# Backdoor Scanning for Deep Neural Networks through K-Arm Optimization

Guangyu Shen  Yingqi Liu  Guanhong Tao  Shengwei An  Qiuling Xu  Siyuan Cheng
Shiqing Ma  Xiangyu Zhang

###### Abstract

Back-door attack poses a severe threat to deep learning systems. It injects
hidden malicious behaviors to a model such that any input stamped with a
special pattern can trigger such behaviors. Detecting back-door is hence of
pressing need. Many existing defense techniques use optimization to generate
the smallest input pattern that forces the model to misclassify a set of
benign inputs injected with the pattern to a target label. However, the
complexity is quadratic to the number of class labels such that they can
hardly handle models with many classes. Inspired by Multi-Arm Bandit in
Reinforcement Learning, we propose a K-Arm optimization method for backdoor
detection. By iteratively and stochastically selecting the most promising
labels for optimization with the guidance of an objective function, we
substantially reduce the complexity, allowing to handle models with many
classes. Moreover, by iteratively refining the selection of labels to
optimize, it substantially mitigates the uncertainty in choosing the right
labels, improving detection accuracy. At the time of submission, the
evaluation of our method on over 4000 models in the IARPA TrojAI competition
from round 1 to the latest round 4 achieves top performance on the
leaderboard. Our technique also supersedes five state-of-the-art techniques in
terms of accuracy and the scanning time needed. The code of our work is
available at https://github.com/PurduePAML/K-ARM_Backdoor_Optimization

Machine Learning, ICML

##  1 Introduction

The semantics of a deep neural network is determined by model parameters that
are not interpretable. Trojan (back-door) attack exploits the
uninterpretability and injects malicious hidden behaviors to neural networks.
To activate back-door behavior, the attacker stamps a trigger to a benign
input and passes the stamped input to the trojaned model, which then
misclassifies the input to the target label. When benign inputs are provided,
the trojaned model has comparable accuracy as the original one. The
feasibility of trojan attack has been demonstrated by many existing works. For
example, data poisoning (Gu et al., 2017) directly uses stamped inputs in
training to inject back-door. Neuron hijacking (Liu et al., 2018b) compromises
a small number of selected neurons by changing their associated weight values
through input reverse engineering and retraining. Clean-label attack (Shafahi
et al., 2018) injects malicious features to the target class samples instead
of victim class samples, and hence is more stealthy. More discussion can be
found in the related work section.

Realizing the prominent threat, researchers have developed a number of defense
techniques that range from detecting malicious (stamped) inputs at runtime (Ma
& Liu, 2019) to offline model scanning for possible back-doors (Liu et al.,
2019; Wang et al., 2019; Kolouri et al., 2020). The former is an on-the-fly
technique and requires the presence of malicious inputs. The latter determines
if a given model contains any backdoor. It usually assumes a small set of
benign inputs for all the classes of the model but not any malicious inputs.
Existing scanners usually consider two types of backdoors. The first is
universal backdoor that causes misclassification (to the target label) for
benign samples from any class when they are stamped with the trigger. The
second is label-specific backdoor that only causes misclassification of benign
samples from a specific victim class to the target label, when they are
stamped with the trigger. Neural Cleanse (NC) (Wang et al., 2019) uses
optimization to derive a trigger for each class and observes if there is any
trigger that is exceptionally small and hence likely injected instead of
naturally occurring feature. Artificial Brain Stimulation (ABS) (Liu et al.,
2019) systematically intercepts and changes internal neuron activation values
on benign inputs, and then observes if consistent misclassification can be
induced. If so, the corresponding neurons are considered compromised and used
to reverse engineer a trigger. More existing techniques are discussed in the
related work section. Although the effectiveness of existing solutions has
been demonstrated, they have various limitations. In particular, since the
target label is unknown beforehand, scanners such as NC try to scan all
labels. If the backdoor is label-specific, the computation complexity is
quadratic. As such they can hardly handle models with many classes. For
example, NC cannot finish scanning a TrojAI round 2 model with 23 classes
within 15 hours. Techniques like ABS leverages additional analysis to pre-
select a set of labels/neurons to optimize. However, their effectiveness
hinges on the correctness of pre-selection.

(a) Pre-selection

(b) ABS

Figure 1: Motivation cases: (a) illustrates pre-selection fails to identify
backdoor in Model #56 in TrojAI round 2; (b) shows that ABS fails to identify
backdoor in Model #13 in TrojAI round 1.

(a) (R4 model #556) victim class #13 input + trigger

(b) (R4 model #556) target class #1 input

(c) (R4 model #262) class #4 input + generated natural feature

(d) (R4 model #262) class #20 input + generated natural feature

Figure 2: Motivation cases: (a) illustrates a victim class #13 input of a
round 4 (R4) trojaned model stamped with trigger generated by K-Arm, yielding
the classification result of label #1; (b) shows a target class #1 input for
the same model; (c) shows a class #4 input of a clean R4 model stamped with
natural features generated by K-Arm, yielding label 20; (d) shows a class #20
input stamped with generated natural features for the same model in (c),
yielding label 4.

We propose a new back-door scanning method that can handle models with many
classes and has better effectiveness and efficiency than existing solutions.
Inspired by K-Arm bandit (Auer et al., 2002) in Reinforcement Learning that
optimizes decision making with a large number of possible options, we propose
a K-Arm backdoor scanner. Instead of optimizing for all the labels one-by-one,
the process is divided to many rounds and in each round, our algorithm selects
one to optimize for a small number of epochs. The selection is stochastic,
guided by an objective function. The function measures the past progress of a
candidate label, e.g., how fast a small trigger can be generated to
misclassify stamped inputs to the label, as a trigger is generally easy to
optimize if the label is trojaned, and how small the trigger is. The
stochastic nature of the method ensures that even if the true target label is
not selected for the current round, it still has a good chance to be selected
later. To our knowledge, we are the first to bring reinforcement learning
(K-Arm Bandit) into the neural backdoor detection domain and substantially
improve the scanner’s efficiency and capability. Natural features sometimes
behave similarly to backdoors. To distinguish the two, we develop a symmetric
optimization algorithm that piggy-backs on the K-Arm backbone. It leverages
the following observation: while it is easy to optimize a trigger that flips
victim label to target label, the inverse (i.e., optimize a trigger that flips
target label to victim label) is difficult; natural features, however, do not
have this property.

We evaluate our prototype on 4000 models from IARPA TrojAI round 1 to the
latest round 4 competitions, and a few complex models on ImageNet. Our
technique achieved top performance on the TrojAI leaderboard and reached the
round targets on the TrojAI test server for all rounds. It is substantially
more effective than the state-of-the-art techniques NC, ABS, and ULP (Kolouri
et al., 2020) by having 31%, 20%, and 27% better accuracy, respectively. In
addition, its scanning time is a few times to orders of magnitude smaller than
other optimization based methods, especially in scanning label-specific
backdoors.

##  2 Related Work

Besides the ones mentioned in the introduction, we further briefly discuss
additional related work and our threat model.

Trojan Attack. Several data-poisoning like attacks (Gu et al., 2017; Liu et
al., 2018b) utilize patch/watermark triggers. Clean-label attacks (Shafahi et
al., 2018; Saha et al., 2020; Turner et al., 2019; Zhao et al., 2020; Zhu et
al., 2019) inject back-door without changing data label. Salem et al. (2020);
Nguyen & Tran (2020) leveraged generative models to construct dynamic triggers
with random patterns and locations for specific samples. Composite attack (Lin
et al., 2020) uses natural features from multiple labels as triggers. Bit
flipping (Rakin et al., 2019, 2020) injects malicious behaviors by flipping
bits in model weights. Trojan attacks have been developed for transfer
learning (Rezaei & Liu, 2019; Wang et al., 2018; Yao et al., 2019), federated
learning (Bagdasaryan et al., 2020; Xie et al., 2019; Wang et al., 2020b) and
NLP tasks (Chen et al., 2020; Sun, 2020).

Existing Detection. ULP (Kolouri et al., 2020) trains a classifier to
determine if a model is trojaned. It leverages a large pool of benign and
trojaned models to learn a set of universal input patterns that can lead to
different logits for benign and trojaned models. The classifier is then
trained on these logits. Similar to ULP (Kolouri et al., 2020), researchers in
(Huang et al., 2020) proposed one-pixel signature. They trained a classifier
to predict the model’s benignity based on their one-pixel signature. Qiao et
al. (2019) proposed to generate trigger distribution. Zhang et al. (2020);
Wang et al. (2020c) leveraged the differences of adversarial examples for
benign and trojaned models to detect backdoors. TABOR (Guo et al., 2019) used
explainable AI techniques to scan backdoors. Xu et al. (2019) detected
backdoors using Meta Neural Analysis. Liu et al. (2018a) combined pruning and
fine-tuning to weaken or even eliminate backdoors. Wang et al. (2020a)
certified model robustness against backdoor via randomized smoothing. Chan &
Ong (2019); Gao et al. (2019); Chen et al. (2018); Chou et al. (2020); Du et
al. (2019); Liu et al. (2017); Ma & Liu (2019) aimed to detect if a provided
input contains trigger. Comprehensive surveys of backdoor learning can be
found at (Li et al., 2020a, b)

Multi-Arm Bandit. Multi-Arm Bandit (MAB) describes the dilemma of making a
sequence of decisions to maximize reward, which has an unknown distribution.
It has been thoroughly studied in (Auer et al., 2002). Many solutions are
proposed to tackle this problem, such as Upper Confidence Bound (UCB) (Auer,
2002), $\epsilon$-greedy (Watkins, 1989), etc. MAB is a general idea with many
applications, Our design is inspired by MAB and unique for backdoor detection.

Threat Model We consider a standard setting in the backdoor scanning. Given a
model and a small set of clean images without trigger information for each
class (less than 20), the defender is required to identify whether the model
is trojaned or not. In this paper, we mainly discuss the backdoor with limited
size on the propose of stealthiness, such as patch triggers (Liu et al.,
2018b) or small perturbations (Saha et al., 2020). The injected backdoor can
be static (Gu et al., 2017), input aware dynamic (Nguyen & Tran, 2020), label-
specific or global. Large triggers such as the composite attack (Lin et al.,
2020) and filter triggers (Liu et al., 2019; Cheng et al., 2020) are out of
the scope. We will leave it to the future work.

##  3 Motivation

In this section, we discuss the limitations of existing optimization based
backdoor scanners and motivate ours.

NC (Wang et al., 2019) cannot handle models with many classes. Assume a model
has $N$ classes. Since the target label is unknown, to detect universal
backdoors, NC considers each of the $N$ labels could be the target label and
optimizes a trigger that flips benign samples from any class to the label. To
detect label specific backdoors, it considers each pair of labels could be the
victim and target labels, and optimizes a trigger to flip only samples of the
victim class to the target label. It then checks if there is an exceptionally
small trigger (among all those generated). If so, the model is considered
having a backdoor. The computation complexity is hence $\mathcal{O}(N)$ for
universal backdoors and $\mathcal{O}(N^{2})$ for label specific backdoors. Our
experiment (in Section 5) shows that to scan a model on ImageNet with a
universal backdoor, NC needs more than 55 hours. It certainly cannot handle
label-specific backdoors on such models.

Pre-selection may miss the correct label(s). To address the above limitation,
a pre-selection strategy was proposed in (Wang et al., 2019) to select a small
subset of labels to proceed after 10 steps of optimization. Specifically, it
selects the $m$ smallest triggers to continue. However, its effectiveness
hinges on the correctness of pre-selection, which is difficult to achieve due
to the uncertainty in optimization. Fig.1(a) illustrates how pre-selection
fails on a TrojAI round 2 model (with a universal backdoor). Due to the small
time budget allowed for scanning a TrojAI model (600s in round 2), top 5
labels are pre-selected out of 14. Observe that the trigger size of the target
label is still much larger than most of the other labels after 10 steps and
precluded. The situation is aggravated when the number of classes is large and
backdoors are label-specific. In fact, our results show that pre-selection can
only achieve 58% accuracy on average in TrojAI rounds 1 to 4 training sets.

ABS may select the wrong neurons in stimulation analysis. ABS (Liu et al.,
2019) avoids optimizing for individual labels/label-pairs. It systematically
enlarges internal neuron activation values for benign inputs and observes if
consistent misclassification (to a certain label) can be achieved. If so, the
neurons are considered potentially compromised by trojaning. It then uses
optimization to generate a trigger by maximizing the activation values of
these neurons. A model is considered trojaned if the generated trigger can
cause the intended misclassification. It works for both universal and label-
specific backdoors. Its effectiveness hinges on correctly identifying the
compromised neurons, which has inherent uncertainty as well. Fig. 1(b) shows
that for a trojaned model $\\#13$ in TrojAI round 1, the top 10 neurons that
have the largest elevation for the target label logits when stimulated (and
hence cause misclassification to the target label) do not include the truly
compromised neuron, which is ranked 134 by the stimulation analysis. As such,
trigger generation based on the top 10 neurons fails to derive the real
trigger. In our experiment, ABS can only achieve 69% detection accuracy on
average for TrojAI rounds 1 to 4.

Existing scanners cannot distinguish triggers from natural features. Natural
features can induce misclassification in a way similar to backdoor triggers.
For example, stamping a dog nose to cat images may induce misclassification to
dog. As such, optimization based trigger generation like NC and ABS may
generate natural features as triggers. Distinguishing the two is important as
misclassification caused by natural features is inevitable and a model should
not be blamed for their presence; and correctly separating natural features
from injected triggers allows model end users to employ proper counter
measures. Many TrojAI models have natural features that behave like triggers.
Fig. 2(c) presents a benign TrojAI model #262 in round 4, with a class #4
input stamped with the natural features generated by K-Arm (i.e., the pixel
pattern inside the red box). It causes the model to misclassify to label 20
(shown in (d)). The inputs to TrojAI models are traffic-sign like foreground
objects (e.g., the triangle in Fig. 2(a) and the octagon in Fig. 2(b)) with
randomly chosen street-view background. More information can be found in
Appendix.D. Observe classes #4 and #20 are similar, and the generated features
in (c) resemble the central symbol of class #20, which explains the
misclassification. Both NC and ABS consider the natural features as a trigger
and report the model as trojaned.

Our Method. From the above discussion, we can observe that a key challenge
lies in the inherent uncertainty in selecting the appropriate label (in NC) or
neuron(s) (in ABS) to perform optimization. An exhaustive method like NC
without selection is not effective for complex models while pre-selection and
ABS making deterministic choices may fail to select the right one. The
overarching idea of our method is to formulate the whole procedure as a
stochastic process in which we continue to make selection at each round. Here
and in the rest of the paper, an optimization round does not mean an
optimization epoch in the traditional sense but rather finding a smaller
trigger (that can cause misclassification). In particular, a selected
label/label-pair/neuron that continues to perform well over time (i.e., whose
trigger has been easy to optimize) will have a high probability to be selected
in the new round. A label/label-pair/neuron that does not get selected in one
round has a probability to be selected in the future. The goal is to allow the
true positive to eventually stand out.

Specifically, we start with a warm-up phase in which we optimize each label
(to generate trigger) for a very small number of rounds (2 in this paper). We
retain a history of trigger size variation for each label. Then we start the
selective optimization. At each round of selective optimization, we select the
label that has the best performance over-time. We use an objective function to
measure the performance. For the moment, readers can intuitively consider that
we utilize the derivative of trigger size (i.e., how fast the trigger size
changes). Note that for a clean label, although the optimization may produce a
small trigger at the beginning, it cannot achieve substantial size reduction
over time. Therefore, its performance degrades and tends to be replaced. In
contrast, although the target label may not perform well at the beginning and
hence not be selected, it is eventually selected when the other optimizations
get stuck.

Fig. 3 shows the trigger size variations of all labels over multiple rounds of
optimization for two models from TrojAI. Observe that after the first round,
the target label has the smallest trigger for model $\\#15$ and hence pre-
selection handles it correctly. In contrast for model $\\#18$, the target
label’s trigger is very large and precluded (by pre-selection) from further
optimization. Observe that it remains larger than many others till round 5.
However, with our method, it eventually stands out and exposes the backdoor.

The algorithm also seamlessly facilitates separation of natural features and
backdoor triggers. Specifically, when two benign classes $A$ and $B$ are
similar (e.g., cat and dog), small natural features (of $A$) can be identified
to flip $B$ samples to $A$ when they are stamped with the features, just like
a trigger. Observe that since the two classes are similar, small natural
features can be easily identified to flip $A$ to $B$ as well. For example in
Fig 2(d), the generated trigger to flip class #20 to #4 has a similar small
size as that in Fig. 2(c). In contrast, such symmetry is unlikely for real
backdoors as generating a trigger to flip the target label to the victim label
tends to be difficult. For example, Fig. 2(a) shows a trigger (the pixel in
the red box) for model #556 in round 4 that has a label-specific backdoor from
class #13 to class #1. It is sufficient to flip all class #13 inputs to class
#1 (i.e., Fig. 2(b)). However, due to the differences of the two classes,
flipping class #1 inputs to class #13 is much more difficult. Hence, we extend
the algorithm such that when it decides to optimize for a victim-target label
pair, it also sufficiently optimizes along the opposite direction to check
symmetry.

Figure 3: Trigger size variations over optimization rounds

##  4 Design

Fig. 4 presents the overview of our technique. On the left is the trigger
optimizer (Section 4.1) that performs one round of trigger optimization at a
time. In each round the optimizer generates a smaller trigger (than before)
that causes a given set of benign samples to be misclassified to a target
label, or returns failure when such a trigger cannot be found within a fixed
number of epochs. On the right is the K-Arm scheduler (Section 4.2) that
decides which arm should be optimized next. Assume a model has $N$ classes. To
identify universal backdoor, we create $N$ (optimization) arms, each having
one of the $N$ labels as the target label and aiming to generate a trigger to
flip benign samples from the remaining $N-1$ classes to the target label. To
identify label-specific backdoor, we create $N\times(N-1)$ arms (i.e., all the
pair-wise combinations), each aiming to flip samples of a victim class to a
target label. Hence, the scheduler selects from the $K=N+N\times(N-1)$ arms.
In the diagram, there are two cycles inside the scheduler representing two
optimization phases. The top cycle denotes the warm-up phase that optimizes
all arms for two rounds. The scheduler receives and retains the generated
trigger information for later use. The bottom cycle denotes the later
selective optimization phase, in which one selected arm is optimized in each
round. The selective optimization terminates when we can get a sufficiently
small trigger or the time budget runs out. To improve efficiency, the
scheduler is facilitated by a prescreening phase to reduce unnecessary arms
(Section 4.3). It also considers symmetry during selection to distinguish
nature features from triggers (Section 4.4).

Figure 4: K-arm optimization workflow

###  4.1 Trigger Optimizer

In each round, the trigger optimizer optimizes one selected arm, generating a
trigger for the target label of the arm. Specifically, a trigger $T$ is
composed of two parts: pattern $P$ and mask $M$ with the former deciding the
input values of a trigger and the latter deciding the shape/position of the
trigger. Given a clean input $x$ and a trigger, the stamped input $\hat{x}$ is
defined as follows.

$\small\hat{x}=(1-M)\cdot x+M\cdot P$ (1)

Here, operator $\cdot$ stands for the element-wise production. Given an $x$ of
dimensions $[C,H,W]$, the dimensions of pattern $P$ and $M$ are identical to
$x$’s. The values of $P$ are in the range of $[0,255]$ and the values of $M$
are in the range of $[0,1]$. Intuitively, stamping a trigger is by mixing $x$
and $P$ through the mask $M$. Given a model $\mathcal{F}$, a target label $t$,
and a set of inputs $X$, the trigger optimization for $t$ is defined as
follows.

$\displaystyle\min_{P,M}(\mathcal{L}(t,\mathcal{F}((1-M)\cdot X+M\cdot
P))+\alpha\lVert M\rVert_{1}),\forall x\in X$ (2)

For an arm of generating universal trigger, $X$ contains a set of clean inputs
from classes other than $t$; for an arm of generating label-specific trigger,
$X$ contains a set of clean inputs from the victim class. $\mathcal{L}$ stands
for the cross-entropy loss function. Hyper-parameter $\alpha$ balances the
attack success rate and the size of the optimized trigger. The optimizer
finishes a round and returns if the current trigger $T$ satisfies the
following condition.

$\small Acc(\hat{X},t)\geq\theta\ \mathop{and}\ \lVert M\rVert_{1}<\lVert
M_{p}\rVert_{1}$

Intuitively, the attack success rate with the trigger needs to be greater than
a threshold $\theta$, which is 0.99 in this paper, meaning samples stamped
with the trigger have higher than 99% chance to be classified to $t$, and the
current trigger is smaller than the previous one $M_{p}$. The optimizer may
return failure for the current round when the budget for the label runs out
(which is 10 epochs in this paper).

###  4.2 K-Arm Scheduler

To handle uncertainty in arm selection, we leverage the $\epsilon$-greedy
algorithm (Watkins, 1989) to introduce randomness in our selection. The idea
is to draw a random sample from a distribution, which is a uniform
distribution from 0 to 1 in this paper. If the sample is larger than a
threshold $\epsilon$, we rely on an objective function to make the selection;
otherwise, a random arm is selected. The procedure of selecting label $L$ is
formally defined as follows.

$\displaystyle L$ $\displaystyle=\left\\{\begin{aligned}
&\mathop{\arg\max}_{l}\ A(l),\ s>\epsilon\\\ &rand(K),\ s<\epsilon\\\
\end{aligned}\right.,\ \mathop{with}\ s\sim U(0,1)$ (3)

The parameter $\epsilon$ decides the level of greediness (or randomness). With
the $\epsilon$-greedy method, even if the true positive label is not selected
in an early round, it still has a chance to be chosen in the following rounds.
We set $\epsilon=0.3$ in this paper and will discuss its effect later in the
section. $A(l)$ is an objective function for the target label $l$ of an arm.
It is supposed to approximate the likelihood of the label being the true label
target. We leverage two kinds of information in the approximation: the current
trigger size for the label and the trigger size variation for the label over
rounds of optimization. To simplify discussion, we leave symmetry (to
distinguish natural features and triggers) to a later section. Intuitively, a
label with a smaller trigger size is promising, and a label that continuously
achieves good trigger size reduction in the past is promising. Let $tm(l)$ be
the accumulated time spent on optimizing $l$ (in the past rounds); $M(l)$ the
current mask of $l$ such that $\lVert M(l)\rVert_{1}$, the $L_{1}$ norm of
$M(l)$, describes the trigger size; and $M_{1}(l)$ the first valid trigger for
$l$. The objective function $A(l)$ is hence defined as follows.

$\displaystyle A(l)$
$\displaystyle=\frac{\lVert{M}(l)\rVert_{1}-\lVert{M}_{1}(l)\rVert_{1}}{tm(l)}+\beta\cdot\frac{1}{\lVert{M}(l)\rVert_{1}}$
(4)

Here $\beta$ is a hyper-parameter set to $10^{5}$. In the early rounds, the
trigger size reduction rate (i.e., the first term in the above equation) is a
stronger indicator of true positive. The equation allows us to put more weight
on the reduction rate instead of the trigger size, which tends to be large at
the beginning and hence the second term tends to be small. As the optimization
proceeds, the trigger size reduction rate degrades, even for the true positive
label, the second term becomes dominating, allowing the scheduler to
prioritize labels with small triggers (to make them smaller).

In the end, we compare the size of the smallest trigger with a threshold
$\tau$ to decide whether a model is trojaned or benign. In this paper, we set
$\tau=300$ for all TrojAI models and $\tau=350$ for ImageNet models.

Theoretical Analysis of K-Arm. We conduct theoretical analysis to show that
K-Arm is more effective (i.e., having higher accuracy) and more efficient
(i.e., lower overhead) than NC and NC+pre-selection. The effectiveness is
proved by computing the expected time of finishing trigger generation for the
true target label. Details can be found in Appendix.A.

###  4.3 Arm Pre-screening

According to the theoretical analysis, when the number of arms $K$ is large,
the cost is dominated by the warm-up phase that is determined by $K$. A large
$K$ is hence undesirable. Recall that for a model with $N$ classes,
$K=N+N\times(N-1)$, which could be large. We hence propose a pre-screening
step to filter out arms that are not promising.

In order to achieve high attack success rate, the attacker often has to stamp
many benign samples (of various classes when injecting a universal backdoor)
with the trigger and use them in trojan training. Note that these stamped
samples have their labels set to the target label. As such, the model learns
the correlations between the target label and the benign features belonging to
the original labels. Consequently, the logits value of the target label tends
to be consistently larger than other labels for benign samples. We leverage
this to preclude labels that do not look promising.

Specifically, for universal backdoor scanning, we consider a label promising
if its logits value ranks among the top $\gamma\%$ labels in at least
$\theta\%$ of all the benign samples (of various labels) that can be leveraged
for scanning. Collecting such statistics has much lower cost compared to
optimization. We set $\gamma=25$ and $\theta=65$ in this paper. For label-
specific backdoor scanning, we consider an optimization arm from the victim
label $t_{s}$ to the target label $t_{d}$ promising if $t_{d}$’s logits value
ranks among the top $\gamma\%$ labels in at least $\theta\%$ of all the
available benign samples of label $t_{s}$. We set $\gamma=25$ and $\theta=90$
in this paper. Observe that our settings of $\gamma$ and $\theta$ are
conservative in order not to exclude the right one. We also empirically study
the effect of different settings.

According to our experiments in the next section, the pre-screening can
substantially reduce the number of arms to consider. For example, we can
effectively reduce the arms of ImageNet from $1000$ to $20$ without
sacrificing accuracy in universal backdoor scanning.

###  4.4 Symmetric Optimization to Distinguish Natural Features from Triggers

Assume a (small) trigger $T$ is generated to flip clean samples with label
$t_{s}$ to label $t_{d}$. As discussed in Section 3, If $T$ does not denote a
backdoor but rather natural features, the two classes are likely close to each
other. As such, the trigger flipping samples of $t_{d}$ to $t_{s}$ shall have
a similar size as $T$. If $T$ indeed denotes a backdoor, the trigger flipping
$t_{d}$ to $t_{s}$ tends to be much larger as it is difficult to cause
misclassification along the opposite direction of trojaning. Therefore, the
scheduling algorithm is enhanced as follows to consider symmetry. The
extension focuses on label-specific optimization as such confusion rarely
happens for universal backdoors.

Given a label-specific arm $\langle t_{s},t_{d}\rangle$, i.e., flipping
$t_{s}$ to $t_{d}$, $M(t_{s},t_{d})$ and $P(t_{s},t_{d})$ denote the mask and
pattern for the generated trigger, respectively, and $M(t_{d},t_{s})$ and
$P(t_{d},t_{s})$ the correspondence along the opposite direction (i.e.,
flipping $t_{d}$ to $t_{s}$). The objective function is as follows.

$\displaystyle A(t_{s},t_{d})$
$\displaystyle=\frac{(\lVert{M}(t_{s},t_{d})\rVert_{1}-\lVert{M}_{1}(t_{s},t_{d})\rVert_{1})/{tm(t_{s},t_{d})}+\beta\cdot
1/\lVert{M}(t_{s},t_{d})\rVert_{1}}{(\lVert{M}(t_{d},t_{s})\rVert_{1}-\lVert{M}_{1}(t_{d},t_{s})\rVert_{1})/{tm(t_{d},t_{s})}+\beta\cdot
1/\lVert{M}(t_{d},t_{s})\rVert_{1}}$ (5)

Intuitively, we leverage the ratio of objective functions in Equation ( 4) in
the two directions to estimate the likelihood of $\langle t_{s},t_{d}\rangle$
being the true victim-target label pair. When $A(t_{s},t_{d})$ is large,
meaning the two directions are asymmetric, the pair is likely the true victim-
target pair and selected.

##  5 Experiments

We compare our method with five state-of-the-art techniques against three
different attack methods on multiple datsets and show that K-arm optimization
can achieve better accuracy with lower time cost.

###  5.1 Datasets

TrojAI Competition. TrojAI (IARPA, 2020) is a program by IARPA that aims to
tackle the back-door detection problem. In each round of competition, the
performers are first given a large set of training models (over 1000) with
different structures and different classification tasks. Roughly half of them
are trojaned and their malicious identities are known. A (small) set of benign
examples are provided for each label of each model. These models may be
trojaned with various kinds of backdoors, including universal and label-
specific. The triggers could be pixel patterns (e.g., polygons with solid
color) and Instagram filters (Liu et al., 2019). They could be position
dependent or independent. Position dependency means that the trigger has to be
at a specific relative position with the foreground object in order to cause
misclassification. A model may have one or more backdoors. The complexity of
models and backdoors grows from round to round. Note that our technique does
not require training. We hence use these training sets as regular datasets.
IARPA also hosts a test set online that is drawn from the same distribution as
the training models. It is unknown which test models are trojaned. One can
submit his/her solution which will be evaluated remotely on their server. The
solution needs to finish scanning all the test models (100, 144, 288, and 288
for rounds 1-4, respectively) within 24 hours for rounds 1-2 and 48 hours for
rounds 3-4. By the time of submission, round 4 is the latest. We compare our
method with the baselines on all the models with polygon backdoors, mixed with
all the clean models across all four rounds. We exclude models trojaned with
Instagram filters as some baselines do not support them. The leaderboard
results for our technique including both polygon and filter backdoors will be
discussed in Section 5.5. The details of datasets can be found in Appendix.B.

Table 1: TrojAI Training Set Results; “Sym K-Arm Opt + Pre-Srn” stands for
symmetric K-Arm with pre-screening.

| Round1 | Round2 | Round3 | Round4
---|---|---|---|---
Method | Acc | Loss | ROC | Time(s) | Acc | Loss | ROC | Time(s) | Acc | Loss | ROC | Time(s) | Acc | Loss | ROC | Time(s)
NC | 72% | 0.61 | 0.73 | 623.9 | - | - | - |  $>$ 30000 | - | - | - |  $>$ 30000 | - | - | - |  $>$ 30000
Pre-selection | 71% | 0.62 | 0.72 | 507.5 | 51% | 1.16 | 0.54 | 3708.2 | 58% | 0.81 | 0.61 | 3482.5 | 55% | 1.09 | 0.55 | 3210.4
ABS | 67% | 0.67 | 0.70 | 542.9 | 62% | 0.76 | 0.57 | 1527.0 | 71% | 0.62 | 0.56 | 1435.0 | 79% | 0.52 | 0.55 | 525.0
TABOR | 80% | 0.51 | 0.81 | 1142.2 | 55% | 1.09 | 0.59 |  $>$ 32000 | 60% | 0.77 | 0.57 |  $>$ 30000 | 60% | 0.81 | 0.55 |  $>$ 35000
DLTND | 85% | 0.45 | 0.86 | 1109.6 | 60% | 0.79 | 0.62 |  $>$ 26000 | 65% | 0.75 | 0.61 |  $>$ 29000 | 65% | 0.77 | 0.64 |  $>$ 31000
K-Arm Opt |  90% | 0.32 | 0.90 | 275.5 |  76% | 0.58 | 0.77 | 1956.5 |  79% | 0.50 | 0.80 | 1740.3 |  82% | 0.51 | 0.81 | 1623.5
K-Arm Opt + Pre-Srn | - | - | - | - |  75% | 0.59 | 0.76 | 140.8 |  79% | 0.50 | 0.80 | 166.2 |  80% | 0.53 | 0.79 | 110.5
Sym K-Arm Opt + Pre-Srn | - | - | - | - |  89% | 0.33 | 0.89 | 340.5 |  91% | 0.31 | 0.91 | 290.5 |  89% | 0.32 | 0.89 | 204.4

ImageNet. We also use 7 VGG16 models on ImageNet (1000 classes) trojaned by
TrojNN (Liu et al., 2018b), a kind of unviersal patch attack, and 6 models on
ImageNet poisoned by hidden-trigger backdoors (Saha et al., 2020), with
different structures including VGG16, AlexNet, DenseNet, Inception, ResNet and
SqueezeNet. The hidden-trigger backdoors are label-specific. They are mixed
with 7 clean ImageNet models.

Other datasets. We also evaluate our method on 4 CIFAR10 and 4 GTSRB models
trojaned by Input-Aware Dynamic Attack (Nguyen & Tran, 2020). They are mixed
with 4 clean models respectively.

###  5.2 Evaluation Metrics

We report two accuracy metrics used in TrojAI: cross-entropy loss (Murphy,
2012) and ROC-AUC (Area under Receiver Operating Characteristic Curve)
(Fawcett, 2006). The former is the lower the better and the latter is the
higher the better. In addition, we also report the plain accuracy, i.e., the
percentage of models that are correctly classified. We also report the average
scanning time for each model. For fair comparison, comparative experiments are
all done on an identical machine with a single 24GB memory NVIDIA Quadro RTX
6000 GPU (with the lab server configuration). Leaderboard results (on TrojAI
test sets) were run on the IARPA server with a single 32GB memory NVIDIA V100
GPU. We use Adam (Kingma & Ba, 2014) optimizer with learning rate $0.1$,
$\beta$ = {0.5, 0.9} for all the experiments.

###  5.3 Baseline Methods

We compare K-Arm with the following state-of-the-art detection methods: ABS
(Liu et al., 2019), NC (Wang et al., 2019), NC+pre-selection (Wang et al.,
2019) (or Pre-selection for short), ULP (Kolouri et al., 2020), TABOR (Guo et
al., 2019), DLTND (Wang et al., 2020c). For the optimization based methods
including ABS, NC, Pre-selection, TABOR and DLTND, we use the same batch size
for fair comparison. For NC, Pre-selection and our method, we use the same
early stop condition to terminate the optimization. For ABS, we select top10
neuron candidates after the stimulation analysis and perform the trigger
reverse engineering. For Pre-selection, we set the number of optimization
epochs as $max(10,s)$ for each label with $s$ the number of epochs when the
first valid trigger is found. Recall Pre-selection performs a few rounds of
optimizations and then selects a promising subset to finish. We select the top
3 among the 5 labels for round 1 models and the top 20% labels/label-pairs for
rounds 2-4. For the ImageNet models, we follow (Wang et al., 2019) and select
the top 100. For ULP, we train it on 500 TrojAI round 1 models and test it on
the 100 test models. We did not run it on later rounds as it cannot handle
model structure variations in those rounds. For TABOR and DLTND, we use the
implementation provided by the authors.

Table 2: Results on ImageNet Models

| Hidden Trigger Attack | TrojanNN
---|---|---
Method | Acc | Loss | ROC | Time(s) | Acc | Loss | ROC | Time(s)
NC | - | - | - |  $>$1m | 71% | 0.65 | 0.82 | 221k
Pre-selection | 54% | 1.02 | 0.62 | 171k | 64% | 0.92 | 0.74 | 43k
ABS | 100% | 0.11 | 1.00 | 389k | 100% | 0.11 | 1.00 | 4.9k
K-Arm | 85% | 0.33 | 0.93 | 86k | 88% | 0.38 | 0.92 | 19k
K-Arm+Pre-Srn | 85% | 0.33 | 0.93 | 2k | 100% | 0.11 | 1.00 | 224
Sym K-Arm+Pre-Srn | 100% | 0.09 | 1.00 | 4k | - | - | - | -

###  5.4 Parameter Tuning

We evaluate the effects of hyper-parameters, including the following: $\beta$
in the objective function, $\theta$, $\gamma$ in the arm pre-screening and
$\epsilon$ in the K-Arm Scheduler. The last one is the threshold $\tau$ which
decides if a model is trojaned. We randomly select 40 models (20 benign and 20
trojaned) from round 2 to test our method. In detail, we pick 5 different
values $(10^{2},10^{3},10^{4},10^{5},10^{6})$ for $\beta$. For $\epsilon$, we
select 10 values ranging from $0.1\sim 0.5$. We use 5 different $\tau$ values
from $100\sim 500$, 3 $\theta$ values from $10\sim 30$ and 3 $\gamma$ values
from $50\sim 80$. The results are in Appendix.C.

Table 3: TrojAI Leaderboard Results

| Round1 | Round2 | Round3 | Round4
---|---|---|---|---
Method | CE Loss | ROC | Time(s) | Rank | CE Loss | ROC | Time(s) | Rank | CE Loss | ROC | Time(s) | Rank | CE Loss | ROC | Time(s) | Rank
NC | - | - | T/O | - | - | - | T/O | - | - | - | T/O | - | - | - | T/O | -
ABS | 0.64(+0.34) | 0.70(-0.21) | 523(+233) | - | 0.76(+0.44) | 0.53(-0.36) | 508(+18) | - | 0.84(+0.55) | 0.56(-0.35) | 599(+367) | - | 0.87(+0.55) | 0.48(-0.42) | 229(+18) | -
ULP | 1.18(+0.88) | 0.59(-0.32) | 0.1(-290) | - | - | - | - | - | - | - | - | - | - | - | - | -
K-Arm | 0.30(-0.00) | 0.91(-0.00) | 290(-0) | 1 | 0.35(+0.03) | 0.90(+0.01) | 290(-200) | 2 | 0.29(-0.00) | 0.91(-0.00) | 232(-0) | 1 | 0.33(+0.01) | 0.90(-0.00) | 201(-10) | 2

###  5.5 Experimental results

Results for TrojAI Rounds 1-4 Training Sets. Table 1 shows the comparison
results on the aforementioned models from TrojAI rounds 1-4 training sets
(3231 models in total). Columns Acc, Loss, ROC, and Time stand for plain
accurcy, cross entropy loss, AUC-ROC, and average scanning time (in seconds)
per model, respectively. Observe that our method achieves the best accuracy
and has the lowest scanning time compared to all the baselines. The best K-Arm
methods have 4%, 27%, 30%, 25% better ROC than the best performance by the
baselines for the four respective rounds. They are also 1.8, 10.8, 8.6, 4.8
times faster than the fastest among the baselines for the four respective
rounds. This strongly supports the better effectiveness and efficiency of
K-Arm. K-Arm has higher accuracy than Pre-selection and ABS because they have
to make deterministic selection (about which labels/neurons to optimize) at
the beginning which is difficult when the candidate sets are large (e.g., in
label-specific backdoor scanning). K-Arm has higher accuracy than NC even
though NC is exhaustive. Besides that NC does not consider symmetry and hence
cannot distinguish natural features from injected triggers, its exhaustive
nature in many cases also hurts performance as it aggressively optimizes for
clean labels, generating many natural features with small size that behave
like triggers. TABOR and DLTND encounter the same problem and suffer from huge
number of false alarms.

The last three rows in Table 1 and 2 present the ablation study for different
components of our method. The vanilla K-Arm can have 79% accuracy and 1773s on
average (from R2 to R4). K-Arm with pre-screening achieves 78% accuracy and
138s. Symmetric K-Arm with pre-screening gets 89% and 278s. Note that vanilla
NC only has 57% with 32000s. Observe that arm pre-screening substantially
reduces the scanning time (by an order of magnitude) without sacrificing much
accuracy; symmetric optimization is critical to improving accuracy, with 13%,
11%, and 10% ROC improvement for rounds 2-4. Without the symmetric
optimization, K-Arm would not be able to reach the round targets (i.e., lower
than 0.348 Loss).

Results for ImageNet Models. Table 2 shows the results for the ImageNet
models. Columns 2-5 present results on the 6 models with (label-specific)
hidden-trigger backdoors mixed with 7 benign models; columns 6-9 present
results on the 7 models with (universal) TrojNN backdoors, mixed with 7 benign
models. For hidden-trigger backdoors, the best K-Arm has 100% accuracy. NC
could not finish due to the large number of victim-target label pairs. It took
two weeks to scan a model. Both Pre-selection and ABS have much worse accuracy
or scanning time. For TrojNN backdoors, The best K-Arm has 100% accuracy,
higher than most baselines. Although ABS can also achieve 100% accuracy, it is
20 times slower than the best K-Arm. NC and Pre-selection have lower accuracy
and much longer scanning time due to the large number of classes and natural
features that behave like triggers.

Results for the Dynamic Attack. Different from static backdoor attacks,
dynamic attack can generate input specific triggers. Therefore, the optimized
trigger of the target class will not be extremely smaller than others, then
bypass the outlier detection. However, our experiment results show that the
proposed pre-screening technique can identify the target label preciously for
the poisoned models. By setting the bound $\theta=70$, $\gamma=25$, we can
successfully detect all 4 trojan models on CIFAR10 and GTSRB without any false
positives. Fig. 5 shows the $\theta$ values of different classes for a GTSRB
and a CIFAR10 poisoned models. The target label is 0 for both models. Observe
that the $\theta$ value of the target label is 35% larger than the largest
value of the rest labels, which is a strong indicator for the trojan models.
Remind the large $\theta$ reveals that the model learns the target class
features as part of the features for other classes due to the poisoning
process.

Figure 5: Results on Input-Aware Dynamic Attack.

K-Arm Performance on TrojAI Leaderboard. K-Arm consistently achieved top
results across the four
rounds111https://pages.nist.gov/trojai/222https://pages.nist.gov/trojai/docs/results.html#previous-
leaderboards. Table 3 shows the K-Arm results for the four rounds, including
the loss, ROC, average scanning time, and ranking. The results include those
for all the different types of backdoors (polygon, filter, label-specific,
universal, position-dependent, multiple backdoors in a model, etc.). We also
show the difference between K-Arm and the top (if any). For example, in round
2, K-Arm ranked number 2. Loss 0.35(+0.03) means that K-Arm’s loss is 0.35
while the top performer has 0.32 loss; ROC 0.90(+0.01) means that K-Arm has
0.9 ROC while the top performer has 0.89 ROC. Note that the leaderboard ranks
solutions by (smaller) loss. K-Arm beat the round targets (i.e., lower than
0.348 loss) for 3 out of the 4 rounds. For round 2, although it did not beat
the target, its ROC is the highest. It ranked number one for 2 out of the 4
rounds. In all rounds, K-Arm is faster than ABS. We also train ULP on 500
round 1 training set models and evaluate it on the round 1 test set. However,
its accuracy is not high. We speculate two reasons: 1) unlike the models in
the ULP paper, the classes of TrojAI models are not fixed; 2) the classifier
seems to easily overfit on the training data and the triggers in the TrojAI
datasets share few common features. On the other hand, ULP is not optimization
based and hence is extremely fast.

Trend of Trigger Optimization in K-Arm. We randomly sample 100 trojaned models
from each training set of TrojAI rounds 1 to 4. We record the ranking of the
optimized trigger size of true target label for each model during
optimization. Fig. 6 shows the percentage of models whose target label trigger
size ranks number 1 (i.e., the smallest) for each round. We can see that after
warm-up, there are only 60-70% models rank top. As such, a simple pre-
selection strategy does not work. All the sets converge at around 90%,
indicating that K-Arm allows the true positives to stand out eventually in
most cases. Also observe that the different sets converge at different
optimization rounds, indicating that using a universal larger number of warm-
up rounds instead of K-Arm will not work. Moreover, 20 rounds of warm-up means
hundreds of epochs, which is already not affordable as all arms have to go
through warm-up. At the end, we point out that there are still around 10%
cases that do not stand out at the end. We study some of them in the
Appendix.D. We leave the problem to future work.

Figure 6: Trend of Trigger Optimization.

Adaptive Attack. We devise an adaptive attack for the arm pre-screening stage.
Our goal is to suppress the target label logits for benign samples of victim
classes. This is done by adding an $\mathcal{L}_{2}$ regularization of target
label logits value of benign samples. As such, the optimizer tries to enlarge
the distance between the target label and the victim label. The strength of
the attack is controlled by a coefficient. We use 10 models on CIFAR10 with
different coefficient values and report the model accuracy, attack success
rate (ASR), selection accuracy and K-Arm detection accuracy in Table 4.
Observe that pre-screening becomes less effective when the attack is stronger.
However, the model accuracy and attack success rate degrade as well. It is
unclear how to design adaptive attack for the scheduler or optimizer. We will
leave it to future work.

Table 4: Adaptive Attack

Coefficient | 0 | 1 | 10 | 100 | 1000
---|---|---|---|---|---
Model Acc | 80.0% | 78.1% | 71.4% | 65.5% | 35.4%
ASR | 99.0% | 99.4% | 92.9% | 92.6% | 0.0%
Selection Acc | 100.0% | 100.0% | 80.0% | 50.0% | -
K-Arm Detection Acc | 100.0% | 100.0% | 70.0% | 40.0% | -

##  6 Conclusion

Inspired by K-Arm Bandit in Reinforcement Learning, we develop a K-Arm
optimization technique for back-door scanning. The technique handles the
inherent uncertainty in searching a very large space of model behaviors, using
stochastic search guided by an objective function. It shows outstanding
performance on models from IARPA TrojAI competitions. It also outperforms the
state-of-the-art techniques that are publicly available.

##  7 Acknowledgments

We thank the anonymous reviewers, Zikang Xiong for their valuable comments.
This research was supported, in part by IARPA TrojAI W911NF-19-S-0012, NSF
1901242 and 1910300, ONR N000141712045, N000141410468 and N000141712947. Any
opinions, findings, and conclusions in this paper are those of the authors
only and do not necessarily reflect the views of our sponsors.

## References

  * Auer (2002) Auer, P.  Using confidence bounds for exploitation-exploration trade-offs.  _Journal of Machine Learning Research_ , 3(Nov):397–422, 2002.
  * Auer et al. (2002) Auer, P., Cesa-Bianchi, N., and Fischer, P.  Finite-time analysis of the multiarmed bandit problem.  _Machine learning_ , 47(2-3):235–256, 2002.
  * Bagdasaryan et al. (2020) Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V.  How to backdoor federated learning.  In _International Conference on Artificial Intelligence and Statistics_ , pp. 2938–2948. PMLR, 2020.
  * Chan & Ong (2019) Chan, A. and Ong, Y.-S.  Poison as a cure: Detecting & neutralizing variable-sized backdoor attacks in deep neural networks.  _arXiv preprint arXiv:1911.08040_ , 2019.
  * Chen et al. (2018) Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B.  Detecting backdoor attacks on deep neural networks by activation clustering.  _arXiv preprint arXiv:1811.03728_ , 2018.
  * Chen et al. (2020) Chen, X., Salem, A., Backes, M., Ma, S., and Zhang, Y.  Badnl: Backdoor attacks against nlp models.  _arXiv preprint arXiv:2006.01043_ , 2020.
  * Cheng et al. (2020) Cheng, S., Liu, Y., Ma, S., and Zhang, X.  Deep feature space trojan attack of neural networks by controlled detoxification.  _arXiv preprint arXiv:2012.11212_ , 2020.
  * Chou et al. (2020) Chou, E., Tramèr, F., and Pellegrino, G.  Sentinet: Detecting localized universal attacks against deep learning systems.  In _2020 IEEE Security and Privacy Workshops (SPW)_ , pp. 48–54. IEEE, 2020.
  * Du et al. (2019) Du, M., Jia, R., and Song, D.  Robust anomaly detection and backdoor attack detection via differential privacy.  _arXiv preprint arXiv:1911.07116_ , 2019.
  * Fawcett (2006) Fawcett, T.  An introduction to roc analysis.  _Pattern recognition letters_ , 27(8):861–874, 2006.
  * Gao et al. (2019) Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S.  Strip: A defence against trojan attacks on deep neural networks.  In _Proceedings of the 35th Annual Computer Security Applications Conference_ , pp. 113–125, 2019.
  * Gu et al. (2017) Gu, T., Dolan-Gavitt, B., and Garg, S.  Badnets: Identifying vulnerabilities in the machine learning model supply chain.  _arXiv preprint arXiv:1708.06733_ , 2017.
  * Guo et al. (2019) Guo, W., Wang, L., Xing, X., Du, M., and Song, D.  Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems.  _arXiv preprint arXiv:1908.01763_ , 2019.
  * Huang et al. (2020) Huang, S., Peng, W., Jia, Z., and Tu, Z.  One-pixel signature: Characterizing cnn models for backdoor detection.  _arXiv preprint arXiv:2008.07711_ , 2020.
  * IARPA (2020) IARPA.  Trojai competition.  https://pages.nist.gov/trojai/, 2020.
  * Kingma & Ba (2014) Kingma, D. P. and Ba, J.  Adam: A method for stochastic optimization.  _arXiv preprint arXiv:1412.6980_ , 2014.
  * Kolouri et al. (2020) Kolouri, S., Saha, A., Pirsiavash, H., and Hoffmann, H.  Universal litmus patterns: Revealing backdoor attacks in cnns.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 301–310, 2020.
  * Li et al. (2020a) Li, S., Ma, S., Xue, M., and Zhao, B. Z. H.  Deep learning backdoors.  _arXiv preprint arXiv:2007.08273_ , 2020a.
  * Li et al. (2020b) Li, Y., Wu, B., Jiang, Y., Li, Z., and Xia, S.-T.  Backdoor learning: A survey.  _arXiv preprint arXiv:2007.08745_ , 2020b.
  * Lin et al. (2020) Lin, J., Xu, L., Liu, Y., and Zhang, X.  Composite backdoor attack for deep neural network by mixing existing benign features.  In _Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security_ , pp. 113–131, 2020.
  * Liu et al. (2018a) Liu, K., Dolan-Gavitt, B., and Garg, S.  Fine-pruning: Defending against backdooring attacks on deep neural networks.  In _International Symposium on Research in Attacks, Intrusions, and Defenses_ , pp. 273–294. Springer, 2018a.
  * Liu et al. (2017) Liu, Y., Xie, Y., and Srivastava, A.  Neural trojans.  In _2017 IEEE International Conference on Computer Design (ICCD)_ , pp. 45–48. IEEE, 2017.
  * Liu et al. (2018b) Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., and Zhang, X.  Trojaning Attack on Neural Networks.  In _Proceedings of the 25nd Annual Network and Distributed System Security Symposium (NDSS)_ , 2018b.
  * Liu et al. (2019) Liu, Y., Lee, W.-C., Tao, G., Ma, S., Aafer, Y., and Zhang, X.  Abs: Scanning neural networks for back-doors by artificial brain stimulation.  In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ , pp. 1265–1282, 2019.
  * Ma & Liu (2019) Ma, S. and Liu, Y.  Nic: Detecting adversarial samples with neural network invariant checking.  In _Proceedings of the 26th Network and Distributed System Security Symposium (NDSS 2019)_ , 2019.
  * Murphy (2012) Murphy, K. P.  _Machine learning: a probabilistic perspective_.  MIT press, 2012.
  * Nguyen & Tran (2020) Nguyen, A. and Tran, A.  Input-aware dynamic backdoor attack.  2020\.
  * Qiao et al. (2019) Qiao, X., Yang, Y., and Li, H.  Defending neural backdoors via generative distribution modeling.  In _Advances in Neural Information Processing Systems_ , pp. 14004–14013, 2019.
  * Rakin et al. (2019) Rakin, A. S., He, Z., and Fan, D.  Bit-flip attack: Crushing neural network with progressive bit search.  In _Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)_ , October 2019.
  * Rakin et al. (2020) Rakin, A. S., He, Z., and Fan, D.  Tbt: Targeted neural network attack with bit trojan.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 13198–13207, 2020.
  * Rezaei & Liu (2019) Rezaei, S. and Liu, X.  A target-agnostic attack on deep models: Exploiting security vulnerabilities of transfer learning.  _arXiv preprint arXiv:1904.04334_ , 2019.
  * Saha et al. (2020) Saha, A., Subramanya, A., and Pirsiavash, H.  Hidden trigger backdoor attacks.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 34, pp. 11957–11965, 2020.
  * Salem et al. (2020) Salem, A., Wen, R., Backes, M., Ma, S., and Zhang, Y.  Dynamic backdoor attacks against machine learning models.  _arXiv preprint arXiv:2003.03675_ , 2020.
  * Shafahi et al. (2018) Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T.  Poison frogs! targeted clean-label poisoning attacks on neural networks.  In _Advances in Neural Information Processing Systems_ , pp. 6103–6113, 2018.
  * Sun (2020) Sun, L.  Natural backdoor attack on text data.  _arXiv preprint arXiv:2006.16176_ , 2020.
  * Turner et al. (2019) Turner, A., Tsipras, D., and Madry, A.  Label-consistent backdoor attacks.  _arXiv preprint arXiv:1912.02771_ , 2019.
  * Wang et al. (2018) Wang, B., Yao, Y., Viswanath, B., Zheng, H., and Zhao, B. Y.  With great training comes great vulnerability: Practical attacks against transfer learning.  In _27th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 18)_, pp. 1281–1297, 2018.
  * Wang et al. (2019) Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y.  Neural cleanse: Identifying and mitigating backdoor attacks in neural networks.  In _2019 IEEE Symposium on Security and Privacy (SP)_ , pp. 707–723. IEEE, 2019.
  * Wang et al. (2020a) Wang, B., Cao, X., Gong, N. Z., et al.  On certifying robustness against backdoor attacks via randomized smoothing.  _arXiv preprint arXiv:2002.11750_ , 2020a.
  * Wang et al. (2020b) Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-y., Lee, K., and Papailiopoulos, D.  Attack of the tails: Yes, you really can backdoor federated learning.  _Advances in Neural Information Processing Systems_ , 33, 2020b.
  * Wang et al. (2020c) Wang, R., Zhang, G., Liu, S., Chen, P.-Y., Xiong, J., and Wang, M.  Practical detection of trojan neural networks: Data-limited and data-free cases.  _arXiv preprint arXiv:2007.15802_ , 2020c.
  * Watkins (1989) Watkins, C. J. C. H.  Learning from delayed rewards.  1989\.
  * Xie et al. (2019) Xie, C., Huang, K., Chen, P.-Y., and Li, B.  Dba: Distributed backdoor attacks against federated learning.  In _International Conference on Learning Representations_ , 2019.
  * Xu et al. (2019) Xu, X., Wang, Q., Li, H., Borisov, N., Gunter, C. A., and Li, B.  Detecting ai trojans using meta neural analysis.  _arXiv preprint arXiv:1910.03137_ , 2019.
  * Yao et al. (2019) Yao, Y., Li, H., Zheng, H., and Zhao, B. Y.  Latent backdoor attacks on deep neural networks.  In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ , pp. 2041–2055, 2019.
  * Zhang et al. (2020) Zhang, X., Mian, A., Gupta, R., Rahnavard, N., and Shah, M.  Cassandra: Detecting trojaned networks from adversarial perturbations.  _arXiv preprint arXiv:2007.14433_ , 2020.
  * Zhao et al. (2020) Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., and Jiang, Y.-G.  Clean-label backdoor attacks on video recognition models.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pp. 14443–14452, 2020.
  * Zhu et al. (2019) Zhu, C., Huang, W. R., Shafahi, A., Li, H., Taylor, G., Studer, C., and Goldstein, T.  Transferable clean-label poisoning attacks on deep neural nets.  _arXiv preprint arXiv:1905.05897_ , 2019.


11institutetext: Harbin Institute of Technology

# Depth-agnostic Single Image Dehazing

Honglei Xu 11 Yan Shu 11 Shaohui Liu 11

###### Abstract

Single image dehazing is a challenging ill-posed problem. Existing datasets
for training deep learning-based methods can be generated by hand-crafted or
synthetic schemes. However, the former often suffers from small scales, while
the latter forces models to learn scene depth instead of haze distribution,
decreasing their dehazing ability. To overcome the problem, we propose a
simple yet novel synthetic method to decouple the relationship between haze
density and scene depth, by which a depth-agnostic dataset (DA-HAZE) is
generated. Meanwhile, a Global Shuffle Strategy (GSS) is proposed for
generating differently scaled datasets, thereby enhancing the generalization
ability of the model. Extensive experiments indicate that models trained on
DA-HAZE achieve significant improvements on real-world benchmarks, with less
discrepancy between SOTS and DA-SOTS (the test set of DA-HAZE). Additionally,
Depth-agnostic dehazing is a more complicated task because of the lack of
depth prior. Therefore, an efficient architecture with stronger feature
modeling ability and fewer computational costs is necessary. We revisit the
U-Net-based architectures for dehazing, in which dedicatedly designed blocks
are incorporated. However, the performances of blocks are constrained by
limited feature fusion methods. To this end, we propose a Convolutional Skip
Connection (CSC) module, allowing vanilla feature fusion methods to achieve
promising results with minimal costs. Extensive experimental results
demonstrate that current state-of-the-art methods equipped with CSC can
achieve better performance and reasonable computational expense, whether the
haze distribution is relevant to the scene depth.

###### Keywords:

Single image dehazing Dehazing datasets Convolutional Skip Connection.

##  1 Introduction

Haze is a common atmospheric phenomenon. Haze images usually suffer from
noticeable visual quality degradation in contrast or color distortion [22]
impacting the reliability of models in high-level vision tasks. To improve the
overall scene visibility, many image dehazing methods have been proposed to
recover the latent haze-free image from the single hazy input.

For the training of image dehazing models, preparing a suitable dataset is the
first step. By utilizing professional haze machines, real haze images can be
generated [2, 4, 3, 1]. However, the primary issue of these hand-crafted real
datasets is their small-scale data because it is very difficult to collect the
haze image and haze-free image at the same scene. Therefore, models trained on
them have limited generalization. To solve this problem, Atmospheric
Scattering Model (ASM) [17] is applied to synthesize large-scale datasets,
which have boosted the performances of many image dehazing methods.

Despite this, challenges still exist, particularly in real-world dehazing
tasks, existing state-of-the-art image dehazing method trained on synthetic
large-scale datasets achieves limited performances in the real-world dehazing
task. Due to the inherent characteristics of synthetic methods, where the haze
density and scene depth are positively correlated, these priors is not
absolute in the real word, as shown in Figure 3 (a). Moreover, they may
mislead models to take shortcuts by relying on scene depth instead of learning
the essence of haze distribution. As shown in Figure 1, the quality of the
restored region will be low if the haze density does not comply with the depth
prior.

(a) Hazy

(b) Restored

(c) GT

(d) Difference

(e) Absolute of difference

(f) Depth

Figure 1: (a) is the hazy image. (b) is the restored image generated by the
model trained on OTS. (c) is the GroundTruth. (d,e) shows the difference
between (b) and (c). (f) is the depth map to stnthesize (a).

In addition, Depth-agnostic dehazing is a more complicated task because of the
lack of depth prior. Therefore, an efficient and effective architecture is
necessary. Existing dehazing methods based on U-Net architecture have designed
dedicated blocks to improve performances. In consideration of performances and
computational expenses, vanilla feature fusion methods (adding and adding-like
operation) have been applied to reduce the input dimension, decreasing the
optimal performances of the blocks. These two intrinsic defects hinder the
practical applications of existing dehazing models.

In this paper, we try our best to answer two questions.  1) Can we generate a
large-scale dataset where the haze distribution is independent of scene depth?
2) Is it possible to unleash the full potential of specialized blocks even
with vanilla feature fusion methods? To this end, we propose Depth-agnostic
Single Image Dehazing.

Figure 2: Comparison of the results generated by NAF-Net trained on the OTS
and our DA-HAZE and tested on the corresponding test sets SOTS and DA-SOTS
(the top figure), real-world dataset NH-HAZE and O-HAZE (bottom figures). DA-
HAZE($\times$n) denotes various scales of the dataset.

On the one hand, we propose a novel synthetic method to generate a depth-
agnostic dataset, named DA-HAZE, in which the haze density is not correlated
with the scene depth. Specifically, by leveraging ASM, we generate sufficient
data in DA-HAZE to enable large-scale training. Moreover, the pairs between
haze-free images and depth maps are randomly ordered. This allows the models
to perceive the haze distribution instead of being misled by scene depth. We
also propose a novel Global Shuffle Strategy (GSS) to make DA-HAZE scalable,
in which the same image matches multiple depth estimations so that the
generalization of models can be improved. On the other hand, we propose a
Convolutional Skip Connection (CSC) module, by introducing a normal
convolution layer to the connection path, vanilla feature fusion methods such
as adding or adding-like operations can achieve promising results, with
minimal computational costs.

The contributions of this work are threefold:

(i) We propose a novel synthetic method to generate a depth-agnostic dataset
(DA-HAZE) where the relationship between haze density and scene depth is
decoupled. This guides models to perceive the haze distribution instead of
relying on scene depth.

(ii) We propose a Global Shuffle Strategy (GSS) for making DA-HAZE scalable,
which can improve the generalization ability of models. Experiments show that
models trained on DA-HAZE with GSS achieve significant improvements on real-
world benchmarks compared to the previous OTS dataset, with less discrepancy
on different distributed validation sets as illustrated in Figure 2.

(iii) We propose a Convolutional Skip Connection (CSC) module, allowing for
vanilla feature fusion methods to achieve promising results with minimal
costs. Experiments show CSC brings a significant gain to the current dehazing
methods whether haze distribution is relevant to scene depth, with a promising
trade-off between performance and computational expenses.

##  2 Related Work

###  2.1 Image Dehazing datasets

Hand-crafted real datasets generate haze in scene images by specific haze
machines. [2] firstly introduced a database termed O-HAZE in outdoor scenes.
Considering that haze is not uniformly distributed in many cases, NH-HAZE [1],
a non-homogeneous realistic dataset with real hazy and corresponding haze-free
images was proposed. Generally, these datasets share similar distributions to
the real-world data, however, their limited scales hinder better
generalization of the models trained on them.

(a)

(b)

Figure 3: (a) Non-homogeneous hazy image. (b) Homogeneous hazy image.

ASM synthetic datasets consider that it is difficult to collect the haze image
and haze-free image at the same scene. Thus, the atmospheric scattering model
(ASM) is utilized to generate large-scale synthetic data. The most commonly
applied dataset is the Realistic Single Image Dehazing (RESIDE) [15], which
consists of Indoor Training Set, Outdoor Training Set, and Synthetic Objective
Testing Set. Most of the methods trained on the benchmark achieved promising
results, but suffer from limited performance towards real-world images due to
the significant domain gaps.

Our proposed depth-agnostic dataset (DA-HAZE) inherits the merits of
handcrafted real datasets and ASM synthetic datasets. On the one hand, we
ensure its large scale based on ASM, on the other hand, we modify the
synthetic methods to generate depth-agnostic hazy images.

###  2.2 Single Image Dehazing

Single image dehazing methods [11, 28, 6, 19, 14, 18, 25] can be divided into
two categories (Prior-based and Data-driven methods). We also introduce the
classical image dehazing methods based on U-Net architecture relevant to our
works.

Prior-based methods rely on the ASM and hand-crafted priors, such as dark
channel prior (DCP) [11] and color attenuation prior (CAP) [28]. He et al.
proposed DCP based on a key observation - most local patches in haze-free
outdoor images contain some pixels with very low intensities in at least one
color channel, which can help estimate the transmission map. CAP established a
linear relationship between depth and the difference between brightness and
saturation. These methods only work well in specific scenes which happen to
satisfy their assumptions.

Data-driven methods aim to directly or indirectly learn the mapping function.
DehazeNet [6] and MSCNN [19] utilized CNNs to estimate the transmission map.
AOD-Net [14] rewrote the ASM and estimated atmospheric light together with the
transmission map. However, the cumulative errors introduced by inaccurate
estimations of the transmission map and atmospheric light may cause
performance degradation. To avoid this, recent works tend to recover the haze-
free image from the hazy image directly by deep neural networks. To enhance
the feature fusion, MSBDN proposed a boosting strategy and back-projection
technique. FFA-Net [18] dealt with different types of information by
introducing the feature attention mechanism. A novel contrastive
regularization was proposed in AECR-Net [24] so that it can benefit from both
positive and negative samples. Although these methods significantly develop
the dehazing performances, the complexity of networks also increases.

U-Net Architecture was originally proposed for image segmentation, which is
similar to an autoencoder but with skip connections between the encoder and
decoder to preserve fine-grained details. Many researchers have extended this
framework into image dehazing. Zhao et al. designed the HyLoG-ViT [27] to
capture local and global dependencies, with promising results achieved but
suffering from large model complexity. To achieve a tradeoff between
performance and computational cost, Dehazeformer [21] and DEA-Net [8] applied
adding-like methods by which the input dimension to the block can be reduced.
Nevertheless, these designs hinder the full exploration of the proposed
blocks. Distinguished from theirs, we revisit the U-Net Architecture and
propose a Convolutional Skip Connection (CSC) method to address the dilemma.

##  3 Method

###  3.1 Depth-agnostic Dataset

Genaration Method. In previous methods for generating dehazing datasets, ASM
(Atmospheric Scattering Model) has been utilized to synthesize haze data. The
formulation of this process is as follows:

$I=J\cdot t+A\cdot(1-t),$ (1)

where $I$ is the observed hazy image, $J$ is the underlying haze-free image to
be recovered, $A$ is the global atmospheric light, indicating the ambient
light intensity and $t$ is the transmission map, which represents the
distance-dependent factor affecting the fraction of light that reaches the
camera sensor and is expressed as:

$t=e^{-\beta d}$ (2)

where $\beta$ is the scattering coefficient of the atmosphere, and $d$ is the
depth map. In this case, there is a positive correlation between the haze
distribution and scene depth. However, models can be misled by this prior
information and may disregard the haze density information.

We propose a novel synthesis method to tackle this problem. Taking inspiration
from previous works, we also employ ASM to guide the generation of haze
images. Alternatively, as shown in Figure 4, we shuffle the pairs of haze-free
images and their corresponding depth maps to decouple the relationship between
haze distribution and scene depth. As a result, the vanilla ASM formulation
can be modified as follows:

$I^{*}=J\cdot t^{*}+A\cdot(1-t^{*}),$ (3) $t^{*}=e^{-\beta d^{*}}$ (4)

where $t^{*}$ is the new transmission map updated by $d^{*}$, a random depth
map in the dataset.

The Depth-agnostic Dataset (DA-HAZE) consists of 313,950 image pairs for
training and 500 image pairs for testing, which is consistent with OTS. We
have also established an evaluation metric termed Discrepancy to assess the
dataset’s quality. By using different testing sets, denoted as
$D_{1},D_{2},\ldots,D_{n}$, we compute the variance $Var(R)$ among the
dehazing results $R_{1},R_{2},\ldots,R_{n}$ obtained from a dehazing method. A
lower $Var(R)$ indicates less variation among different testing sets, which
demonstrates that the dataset enables the model to perceive real haze
distribution.

Global Shuffle Strategy. DA-HAZE decouples the relationship between haze
distribution and image depth. However, the haze distribution can dynamically
change over time. We propose a Global Shuffle Strategy (GSS) to adapt to this
situation. Specifically, according to Eq.(3) and Eq.(4), depth-agnostic hazy
images can be generated. Further, for a given haze-free image $J$, there are
multiple $d^{*}$ associated with it. The number of paired $d^{*}$ for each
image determines the scale of the DA-HAZE. GSS enhances the diversity of the
dataset, thereby improving the generalization of the model by allowing it to
perceive images with different depth distributions during the training
process.

Figure 4: Comparisons of previous synthetic method (top line) and ours (bottom
line). Left column is the haze-free image, middle column is the depth map to
synthesis the hazy image (right column).

###  3.2 Convolutional Skip Connection

U-Net was proposed in the segmentation task, consisting of an encoder path
that captures contextual information and a decoder path that performs precise
localization. Within this framework, feature fusion methods, such as adding or
concatenation, are employed to integrate multi-scale features. For notation
simplicity, we use $Z_{\theta}$ to express the output of a single channel in
the feature fusion module, in which $\theta$ represents different operations.
The adding operation can be expressed as:

$Z_{add}=\sum_{i=1}^{c}\left(X_{i}+Y_{i}\right)*K_{i}=\sum_{i=1}^{c}X_{i}*K_{i}+\sum_{i=1}^{c}Y_{i}*K_{i}$
(5)

where $X_{i}$ and $Y_{i}$ represent the $i^{th}$ channel of feature maps from
skip connection and up-sampling separately. $K$ comprises a set of
convolutional kernels, and $K_{i}$ is the corresponding convolutional kernel
of the ith channel. $c$ is the number of channels for each input. The
concatenation operation has a similar expression as :

$Z_{concat}=\sum_{i=1}^{c}X_{i}*K_{i}+\sum_{i=1}^{c}Y_{i}*K_{i+c}$ (6)

Different from adding, the $K$ for concatenation utilizes $2\cdot c$
convolutional kernels, where the first $c$ kernels are for $X$ and the remains
are applied to $Y$. Compared to adding, concatenation has a stronger feature
representation ability, thereby achieving better performances.

In current dehazing works, adding operation is applied to reduce the input
dimension, so that performances and computational costs can be balanced.
However, their optimal performances are limited. To this end, we propose a
Convolutional Skip Connection module, as shown in Figure 5. Specifically, by
introducing a single convolution layer, insufficient feature representations
can be mitigated. The CSC can be formulated as:

$Z_{csc}=\sum_{i=1}^{c}X_{i}*K_{i}+\sum_{i=1}^{c}Y_{i}*K_{i}+\sum_{i=1}^{c}Y_{i}*\hat{K}_{i}$
(7)

where $\hat{K}$ is the introduced convolution layer that has the same number
of channels as $K$.

Notably, the CSC we proposed can be integrated into any U-Net-based dehazing
architecture, with significant improvement in performance but little
computational cost.

Figure 5: Illustration of Convolutional Skip Connection (CSC). By introducing
a single convolution layer (pink line), insufficient feature representations
can be mitigated.

###  3.3 Loss Function

MSE or L2 loss is the most widely used loss function for single image
dehazing. However, some works [16] pointed out that many image restoration
tasks training with L1 loss perform better than L2 loss in terms of PSNR and
SSIM metrics. Therefore, we adopt the simple L1 loss.

$L_{1}=\frac{1}{N}\sum_{i=1}^{n}|I_{gt}^{i}-I_{r}^{i}|$ (8)

where $I_{gt}$ is the ground truth, $I_{r}$ is the restored image.

##  4 Experiment

###  4.1 Datasets and Metrics

Datasets. REalistic Single Image DEhazing (RESIDE) [15] is a widely used
dataset, which consists of Indoor Training Set (ITS, 13,990 image pairs),
Outdoor Training Set (OTS, 313,950 image pairs), and Synthetic Objective
Testing Set (SOTS, 500 indoor image pairs and 500 outdoor image pairs). We
select OTS in the training phase and select SOTS-outdoor in the testing phase
for comparison with SOTA methods. DA-SOTS and NH-HAZE, a non-homogeneous
realistic dataset, are also used for testing to demonstrate the limitations of
OTS. We also train the model on Depth-agnostic Dataset (DH-HAZE) we proposed
and test it on SOTS-outdoor, DA-SOTS-outdoor, NH-HAZE [1], and O-HAZE [2].

Evaluation Metrics. Peak signal-to-noise-ratio (PSNR) and structural
similarity index (SSIM) [23], which are commonly used to measure the image
quality among the computer vision community, are utilized for dehazing
performance evaluation. We also use the Discrepancy described in Sec 3.1 to
evaluate the generalization ability of the model.

###  4.2 Implementation Details

The models are optimized by Adam Optimizer. Moreover, Cosine annealing
strategy [12] is adopted, and the batch size is set to 32. To train the model,
we randomly crop patches from the original images with size $256\times 256$,
then two data augmentation techniques are adopted including rotation and
vertical or horizontal flip. In the whole training phase, the model is trained
for 30 epochs.

###  4.3 Comparison with state-of-the-art methods

NAF-Net [7] was proposed as a simple baseline for image restoration. We
evaluate its performance on image dehazing by training from scratch on SOTS-
outdoor, as shown in Table 2. NAF-Net outperforms other dehazing methods, with
low computational cost. As a complement to NAF-Net, DhazeFormer [21], which is
a transformer-based architecture is also applied as our baseline.

In table 1, we compare the proposed DA-HAZE with OTS, a classical synthetic
dehazing benchmark. Under the same training configurations, NAF-Net trained on
DA-HAZE achieves better performances on real data, with 12.16dB PSNR on NH-
HAZE and 16.53dB PSNR on O-HAZE, compared to the one trained on OTS. Similar
conclusions can be found in DehazeFormer, which can achieve 0.16dB PSNR and
0.12dB PSNR gains when trained on DA-HAZE. Moreover, we can observe that the
model trained on OTS demonstrates a large discrepancy between different hazy
distribution test sets (SOTS and DA-SOTS). However, DA-HAZE can significantly
mitigate the discrepancy, indicating that it can enable the model to perceive
real hazy distribution instead of misleading by depth priors. Some
visualization results can be shown in Figure 6.

Table 1: Quantitative comparisons of NAF-Net and DehazeFormer trained on OTS
and different scaled DA-HAZE, and tested on syntheic and real datasets. Bold
indicates the best results.

Method | Dataset | Num | SOTS-outdoor | DA-SOTS-outdoor | discrepancy | NH-HAZE | O-HAZE
---|---|---|---|---|---|---|---
PSNR | SSIM | PSNR | SSIM | PSNR | PSNR | PSNR
NAF-Net | OTS | 313950 | 38.94 | 0.995 | 32.74 | 0.980 | 9.61 | 11.99 | 16.49
DA-HAZE | 313950 | 34.23 | 0.990 | 35.82 | 0.989 | 0.63 | 12.16 | 16.53
DA-HAZE($\times$2) | $313950\times 2$ | 35.92 | 0.992 | 37.19 | 0.991 | 0.40 | 12.27 | 16.66
DA-HAZE($\times$3) | $313950\times 3$ | 36.37 | 0.992 | 37.52 | 0.992 | 0.33 | 12.33 | 16.75
DehazeFormer | OTS | 313950 | 36.44 | 0.992 | 31.67 | 0.976 | 5.69 | 12.09 | 16.60
DA-HAZE | 313950 | 32.30 | 0.978 | 33.52 | 0.984 | 0.37 | 12.25 | 16.72
DA-HAZE($\times$2) | $313950\times 2$ | 33.84 | 0.986 | 34.80 | 0.990 | 0.23 | 12.39 | 16.77
DA-HAZE($\times$3) | $313950\times 3$ | 34.24 | 0.990 | 35.11 | 0.991 | 0.19 | 12.45 | 16.89

Figure 6: Top line shows the restored image of SOTS (left) and DA-HAZE
(middle) generated by NAF-Net trained on OTS, and the difference map (right)
between them. Bottom line shows the corresponding results by NAF-Net trained
on DA-HAZE.

Table 2 shows quantitative evaluation results of DhazeFormer and NAF-Net
equipped with our CSC and other state-of-the-art results on SOTS. As we can
see, CSC improves the performance on both DhazeFormer and NAF-Net, while
introducing minimal computational cost. On SOTS, our NAF-Net-CSC achieves the
38.98dB PSNR, only behind NAF-Net-cat model. However, NAF-Net-CSC contains
fewer parameters and flops, implying it can reach a good trade-off between
performance and model complexity.

Table 2: Quantitative comparisons of various dehazing methods on SOTS-outdoor. We report PSNR, SSIM, number of parameters ($\\#$ PARAM.) and number of floating-point operations ($\\#$ FLOPS). The sign ”-” denotes the digit is unavailable. Bold and underlined indicate the best and the second best results respectively. Method | SOTS-outdoor | # Param. (M) | # FLOPs (G)
---|---|---|---
PSNR | SSIM
(TPAMI’10) DCP[11] | 19.14 | 0.861 | - | -
(TIP’16) DehazeNet[6] | 27.75 | 0.927 | 0.008 | 0.541
(ECCV’16) MSCNN [19] | 22.06 | 0.908 | 0.008 | 0.525
(ICCV’17) AOD-Net[14] | 24.14 | 0.920 | 0.002 | 0.115
(CVPR’18) GFN[20] | 21.55 | 0.844 | 0.499 | 14.94
(AAAI’20) FFA-Net[18] | 33.57 | 0.984 | 4.456 | 287.5
(CVPR’20) MSBDN[9] | 34.81 | 0.986 | 31.35 | 24.44
(TIP’22) SGID-PFF[5] | 30.20 | 0.975 | 13.87 | 152.8
(AAAI’22) UDN[13] | 34.92 | 0.987 | 4.250 | -
(ECCV’22) PMDNet[26] | 34.74 | 0.985 | 18.90 | -
(CVPR’22) Dehamer[10] | 35.18 | 0.986 | 132.4 | 48.93
(arxiv’23) DEA-Net[8] | 35.97 | 0.989 | 3.653 | 32.23
(TIP’23) DehazeFormer [21] | 36.44 | 0.992 | 0.686 | 6.658
DhazeFormer-add | 36.35 | 0.992 | 0.683 | 6.29
DhazeFormer-cat | 36.63 | 0.992 | 0.797 | 9.26
DhazeFormer-add (w CSC) | 36.50 | 0.992 |  0.686 |  6.37
(ECCV’22) NAF-Net [7] | 38.94 | 0.995 | 29.10 | 16.23
NAF-Net-cat | 39.03 | 0.995 | 32.6 | 25.76
NAF-Net (w CSC) |  38.98 |  0.995 | 29.2 | 16.5

###  4.4 Abalation studies

The effectiveness of GSS. To validate the effectiveness of Global Shuffle
Strategy (GSS), we change the number of $d^{*}$ to generate different scaled
datasets, by which NAF-Net and Dehaze-Former can be trained. It can be seen
from Table 1 that larger-scale datasets can improve the performance of models
on real-world data (NH-HAZE and O-HAZE). Meanwhile, as the dataset size
increases, the discrepancy between validation sets with different hazy
distributions (SOTS and DA-SOTS) also decreases (from 0.63dB PSNR to 0.33dB
PSNR on NAF-Net and from 0.37dB PSNR to 0.19dB PSNR on DehazeFormer). The
results show that our DA-HAZE with GSS enables the model a strong cross-domain
generalization ability.

The effectiveness of CSC. To further validate the superiority of CSC, we
replace the fusion methods in DhazeFormer with adding and concatenation
operations, termed DhazeFormer-add and DhazeFormer-cat. We incorporate our CSC
with DhazeFormer-add and report the results in Table 2, from which we can see
that CSC brings 0.15dB PSNR improvements with introducing minimal
computational cost. Compared to DhazeFormer-cat, DhazeFormer-CSC achieves a
better trade-off between performance and computational complexity. Similarly,
we equip NAF-Net with CSC, which uses adding operation as a fusion method. It
can be found that NAF-Net with CSC achieves competitive results with NAF-Net-
cat, which introduces extra parameters. Apart from OTS, CSC also achieves
promising results in our proposed DH-HAZE, as shown in Table 3. The model with
CSC trained on DH-HAZE shows less discrepancy on different test sets and
higher performance on real datasets.

Table 3: Quantitative comparisons of NAF-Net and DehazeFormer trained on DH-
HAZE($\times$3) and tested on synthetic and real datasets.

Method | SOTS-outdoor | DA-STOS-outdoor | discrepancy | NH-HAZE | O-HAZE
---|---|---|---|---|---
PSNR | SSIM | PSNR | SSIM | PSNR | PSNR | PSNR
NAF-Net | 36.37 | 0.992 | 37.52 | 0.992 | 0.33 | 12.33 | 16.75
NAF-Net-cat | 36.68 | 0.992 | 37.63 | 0.992 | 0.23 | 12.69 | 17.12
NAF-Net(w CSC) | 36.54 | 0.992 | 37.57 | 0.992 | 0.27 | 12.52 | 16.95
DehazeFormer-add | 34.06 | 0.990 | 35.03 | 0.991 | 0.22 | 12.32 | 16.74
DehazeFormer-cat | 34.43 | 0.990 | 35.31 | 0.991 | 0.15 | 12.67 | 17.11
DehazeFormer-add (w CSC) | 34.32 | 0.990 | 35.18 | 0.991 | 0.18 | 12.50 | 16.94

##  5 Conclusion

In this paper, we propose a novel synthetic method to generate a large-scale
dataset, termed DA-HAZE, by which the relationship between haze density and
scene depth is decoupled. Meanwhile, a Global Shuffle Strategy (GSS) is
proposed to generate different scaled datasets, thereby enhancing the
generalization ability of the model. In addition, We propose a Convolutional
Skip Connection (CSC) module, allowing for vanilla feature fusion methods to
achieve promising results with minimal costs. Our CSC can be a complement to
existing image dehazing methods to enhance their dehazing ability. Extensive
experiments demonstrate that existing methods with CSC can surpass state-of-
the-art approaches. Moreover, models trained on DA-HAZE with GSS achieve
significant improvements on real-world benchmarks compared to the previous OTS
dataset, with less discrepancy on different distributed validation sets.

## References

  * [1] Ancuti, C.O., Ancuti, C., Timofte, R.: Nh-haze: An image dehazing benchmark with non-homogeneous hazy and haze-free images. In: CVPRW. pp. 444–445 (2020)
  * [2] Ancuti, C.O., Ancuti, C., Timofte, R., De Vleeschouwer, C.: O-haze: a dehazing benchmark with real hazy and haze-free outdoor images. In: CVPR. pp. 754–762 (2018)
  * [3] Ancuti, C., Ancuti, C.O., De Vleeschouwer, C.: D-hazy: A dataset to evaluate quantitatively dehazing algorithms. In: ICIP). pp. 2226–2230 (2016)
  * [4] Ancuti, C., Ancuti, C.O., Timofte, R., De Vleeschouwer, C.: I-haze: a dehazing benchmark with real hazy and haze-free indoor images. In: ACIVS. pp. 620–631 (2018)
  * [5] Bai, H., Pan, J., Xiang, X., Tang, J.: Self-guided image dehazing using progressive feature fusion. TIP 31, 1217–1229 (2022)
  * [6] Cai, B., Xu, X., Jia, K., Qing, C., Tao, D.: Dehazenet: An end-to-end system for single image haze removal. TIP 25(11), 5187–5198 (2016)
  * [7] Chen, L., Chu, X., Zhang, X., Sun, J.: Simple baselines for image restoration. In: ECCV. pp. 17–33 (2022)
  * [8] Chen, Z., He, Z., Lu, Z.M.: Dea-net: Single image dehazing based on detail-enhanced convolution and content-guided attention. arXiv (2023)
  * [9] Dong, H., Pan, J., Xiang, L., Hu, Z., Zhang, X., Wang, F., Yang, M.H.: Multi-scale boosted dehazing network with dense feature fusion. In: CVPR. pp. 2157–2167 (2020)
  * [10] Guo, C.L., Yan, Q., Anwar, S., Cong, R., Ren, W., Li, C.: Image dehazing transformer with transmission-aware 3d position embedding. In: CVPR. pp. 5812–5820 (2022)
  * [11] He, K., Sun, J., Tang, X.: Single image haze removal using dark channel prior. TPAMI 33(12), 2341–2353 (2010)
  * [12] He, T., Zhang, Z., Zhang, H., Zhang, Z., Xie, J., Li, M.: Bag of tricks for image classification with convolutional neural networks. In: CVPR. pp. 558–567 (2019)
  * [13] Hong, M., Liu, J., Li, C., Qu, Y.: Uncertainty-driven dehazing network. In: AAAI. vol. 36, pp. 906–913 (2022)
  * [14] Li, B., Peng, X., Wang, Z., Xu, J., Feng, D.: Aod-net: All-in-one dehazing network. In: ICCV. pp. 4770–4778 (2017)
  * [15] Li, B., Ren, W., Fu, D., Tao, D., Feng, D., Zeng, W., Wang, Z.: Benchmarking single-image dehazing and beyond. TIP 28(1), 492–505 (2018)
  * [16] Lim, B., Son, S., Kim, H., Nah, S., Mu Lee, K.: Enhanced deep residual networks for single image super-resolution. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops. pp. 136–144 (2017)
  * [17] Narasimhan, S.G., Nayar, S.K.: Contrast restoration of weather degraded images. TPAMI 25(6), 713–724 (2003)
  * [18] Qin, X., Wang, Z., Bai, Y., Xie, X., Jia, H.: Ffa-net: Feature fusion attention network for single image dehazing. In: AAAI. vol. 34, pp. 11908–11915 (2020)
  * [19] Ren, W., Liu, S., Zhang, H., Pan, J., Cao, X., Yang, M.H.: Single image dehazing via multi-scale convolutional neural networks. In: ECCV. pp. 154–169 (2016)
  * [20] Ren, W., Ma, L., Zhang, J., Pan, J., Cao, X., Liu, W., Yang, M.H.: Gated fusion network for single image dehazing. In: CVPR. pp. 3253–3261 (2018)
  * [21] Song, Y., He, Z., Qian, H., Du, X.: Vision transformers for single image dehazing. TIP 32, 1927–1941 (2023)
  * [22] Tan, R.T.: Visibility in bad weather from a single image. In: CVPR. pp. 1–8 (2008)
  * [23] Wang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P.: Image quality assessment: from error visibility to structural similarity. TIP 13(4), 600–612 (2004)
  * [24] Wu, H., Qu, Y., Lin, S., Zhou, J., Qiao, R., Zhang, Z., Xie, Y., Ma, L.: Contrastive learning for compact single image dehazing. In: CVPR. pp. 10551–10560 (2021)
  * [25] Xu, H., Liu, S., Shu, Y., Jiang, F.: Aprogressive image dehazing framework with inter and intra contrastive learning. In: ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). pp. 1–5. IEEE (2023)
  * [26] Ye, T., Jiang, M., Zhang, Y., Chen, L., Chen, E., Chen, P., Lu, Z.: Perceiving and modeling density is all you need for image dehazing. arXiv (2021)
  * [27] Zhao, D., Li, J., Li, H., Xu, L.: Hybrid local-global transformer for image dehazing. arxiv 2(3) (2021)
  * [28] Zhu, Q., Mai, J., Shao, L.: A fast single image haze removal algorithm using color attenuation prior. TIP 24(11), 3522–3533 (2015)