Backdoor Defense with Machine Unlearning

Abstract

Backdoor injection attack is an emerging threat to the security of neural networks, however, there still exist limited effective defense methods against the attack. In this paper, we propose BAERASER, a novel method that can erase the backdoor injected into the victim model through machine unlearning. Specifically, BAERASER mainly implements backdoor defense in two key steps. First, trigger pattern recovery is conducted to extract the trigger patterns infected by the victim model. Here, the trigger pattern recovery problem is equivalent to the one of extracting an unknown noise distribution from the victim model, which can be easily resolved by the entropy maximization based generative model. Subsequently, BAERASER leverages these recovered trigger patterns to reverse the backdoor injection procedure and induce the victim model to erase the polluted memories through a newly designed gradient ascent based machine unlearning method. Compared with the previous machine unlearning solutions, the proposed approach gets rid of the reliance on the full access to training data for retraining and shows higher effectiveness on backdoor erasing than existing fine-tuning or pruning methods. Moreover, experiments show that BAERASER can averagely lower the attack success rates of three kinds of state-of-the-art backdoor attacks by 99% on four benchmark datasets.

Evaluating Machine Unlearning via Epistemic Uncertainty

“…However, it is worth mentioning that Machine Unlearning is not limited to this use case. In [16], Liu et al, for instance, utilize forgetting in order to remove backdoors that were induced into a model. Since the field of Machine Unlearning is rather young, we believe that applications in many other domains will likely arise soon, e.g., model revision, continual learning and bias correction.…”

“…Finally, we have those approaches that are neither perfect nor give guarantees [7,8,9,16,22,28,29], but evaluate the success of unlearning purely empirical or compare the resulting model with an actual retrained model. The latter might be interesting from a theoretical point of view but is inapplicable in practice.…”