PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoor Defense with Machine Unlearning

Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, Jianfeng Ma

arXiv:2201.09538v1cs.CRcs.LG

TL;DR

Backdoor injection can implant trigger-dependent behavior in neural networks while leaving clean-data performance intact, and existing defenses provide limited erasing effectiveness. BAERASER recovers the infected trigger distribution with entropy-maximizing generation and reverses the attack using gradient-ascent machine unlearning. Across four benchmark datasets and three state-of-the-art attacks, it reports roughly 98–99% average attack-success-rate reduction with negligible or less-than-5% accuracy drops.

  • Problem

    Backdoor attacks are difficult to defend because triggers can control specific model behaviors without affecting normal-data performance, while effective erasing methods remain limited.

  • Method

    BAERASER recovers infected trigger patterns with an entropy-maximization generative model and erases them through gradient-ascent machine unlearning without full training-data access.

  • Results

    BAERASER lowers attack success rates from almost 100% to about 10% across four datasets and three attacks while introducing negligible accuracy drops.

  • Takeaways & Limitations

    The results support machine unlearning as an effective backdoor-defense strategy that is stronger than existing fine-tuning or pruning solutions in the reported settings.

Abstract

from arXiv · show

Backdoor injection attack is an emerging threat to the security of neural networks, however, there still exist limited effective defense methods against the attack. In this paper, we propose BAERASE, a novel method that can erase the backdoor injected into the victim model through machine unlearning. Specifically, BAERASE mainly implements backdoor defense in two key steps. First, trigger pattern recovery is conducted to extract the trigger patterns infected by the victim model. Here, the trigger pattern recovery problem is equivalent to the one of extracting an unknown noise distribution from the victim model, which can be easily resolved by the entropy maximization based generative model. Subsequently, BAERASE leverages these recovered trigger patterns to reverse the backdoor injection procedure and induce the victim model to erase the polluted memories through a newly designed gradient ascent based machine unlearning method. Compared with the previous machine unlearning solutions, the proposed approach gets rid of the reliance on the full access to training data for retraining and shows higher effectiveness on backdoor erasing than existing fine-tuning or pruning methods. Moreover, experiments show that BAERASE can averagely lower the attack success rates of three kinds of state-of-the-art backdoor attacks by 99\% on four benchmark datasets.

I. INTRODUCTION

Backdoor erasing remains difficult because triggers can preserve targeted behavior without harming clean-data performance, while existing defenses have limited robustness. BAERASER reverses injection by recovering trigger patterns and unlearning them without full training-data access.

  • Contribution: BAERASER treats backdoor erasing as unlearning polluted trigger memories from the victim model.The approach is motivated by the gap between backdoor detection and reliable backdoor erasing.
  • Contribution: Trigger recovery uses a max-entropy generative model to extract infected trigger patterns without accessing training data.The method replaces typical GAN-based recovery to address high-dimensional trigger patterns.
  • Contribution: Gradient-ascent unlearning reverses training and uses a dynamic penalty to mitigate catastrophic forgetting without retraining.This design targets the full-training-set requirement of most existing machine-unlearning methods.
  • Experiments: 98% average attack-success-rate reduction across four datasets and three state-of-the-art attacks is reported with less than 5% accuracy drops.The experiments report stronger performance than most prior methods.

II. RELATED WORK

Backdoor attacks implant trigger-dependent behavior while preserving normal performance, motivating defenses that both detect and erase the injected behavior. Prior erasing methods trade off robustness, clean accuracy, or complete removal of polluted memories.

  • 1) Backdoor Injection Attack.: Backdoor attacks use triggers ranging from single pixels and tiny patches to imperceptible noises to induce specific model behaviors.The attack can preserve performance on clean inputs while changing predictions on triggered inputs.
  • 2) Backdoor Injection Defense.: Backdoor defense comprises detection and erasing, but detection alone leaves the poisoned model vulnerable to injected backdoors.Erasing is intended to purify polluted model memory while preserving clean-data accuracy.
  • 2) Backdoor Injection Defense.: Fine-tuning is easy to apply but weak against state-of-the-art attacks, while fine-pruning improves defense at the cost of model performance.Fine-pruning removes neurons activated by triggers, which can also correlate with normal inputs.
  • 2) Backdoor Injection Defense.: Distillation transfers clean memories but remains an improved fine-tuning approach rather than thoroughly removing polluted memories.The related methods therefore struggle to balance defense effectiveness and clean accuracy.

B. Machine Unlearning

Machine unlearning removes selected samples’ influence but commonly relies on costly retraining, creating a challenge for backdoor defense. BAERASER assumes a compromised victim model, limited validation access, and no full training set, while preserving clean-data accuracy.

  • B. Machine Unlearning: Machine unlearning strategically eliminates specific samples’ influence, but retraining-based methods can require massive computational and storage resources.Prior approaches include SISA and related retraining strategies.
  • A. Threat Model & Goals: BAERASER considers an attacker who poisons source images with triggers while the victim model remains normal on clean data.The defender must purify an already successfully attacked model.
  • 1) Threat Model:: The defender lacks knowledge of polluted images and the attacker’s target label and has only limited validation data, not the full training set.These constraints model a restricted real-world defense setting.
  • 1) Threat Model:: The defense goal is to correct predictions on backdoored images while maintaining accuracy on remaining clean data.The victim model is denoted F_θ.

2) Defense goal:

BAERASER reverses backdoor injection in two stages: recover the trigger pattern and unlearn its effect from the victim model. Its recovery and training-data-free unlearning components are designed to improve interpretability and avoid retraining.

  • 2) Defense goal:: The defense goal penalizes over-unlearning through a term that protects memories associated with remaining clean data.The penalty coefficient λ weights this protection term.
  • 1) Key Intuition.:: BAERASER reverses injection by mapping model outputs back to trigger-producing inputs, then converting trigger learning into unlearning.These steps are called trigger pattern recovery and trigger pattern unlearning.
  • 1) Key Intuition.:: A max-entropy staircase approximator recovers valid trigger patterns and is intended to improve high-dimensional trigger-pattern recovery over GANs.The recovered patterns are those memorized by the victim model.
  • 1) Key Intuition.:: Gradient-ascent unlearning removes recovered trigger patterns without relying on the full training set or retraining.This design adapts machine unlearning to backdoor erasing under restricted data access.

IV. BACKDOOR ERASING WITH MACHINE UNLEARNING

BAERASER reverses backdoor injection by recovering trigger distributions without training-data access, then using valid recovered patterns for erasing.

  • IV. BACKDOOR ERASING WITH MACHINE UNLEARNING: The recovery procedure initializes thresholds and generative models for each label, optimizes them with validation batches, and returns a trigger pool for unlearning.Algorithm 1 specifies Gaussian noise sampling, loss optimization, and attack-success filtering before the unlearning stage.
  • A. Trigger Pattern Recovery: BAERASER treats trigger recovery as sampling-free generative modeling of an unknown trigger distribution that affects batches of inputs.This distinguishes trigger patterns from adversarial noises, which typically affect only individual inputs.
  • A. Trigger Pattern Recovery: MSA uses entropy maximization and staircase approximation across multiple sub-models to recover trigger patterns from the victim model.It addresses model dropping encountered by typical GAN-based entropy estimation on high-dimensional trigger patterns.
  • A. Trigger Pattern Recovery: Recovered patterns are retained only when their batch attack success rate exceeds a threshold, ensuring they function as valid triggers rather than adversarial noises.The recovered trigger pool is built by evaluating generated patterns over validation batches.

B. Trigger Pattern Unlearning

BAERASER unlearns recovered trigger patterns through gradient ascent while preserving clean-model behavior with validation-data penalties and dynamic parameter regularization.

  • B. Trigger Pattern Unlearning: Gradient ascent reverses gradient-descent learning to erase the victim model’s targeted trigger memories.The unlearning loss is defined over recovered trigger patterns and their targeted labels.
  • B. Trigger Pattern Unlearning: Validation-data cross-entropy preserves normal-data memory, while a dynamic penalty limits over-unlearning unrelated model memories.Directly applying the basic unlearning objective can cause catastrophic forgetting and significant performance degradation.
  • B. Trigger Pattern Unlearning: The penalty weight increases when unlearning causes validation performance to drop, restraining further parameter changes.The weight is defined per parameter dimension and adapts according to target-model performance on validation data.
  • B. Trigger Pattern Unlearning: The paper explicitly limits its scope to backdoor defense and does not discuss defense against adversarial attacks.This is the stated scope boundary of the method.
  • B. Trigger Pattern Unlearning: BAERASER is positioned as achieving stronger backdoor defense with lower performance loss than simple fine-tuning or pruning.The comparison is stated as the consequence of combining gradient-based unlearning with clean-data preservation and adaptive penalties.

V. PERFORMANCE EVALUATION

The evaluation compares BAERASER with fine-tuning, Fine-Pruning, and NAD across three backdoor attacks and four benchmark datasets using ASR and accuracy.

  • V. PERFORMANCE EVALUATION: Baselines span fine-tuning with trigger recovery, Fine-Pruning, and Neural Attention Distillation, representing three mainstream backdoor-erasing directions.The fine-tuning baseline uses trigger pattern recovery and is stronger than pure fine-tuning.
  • V. PERFORMANCE EVALUATION: The study evaluates BAERASER against BadNet, TrojanNN, and IMC, covering training-stage and post-training attacks with varied trigger sizes.IMC is described as a particularly strong attack that combines adversarial attacks.
  • V. PERFORMANCE EVALUATION: Experiments use MNIST, Fashion-MNIST, CIFAR-10, and CIFAR-100 with ResNet18 as the base model.All methods are assessed on four common benchmark datasets.
  • V. PERFORMANCE EVALUATION: Effectiveness is measured by Attack Success Rate and model Accuracy, with successful erasing requiring low ASR and small accuracy drop.Metrics are computed on the testing sets of all four datasets.
  • V. PERFORMANCE EVALUATION: All defenses access 5% randomly selected clean testing data, use recommended hyperparameters, and average results over five random trials.BAERASER uses SGD with momentum 0.9, batch size 128, and learning rate 0.01.
  • V. PERFORMANCE EVALUATION: Table I reports ASR and accuracy before defense plus averages over nine conditions for MNIST and Fashion-MNIST.The table caption defines the scope of the compared metrics and conditions.

A. Comparison

BAERASER lowers attack success substantially while preserving accuracy, outperforming baselines especially on harder attacks and remaining robust across trigger sizes.

  • A. Comparison: Before defense, all evaluated attacks maintain more than 98% ASR across 3×3, 5×5, and 7×7 trigger sizes.The experiments extend beyond the commonly used 3×3 trigger size to test robustness.
  • A. Comparison: BAERASER lowers around 98% ASR across all three attacks with negligible accuracy drops and outperforms baselines on most settings.The reported comparison prioritizes both backdoor removal and preservation of clean-task accuracy.
  • A. Comparison: BAERASER reduces ASR from almost 100% to about 10% across all four datasets, whereas NAD lowers IMC ASR by only about 40%-60% on CIFAR-10 and CIFAR-100.The contrast is most pronounced for the state-of-the-art IMC attack.
  • A. Comparison: As trigger size increases, BAERASER can improve while other defenses tend to worsen, because larger triggers provide more distinguishable features for its unlearning process.The paper links this behavior to faster convergence toward the desired unlearning direction and less punishment on normal data.

B. Further Understanding of BAERASER

This section examines tunable factors and the effectiveness of BAERASER through extensive experiments.

  • The experiments investigate tunable parameters that influence BAERASER’s performance.The section frames the analysis around parameter sensitivity and method effectiveness.
  • The analysis evaluates how BAERASER’s performance changes under different experimental settings.
  • The experiments provide further evidence about BAERASER’s effectiveness.

1) Trade-off between ASR and Acc:

BAERASER trades attack-success-rate reduction against clean accuracy, while its performance improves with more held-out clean data and depends on the α-to-β balance.

  • 1) Trade-off between ASR and Acc:: Less than 10% accuracy drop is maintained while ASR decreases to almost 0%, although later reductions sacrifice more accuracy.More unlearning iterations intensify catastrophic forgetting and can accelerate accuracy decline.
  • 2) Impact of Holding Ratio:: With only 1% clean data, or 500 clean points, BAERASER lowers ASR by at most 98%, and higher holding ratios improve defense.
  • 3) Impact of α and: Increasing β/α prioritizes controlling accuracy loss, whereas very small ratios lower ASR toward 0% but can cause more than 10% accuracy drop.The experiments support the dynamic penalty mechanism as a way to reduce catastrophic forgetting.

4) Visualization of Recovered Triggers:

BAERASER recovers triggers that closely resemble the originals and unlearns backdoor behavior rapidly while preserving correct memories through its penalty mechanism.

  • 4) Visualization of Recovered Triggers:: Recovered triggers differ slightly from the originals, but most pixel differences are negligible, supporting their use for backdoor defense.The recovery method still leaves room for improvement across a wider range of applications.
  • 5) Understanding of Backdoor Unlearning:: Backdoor unlearning converges triggered-input predictions toward the correct direction in only eight iterations and remains robust to trigger position.It also largely preserves correct memories, including when the attacker’s target label is already correct.
  • VI. CONCLUSION: BAERASER combines generative trigger recovery with gradient-ascent machine unlearning to reverse backdoor injection without relying on training-data access.The conclusion reports stronger defense capability than existing solutions.
Loading 2201.09538v1…