Adversarial Unlearning of Backdoors via Implicit Hypergradient

1 INTRODUCTION

• Backdoor attacks embed training-time triggers so patched test examples are misclassified into a target class, threatening mission-critical applications.The introduction gives the example of a sticker causing a road-sign classifier to label STOP signs as speed-limit signs (Gu et al., 2017).Source: §1 · p. 1
• Trigger-synthesis defenses can be ineffective against many targeted classes and computationally costly, while other approaches struggle to balance robustness and accuracy or depend sensitively on attack and augmentation choices.The introduction cites trigger synthesis (Guo et al., 2019), pruning and fine-tuning (Liu et al., 2018a), preprocessing (Qiu et al., 2021), and teacher-guided fine-tuning (Li et al., 2020b).Source: §1 · p. 1
• The minimax formulation assumes only a bounded-norm trigger, and I-BAU uses implicit hypergradients to account for interdependence between inner and outer optimization.The formulation encompasses prior trigger-synthesis defenses, which solve the inner and outer problems independently.Source: §1 · pp. 1–2
• I-BAU usually significantly outperformed the best baseline, was more than 13X faster than the most efficient single-target baseline, and remained effective with 100 clean samples when all baselines failed.Evaluation covered seven attacks, two datasets, and varied attack settings.Source: §1 · p. 2
• The authors analyze I-BAU’s convergence and derive generalization bounds for linear models and neural networks, addressing robustness transfer to unseen test data.The generalization analysis concerns the extent to which robustness gained by solving the minimax on clean data extends to test examples.Source: §1 · p. 2

Backdoor Attacks

• Backdoor attacks evolved from visible patterns and optimized triggers to visually invisible and clean-label attacks, then to triggers hidden in frequency or auto-encoder feature spaces.The paper incorporates successful attacks from these major groups and reports its defense is effective and generalizable.Source: §2 · p. 2

Backdoor Defenses

• Defenses include poison detection, poisoned-model identification, robust training, and backdoor removal; robust training may reduce clean accuracy.Poison detection models clean-sample distributions; removal methods use trigger synthesis or preprocessing and fine-tuning.Source: §2 · p. 2
• Backdoor removal is a fundamental response to poisoned models, but prior methods lack satisfying robustness across datasets and triggers; this paper proposes a minimax solver and compares cutting-edge methods.Prior removal approaches synthesize triggers or use preprocessing and fine-tuning.Source: §2 · p. 2

• The attack model allows multiple triggers and target classes, bounds trigger norm, and defines poison ratio as the poisoned-example share of training data.The attacker aims to make triggered clean test samples predict a target class while leaving predictions without the trigger unaffected.Source: §3 · p. 2
• Given a poisoned classifier and a small clean dataset, the defender seeks a model whose predictions are unchanged when a backdoor trigger is added.The clean data is assumed much smaller than the amount needed to retrain a high-accuracy model from scratch.Source: §3 · p. 3
• The defense minimizes model parameters against the highest loss caused by one bounded trigger applied to every clean sample.Unlike evasion-attack training, which optimizes perturbations independently for each sample, the backdoor formulation uses the same trigger across samples (Madry et al., 2017).Source: §3 · p. 3
• The minimax formulation unifies prior trigger-synthesis and unlearning methods, which solve inner and outer optimization separately and neglect their interdependence.It maximizes loss for the correct label rather than minimizing loss for an attacker-selected target because the defender does not know that target; synthesis methods may also fail when multiple targets are present.Source: §3 · p. 3
• A vanishing loss in the minimax formulation measures perfect robustness on the clean dataset against attacks within the stated model.The formulation assumes no trigger property beyond the bounded-norm constraint; robustness on the data distribution is addressed through generalization analysis.Source: §3 · p. 3

A natural (but problematic) algorithm design

• Universal-perturbation adversarial training produced highly variable ASR across runs and mostly erratic, slow ASR decline within runs.Its perturbation method can cancel the effects of individual example perturbations; moreover, Danskin’s Theorem is unsuitable when the inner maximum is not attained and the loss is nonconvex.Source: §4 · pp. 3–4

Proposed algorithm

• I-BAU updates the poisoned model using an approximate implicit hypergradient based on a suboptimal inner solution, improving robustness to inner-optimization error without requiring convexity.The algorithm evaluates the minimax objective at an arbitrary suboptimal inner solution rather than relying on solving the inner maximization to global or local optimality.Source: §4 · pp. 4–5
• At a stationary inner solution with an invertible Hessian, I-BAU derives the response Jacobian via the implicit function theorem and approximates it with an iterative solver and reverse-mode differentiation.The response Jacobian accounts for the sensitivity of the inner solution to model parameters; suggested solvers include conjugate gradient and fixed-point methods.Source: §4 · p. 4
• Because the implicit hypergradient depends on the inner solution’s value rather than its optimization path, I-BAU is more memory-efficient than explicit bilevel optimization and generalizes straightforwardly to other norms.The authors report that a large norm bound has no discernible effect on clean accuracy, allowing flexibility for triggers at different scales.Source: §4 · p. 5

Convergence Bound

• As inner epochs increase, I-BAU’s estimated hypergradient becomes more accurate, and under convexity the solution converges.The convergence analysis assumes smoothness and strong convexity of H, Lipschitz and bounded derivative terms, and asymptotic convergence of the inner iterates.Source: §5 · p. 5

Generalization Bound for Linear Models

• For linear models, generalizability improves with more clean samples; the backdoor bound lacks the d factor in the evasion bound’s second term, favoring high-dimensional inputs.The bound applies to norm-bounded linear classifiers and holds with probability at least 1 − ξ.Source: §5 · p. 5

Generalization Bound for Neural Networks

• For neural networks, the generalization bound improves with more clean samples but is harder than regular training; I-BAU remains effective with only 100 clean samples.The proof treats the shared backdoor perturbation across poison samples as additional model-parameter dimensions and uses Dudley’s entropy integral to bound Rademacher complexity.Source: §5 · p. 6

6.1 EFFICACY

• The efficacy evaluation covers three attack settings and seven triggers, using a 20% poison ratio in the main-text experiments.The settings are one-trigger-one-target, one-trigger-all-to-all, and multi-trigger-multi-target.Source: §6.1 · p. 6
• I-BAU mitigates one-trigger attacks with little clean-accuracy impact, is the only defense effective across GTSRB attack settings, and reduces ASR while maintaining ACC in multi-trigger tests.It is comparable to or better than the strongest baseline in most settings, with Smooth triggers the stated exception on CIFAR-10.Source: Table 1 · p. 7, Table 2 · p. 7, §6.1 · pp. 7–8

6.2 STABILITY

• On CIFAR-10 with BadNets, I-BAU reduces ASR more smoothly across runs than the naive heuristic, mitigates the attack after one outer-minimization iteration, and attains slightly higher ACC.The comparison tracks ACC and ASR over iterations for each run.Source: Figure 1 · p. 8, §6.2 · p. 8

6.3 SENSITIVITY

• Across poison ratios on CIFAR-10 Trojan WM, I-BAU is least sensitive among the compared defenses, maintaining good ACC and ASR as the poison ratio changes.TABOR ultimately fails to remove triggers as the poison ratio drops, while NC becomes the most effective baseline.Source: Table 4 · p. 9, §6.3 · p. 9
• With only 100 clean samples on CIFAR-10 Trojan WM, I-BAU still achieves acceptable backdoor removal and is least sensitive to clean-set size.The performance of all defenses declines as the available clean samples decrease.Source: Table 5 · p. 9, §6.3 · p. 9

6.4 EFFICIENCY

• I-BAU takes 6.82 s on CIFAR-10 and 7.84 s on GTSRB on average to reduce ASR below 20%, mitigating one-trigger-one-target attacks in one iteration.It needs more rounds for difficult all-to-all and multi-trigger-multi-target attacks but remains effective across those settings.Source: §6.4 · p. 9

7 CONCLUSION

• 7.35 s is I-BAU’s average time to achieve an effective defense in standard one-trigger-one-target cases.The conclusion reports this average time for the standard setting.Source: Table 6 · p. 9, §7 · p. 9
• I-BAU is the only generalizable defense across all eleven evaluated backdoor attacks, with results comparable to or exceeding the best results from combining six state-of-the-art techniques.The conclusion also reports reduced sensitivity to poison rate and effectiveness with only 100 clean samples.Source: §7 · p. 9
• The minimax formulation encompasses existing unlearning objectives without assumptions about attack strategies or trigger patterns, and I-BAU solves it using implicit hypergradients.Theoretical analysis verifies convergence and generalizability of I-BAU or the minimax formulation.Source: §7 · p. 9

A.1 CONVERGENCE BOUND

• The inner update map is shown to be contractive under a step size chosen from the strong-convexity and smoothness parameters of H.The passage gives a contraction coefficient q_θ and states that the optimal choice yields q_θ = κ(θ)−1.Source: §A.1 · p. 13
• The analysis writes the partial Jacobians of Φ with respect to both variables and simplifies the second-variable Jacobian at the inner solution.Source: §A.1 · p. 13
• The proof bounds the second-variable partial Jacobian of Φ and assumes a bound on the cross-derivative term.Source: §A.1 · p. 13
• Lipschitz continuity and norm-boundedness assumptions on second-order terms control changes in the partial Jacobians as δ varies.The passage gives an explicit bound for the change in the first-variable Hessian term.Source: §A.1 · p. 13
• Citing Grazzi et al. (2020), Lemma 1 states that the approximate hypergradient has bounded error.Source: §A.1 · p. 13
• The proof of Theorem 1 applies Lemma 1’s inequality with the constants specified in the preceding assumptions.Source: §A.1 · p. 13

A.2 GENERALIZATION BOUNDS

• The setup defines M(v, y)=vy−max_j≠y vj and uses ramp loss ℓγ to form the adversarial loss class Θγ.Θγ contains losses ℓγ(−M(θ(x+δ), y)) for θ∈Θ.Source: §A.2 · p. 14
• Rγ(θ) and empirical risk R̂γ(θ) upper-bound error fractions on the source distribution and unlearning dataset Dsan, respectively.The section introduces population and empirical risks against perturbation δ.Source: §A.2 · p. 14
• The adversarial-unlearning bound is derived with standard Rademacher-complexity tools, whose control instantiates it for linear models and neural networks.The passage identifies these model classes but does not provide the complexity expressions here.Source: §A.2 · p. 14
• For unlearned models Θ with θ ∈ Θ and margin γ > 0, Lemma 2 defines Θγ as the class of mappings (x, y) ↦ ℓγ(−M(θ(x + δ), y)) over θ ∈ Θ.Source: §A.2 · p. 14

A.2.1 PROOF FOR LINEAR MODELS

• The proof considers linear poisoned models whose inputs are perturbed by δ.The model class is defined as γ := {(x, y) ↦ ⟨θ, x + δ⟩ : θ ∈ Θ}.Source: §A.2.1 · p. 14
• The bound assumes ∥θ∥ ≤ Cθ, ∥δ∥ ≤ Cδ, and ∥x∥2 ≤ χ.Source: §A.2.1 · p. 14
• The proof bounds the Rademacher complexity by bounding terms A and B, then substitutes the resulting bound into (22) to complete Theorem 2.The derivation of the bound on A uses the Cauchy–Schwarz inequality.Source: §A.2.1 · p. 15

A.2.2 PROOF FOR NEURAL NETWORKS

• The proof reduces the neural-network generalization bound to covering the network class, using four steps from the input-layer cover through the final bound.The later-layer matrix covers come from prior work; induction combines layer covers into a whole-network cover before applying the covering-number estimates to the Rademacher-complexity bound.Source: §A.2.2 · pp. 16, 18, 19, 20
• For the perturbed input layer, the proof rewrites (X + Δ)A1 as an augmented matrix product and constructs a cover for that product.The target product is X̂Â1, where the augmentation incorporates the repeated perturbation rows.Source: §A.2.2 · p. 16
• For subsequent layers without perturbations, the proof adopts the matrix-covering result of Bartlett et al. (2017) and combines layer covers by induction into a whole-network bound.The network is composed of Lipschitz activation functions and layer operators with specified norm bounds.Source: §A.2.2 · pp. 18–19
• The proof substitutes the whole-network covering estimates into the Dudley entropy integral to bound Rademacher complexity and complete Theorem 3.It first forms a class using the ramp loss and negated margin operator, then applies the covering-number bound with α := 1/√n.Source: §A.2.2 · p. 20

A.2.3 EMPERICAL VALIDATION OF THEOREM 3

• For Trojan WM-poisoned CIFAR-10 models (20% poison rate, target label 2), increasing width corresponded to a smaller Error Gap; using more clean samples during I-BAU also reduced Error Gap, indicating better generalization.For width comparisons, Error Gap is the absolute difference between test and training error after defense. Both results aligned with Theorem 3.Source: §A.2.3 · pp. 20–21

A.3 IMPLEMENTATION DETAILS AND COMPLEXITY ANALYSIS; A.3.2 MEMORY COMPLEXITY ANALYSIS; A.3.3 TIME COMPLEXITY ANALYSIS

• I-BAU approximates the response Jacobian with an iterative solver and reverse-mode automatic differentiation rather than directly computing second-order derivatives.Its memory complexity is Mem(∇H(δ, θ)), versus Mem(K · T · ∇H(δ, θ)) for explicit-gradient methods; with fixed-point iterations ϑ = 5, K = 1 sufficed in most single-target cases, and the analysis finds I-BAU more time-efficient than the compared defenses.Source: §A.3 · p. 21, §A.3.2 · p. 22, §A.3.3 · pp. 22–23

A.3.1 ABLATION STUDY ON THE l2 NORM BOUND

• On GTSRB, larger l2 norm bounds than the Trojan WM trigger’s 8.739 norm enabled effective defense with low ASR and little clean-ACC impact.The authors recommend a large bound to encompass more potential attacks; Best Efforts imposed no norm constraint beyond keeping trigger values within the image range.Source: §A.3.1 · pp. 21–22

A.4 EXPERIMENTAL DETAILED SETTINGS; A.4.1 ATTACKS DETAILS; A.4.2 BASELINE DEFENSES DETAILS; A.6 TSNE ANALYSIS ON UNLEARNING EFFECTS

• Experiments used CIFAR-10 and GTSRB with 20% poison rates and 5,000 clean samples, and compared I-BAU with six backdoor defenses.The appendix describes eleven incorporated attacks and reports that, after one I-BAU round on a BadNets model, triggered samples mapped back to their original classes in feature space.Source: §A.4.1 · p. 23, §A.4.2 · p. 23, §A.6 · p. 26

A.5 CASE STUDY ON NON-ADDITIVE BACKDOOR ATTACKS; A.5.1 TOWARDS MITIGATING SR; A.5.2 TOWARDS MITIGATING WANET; A.5.3 TOWARDS MITIGATING THE IAB ATTACK; A.5.4 TOWARDS MITIGATING HT; A.5.5 HIGHLIGHTS ON THE CASE STUDIES TOWARDS NON-ADDITIVE ATTACKS

• I-BAU was empirically effective against non-additive attacks, including semantic replacement, WaNet, IAB, and Hidden Trigger.Semantic replacement was mitigated within three rounds with an acceptable ACC drop; WaNet and IAB defenses had acceptable or low ACC impact. For Hidden Trigger, after 20 rounds ACC/ASR was 84.58/11.10, and after 90 rounds it was 84.06/0.23.Source: §A.5 · p. 24, §A.5.1 · p. 25, §A.5.2 · p. 25

A.7 ITERATIVE ILLUSTRATION ON MULTI-TARGET CASES

• For BadNets all-to-all attacks, I-BAU reduced ASR below 10% while keeping CIFAR-10 ACC above 80%, and maintained GTSRB ACC around 99%.The CIFAR-10 model’s original ACC was 86.38; it took more unlearning rounds than one-trigger-one-target cases, while GTSRB required fewer rounds.Source: Figure 5 · p. 27, §A.7 · p. 27
• For 7-trigger-7-target attacks, CIFAR-10 required more than 200 I-BAU rounds, while GTSRB maintained ACC close to 99%.Trojan WM and Trojan SQ were easier for I-BAU to find, which the authors attribute to their optimized triggers.Source: Figure 6 · p. 27, §A.7 · p. 27