Abstract:Adversarial attacks by malicious actors on machine learning systems, such as introducing poison triggers into training datasets, pose significant risks. The challenge in resolving such an attack arises in practice when only a subset of the poisoned data can be identified. This necessitates the development of methods to remove, i.e. unlearn, poison triggers from already trained models with only a subset of the poison data available. The requirements for this task significantly deviate from privacy-focused unlearning where all of the data to be forgotten by the model is known. Previous work has shown that the undiscovered poisoned samples lead to a failure of established unlearning methods, with only one method, Selective Synaptic Dampening (SSD), showing limited success. Even full retraining, after the removal of the identified poison, cannot address this challenge as the undiscovered poison samples lead to a reintroduction of the poison trigger in the model. Our work addresses two key challenges to advance the state of the art in poison unlearning. First, we introduce a novel outlier-resistant method, based on SSD, that significantly improves model protection and unlearning performance. Second, we introduce Poison Trigger Neutralisation (PTN) search, a fast, parallelisable, hyperparameter search that utilises the characteristic "unlearning versus model protection" trade-off to find suitable hyperparameters in settings where the forget set size is unknown and the retain set is contaminated. We benchmark our contributions using ResNet-9 on CIFAR10 and WideResNet-28x10 on CIFAR100. Experimental results show that our method heals 93.72% of poison compared to SSD with 83.41% and full retraining with 40.68%. We achieve this while also lowering the average model accuracy drop caused by unlearning from 5.68% (SSD) to 1.41% (ours).

L-GEM Based Robust Learning Against Poisoning Attack

Invisible Poisoning: Highly Stealthy Targeted Poisoning Attack

What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?

A Concealed Poisoning Attack to Reduce Deep Neural Networks’ Robustness Against Adversarial Samples

Transfer Learning Based Countermeasure Against Label Flipping Poisoning Attack

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets

Pick your Poison: Undetectability versus Robustness in Data Poisoning Attacks

Poisoning $\times$ Evasion: Symbiotic Adversarial Robustness for Graph Neural Networks

FedRMA: A Robust Federated Learning Resistant to Multiple Poisoning Attacks

Transferring Robustness for Graph Neural Network Against Poisoning Attacks

RoseAgg: Robust Defense Against Targeted Collusion Attacks in Federated Learning

Exploiting Supervised Poison Vulnerability to Strengthen Self-Supervised Defense

Robust Linear Regression Against Training Data Poisoning

Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networks

Towards Fair Classification against Poisoning Attacks

Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Learning to Poison Large Language Models During Instruction Tuning

Potion: Towards Poison Unlearning

Poisoning Attacks with Generative Adversarial Nets

Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferability