遗忘后门威胁：通过局部Token遗忘增强多模态对比学习中的后门防御
Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning
AI总结：
本文从模型遗忘角度提出一种低成本的后门防御方法UBT，通过少量中毒样本强化后门捷径以发现可疑样本，并采用基于token的局部遗忘训练机制消除后门关联，在保证模型高干净准确率的同时实现极低的攻击成功率。
摘要：
多模态对比学习已成为利用各种数据模态互补优势构建高质量特征的强大范式。然而，此类系统的开放性无意中增加了后门攻击的可能性。这些攻击在训练期间将恶意行为隐蔽地嵌入模型中，在推理阶段可被特定触发器激活，构成重大安全风险。尽管现有的微调对策减少了此类攻击的不利影响，但这些防御通常会降低干净准确率，并且需要构建大量干净的训练对。在本文中，我们从模型遗忘的角度探索了一种低成本的防御可能性，即是否可以通过构建少量中毒样本，使模型快速遗忘后门威胁（UBT）。具体而言，我们通过以弱相似性样本优先的过拟合训练，强化后门捷径以发现可疑样本。在初步识别可疑样本的基础上，我们引入了一种创新的基于token的局部遗忘训练机制。该技术专门针对模型的中毒部分，施加集中努力以遗忘后门关联，并尽量不损害整体模型的完整性。实验结果表明，我们的方法不仅确保了极低的攻击成功率，还保留了模型较高的干净准确率。
英文摘要：
Multimodal contrastive learning has emerged as a powerful paradigm for building high-quality features using the complementary strengths of various data modalities. However, the open nature of such systems inadvertently increases the possibility of backdoor attacks. These attacks subtly embed malicious behaviors within the model during training, which can be activated by specific triggers in the inference phase, posing significant security risks. Despite existing countermeasures through fine-tuning that reduce the adverse impacts of such attacks, these defenses often degrade the clean accuracy and necessitate the construction of extensive clean training pairs. In this paper, we explore the possibility of a less-cost defense from the perspective of model unlearning, that is, whether the model can be made to quickly \textbf{u}nlearn \textbf{b}ackdoor \textbf{t}hreats (UBT) by constructing a small set of poisoned samples. Specifically, we strengthen the backdoor shortcuts to discover suspicious samples through overfitting training prioritized by weak similarity samples. Building on the initial identification of suspicious samples, we introduce an innovative token-based localized forgetting training regime. This technique specifically targets the poisoned aspects of the model, applying a focused effort to unlearn the backdoor associations and trying not to damage the integrity of the overall model. Experimental results show that our method not only ensures a minimal success rate for attacks, but also preserves the model's high clean accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
