RePAIR repairs backdoored semantic segmentation models without retraining
Original title: RePAIR: Inverting Backdoor Attacks in Semantic Segmentation
The post-hoc, label-free method infers victim-target pairs from unlabeled images and corrects suspicious pixels.
Researchers introduce RePAIR, a post-hoc defense for semantic segmentation backdoors that send a chosen victim class to an attacker-specified class when a trigger is present. It builds a semantic reference from an unlabeled, possibly contaminated image pool and localizes suspicious pixels by comparing classifier-head predictions with internal features. Authors report that the method substantially lowers attack success across architectures while largely preserving clean performance, without retraining.
Unconfirmed: Attack-reduction and clean-performance claims are the authors' experimental results, not independently verified.
- Dedicated segmentation defenses are scarce and usually need retraining or model changes.
- RePAIR is attack-unaware and does not require labels.
- The attack is modeled as adversarial probability transport and repair as its reversal.
- Output constraints are meant to limit changes on benign predictions.
From the original article
1 min read at arxiv.orgDespite significant advances in computer vision, semantic segmentation models remain vulnerable to backdoor attacks, posing a security risk. These attacks redirect pixels of a chosen victim class to an attacker-specified target class when a trigger is present, while preserving clean predictions.
By Arnold Brosch · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.