  DNNs' demand for massive data forces practitioners to collect data from the
Internet without careful check due to the unacceptable cost, which brings
potential risks of backdoor attacks. A backdoored model always predicts a
target class in the presence of a predefined trigger pattern, which can be
easily realized via poisoning a small amount of data. In general, adversarial
training is believed to defend against backdoor attacks since it helps models
to keep their prediction unchanged even if we perturb the input image (as long
as within a feasible range). Unfortunately, few previous studies succeed in
doing so. To explore whether adversarial training could defend against backdoor
attacks or not, we conduct extensive experiments across different threat models
and perturbation budgets, and find the threat model in adversarial training
matters. For instance, adversarial training with spatial adversarial examples
provides notable robustness against commonly-used patch-based backdoor attacks.
We further propose a hybrid strategy which provides satisfactory robustness
across different backdoor attacks.
