SSDA: Secure Source-Free Domain Adaptation

Source-free domain adaptation (SFDA) is a popular unsupervised domain adaptation method where a pre-trained model from a source domain is adapted to a target domain without accessing any source data. Despite rich results in this area, existing literature overlooks the security challenges of the unsupervised SFDA setting in presence of a malicious source domain owner. This work investigates the effect of a source adversary which may inject a hidden malicious behavior (Backdoor/Trojan) during source training and potentially transfer it to the target domain even after benign training by the victim (target domain owner). Our investigation of the current SFDA setting reveals that because of the unique challenges present in SFDA (e.g., no source data, target label), defending against backdoor attack using existing defenses become practically ineffective in protecting the target model. To address this, we propose a novel target domain protection scheme called secure source-free domain adaptation (SSDA). SSDA adopts a single-shot model compression of a pre-trained source model and a novel knowledge transfer scheme with a spectral-norm-based loss penalty for target training. The proposed static compression and the dynamic training loss penalty are designed to suppress the malicious channels responsive to the backdoor during the adaptation stage. At the same time, the knowledge transfer from an uncompressed auxiliary model helps to recover the benign test accuracy. Our extensive evaluation on multiple dataset and domain tasks against recent backdoor attacks reveal that the proposed SSDA can successfully defend against strong backdoor attacks with little to no degradation in test accuracy compared to the vulnerable baseline SFDA methods. Our code is available at https://github.com/ML-Security-Research-LAB/SSDA.

1. Introduction

Deep Neural Networks (DNNs) have shown remarkable success across a multitude of tasks [18], [8], [12], [9], [5], [37], [2], [15], [26]. In particular, they have exhibited extraordinary performance in various visual tasks such as classification [18], object detection [8], and semantic segmentation [12]. Even though DNNs have achieved great success in various visual tasks, they heavily depend on the underlying distribution of training data. Unfortunately, DNNs deployed in real-world scenarios, such as those utilized in autonomous vehicles, frequently encounter new situations, such as varying weather conditions [1] and changing illumination levels [36]. Consequently, the machine learning community has increasingly directed their attention towards domain adaptation [4], [27], [22] concept.