Universal Post-Training Backdoor Detection and Mitigation for Classifiers

A computer-implemented method for testing for overfitting bias for a trained neural network, the method comprising:

• receiving the trained neural network;
• defining a detection criterion for possible responses of the trained neural network based on the trained neural network's output logits;
• calculating a maximum for the detection criterion over a set of inputs to the trained neural network for two or more of the trained neural network's output logits;
• and
• testing for overfitting bias to a corresponding output logit based on the calculated maximum detection criteria.

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for testing for overfitting bias for a trained neural network, the method comprising:

• receiving the trained neural network;
• defining a detection criterion for possible responses of the trained neural network based on the trained neural network's output logits;
• calculating a maximum for the detection criterion over a set of inputs to the trained neural network for two or more of the trained neural network's output logits;
• and
• testing for overfitting bias to a corresponding output logit based on the calculated maximum detection criteria.

A testing system that tests for overfitting bias for a trained neural network, comprising:

• a processor;
• a memory;
• and
• a detection mechanism;
• wherein at least one of the processor and the detection mechanism are configured to receive the trained neural network and store the program instructions associated with the trained neural network in the memory;
• wherein the testing system is configured to:
• define a detection criterion for possible responses of the trained neural network based on the trained neural network's output logits;
• calculate a maximum for the detection criterion over a set of inputs to the trained neural network for two or more of the trained neural network's output logits;
• and
• test for overfitting bias to a corresponding output logit based on the calculated maximum detection criteria.