选择性遗忘：关于被植入木马的机器学习模型中后门效应的高效、高保真且盲目的抑制
Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models
AI总结：
本文提出 SEAM，通过随机标注干净数据诱发灾难性遗忘再恢复主任务，在无触发器条件下盲抑制后门，并在图像与 NLP 任务上证明其更快、更省数据且优于现有方法。
摘要：
在本文中，我们提出了一种简单却出奇有效的技术，用于在被植入后门的模型上诱发“选择性遗忘”。我们的方法称为 SEAM，其灵感来自灾难性遗忘（CF）问题，这是持续学习中一个长期存在的问题。我们的想法是在随机标注的干净数据上重新训练给定的 DNN 模型，以在模型上诱发 CF，从而导致其突然遗忘主要任务和后门任务；随后，我们通过在正确标注的干净数据上重新训练该随机化模型来恢复主要任务。我们通过将遗忘过程建模为持续学习，并进一步使用 Neural Tangent Kernel 近似 DNN 以衡量 CF，对 SEAM 进行了分析。我们的分析表明，在没有触发器输入的情况下，我们的随机标注方法实际上最大化了对未知后门的 CF，同时还保留了网络中的部分特征提取能力，从而能够快速恢复主要任务。我们进一步在图像处理和自然语言处理任务上评估了 SEAM，涵盖数据污染和训练操纵攻击，涉及数千个模型，这些模型要么在流行图像数据集上训练，要么由 TrojAI 竞赛提供。我们的实验表明，SEAM 大幅优于最先进的遗忘技术，在几分钟内即可实现高保真度（用于衡量主要任务准确率与后门准确率之间的差距）（在 MNIST 数据集上比从头训练模型快约 30 倍），并且只需要少量干净数据（TrojAI 模型训练数据的 0.1%）。
英文摘要：
In this paper, we present a simple yet surprisingly effective technique to induce "selective amnesia" on a backdoored model. Our approach, called SEAM, has been inspired by the problem of catastrophic forgetting (CF), a long standing issue in continual learning. Our idea is to retrain a given DNN model on randomly labeled clean data, to induce a CF on the model, leading to a sudden forget on both primary and backdoor tasks; then we recover the primary task by retraining the randomized model on correctly labeled clean data. We analyzed SEAM by modeling the unlearning process as continual learning and further approximating a DNN using Neural Tangent Kernel for measuring CF. Our analysis shows that our random-labeling approach actually maximizes the CF on an unknown backdoor in the absence of triggered inputs, and also preserves some feature extraction in the network to enable a fast revival of the primary task. We further evaluated SEAM on both image processing and Natural Language Processing tasks, under both data contamination and training manipulation attacks, over thousands of models either trained on popular image datasets or provided by the TrojAI competition. Our experiments show that SEAM vastly outperforms the state-of-the-art unlearning techniques, achieving a high Fidelity (measuring the gap between the accuracy of the primary task and that of the backdoor) within a few minutes (about 30 times faster than training a model from scratch using the MNIST dataset), with only a small amount of clean data (0.1% of training data for TrojAI models).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
