https://openalex.org/W2979390449","https://openalex.org/W2988471847","https://openalex.org/W2990138404","https://openalex.org/W3007112707","https://openalex.org/W3010216907","https://openalex.org/W3013170989","https://openalex.org/W3042368254","https://openalex.org/W3083185154","https://openalex.org/W3092003702","https://openalex.org/W3107337211","https://openalex.org/W3118608800","https://openalex.org/W3127981240","https://openalex.org/W3130788031","https://openalex.org/W3138646989","https://openalex.org/W3168256814","https://openalex.org/W3178326529","https://openalex.org/W3204704497","https://openalex.org/W3209853255","https://openalex.org/W3210327063","https://openalex.org/W3210377054","https://openalex.org/W3211600423","https://openalex.org/W4226002507","https://openalex.org/W4252979261","https://openalex.org/W4361230562","https://openalex.org/W6787972765","https://openalex.org/W7133194765"],"related_works":["https://openalex.org/W4404577579","https://openalex.org/W2934843808","https://openalex.org/W4403791880","https://openalex.org/W4402916397","https://openalex.org/W4378474101","https://openalex.org/W3138646989","https://openalex.org/W4386185023","https://openalex.org/W7208754725","https://openalex.org/W4390872105","https://openalex.org/W4415795615"],"abstract_inverted_index":{"Backdoor":[0],"attacks":[1,35],"pose":[2],"a":[3,17,21,37,44,48,58,80,93,123,127],"significant":[4],"threat":[5],"to":[6,15,47,88,126,153],"deep":[7],"neural":[8,65],"networks":[9],"as":[10,69],"they":[11],"allow":[12],"an":[13,70],"adversary":[14],"inject":[16],"malicious":[18],"behavior":[19],"in":[20,36,64,104,114],"victim":[22],"model":[23,128,189],"during":[24],"training.":[25],"This":[26],"paper":[27],"addresses":[28],"the":[29,41,90,151,161,170,179,192],"challenge":[30],"of":[31,92,163,181,195],"defending":[32,74],"against":[33,75],"backdoor":[34],"black-box":[38,81,115,173],"setting":[39],"where":[40],"defender":[42,82],"has":[43],"limited":[45],"access":[46,125],"suspicious":[49],"model.":[50],"In":[51],"this":[52],"paper,":[53],"we":[54,149],"introduce":[55],"Importance":[56],"Splitting,":[57],"Sequential":[59],"Monte-Carlo":[60],"method":[61,141],"previously":[62],"used":[63],"network":[66],"robustness":[67],"certification,":[68],"off-the-shelf":[71],"tool":[72],"for":[73],"backdoors.":[76],"We":[77,138,147],"demonstrate":[78,154],"that":[79,155,177],"can":[83],"leverage":[84],"rare":[85,164],"event":[86,165],"simulation":[87],"assess":[89],"presence":[91],"backdoor,":[94],"reconstruct":[95],"its":[96,131],"trigger,":[97],"and":[98,145],"finally":[99],"purify":[100],"test-time":[101],"input":[102,109,174],"data":[103],"real-time.":[105],"So-called":[106],"REStore,":[107],"our":[108,140],"purification":[110,175],"defense":[111,176],"proves":[112],"effective":[113],"scenarios":[116],"because":[117],"it":[118],"uses":[119],"triggers":[120],"recovered":[121],"with":[122],"query":[124],"(only":[129],"observing":[130],"logit,":[132],"probit,":[133],"or":[134,191],"top-1":[135],"label":[136],"outputs).":[137],"test":[139],"on":[142],"MNIST,":[143],"CIFAR-10,":[144],"CASIA-Webface.":[146],"believe":[148],"are":[150],"first":[152,171],"backdoors":[156],"may":[157],"be":[158],"considered":[159],"under":[160],"lens":[162],"simulation.":[166],"Moreover,":[167],"REStore":[168,185],"is":[169],"one-stage,":[172],"approaches":[178],"performance":[180],"more":[182],"complex":[183],"comparables.":[184],"avoids":[186],"gradient":[187],"estimation,":[188],"reconstruction,":[190],"vulnerable":[193],"training":[194],"additional":[196],"models.":[197]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":2}],"updated_date":"2026-10-30T12:39:25.321706","created_date":"2024-05-11T00:00:00"}