通过持续学习中的灾难性遗忘视角重新思考后门对抗性去学习
Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning
AI总结：
本文将后门学习与去学习建模为持续学习视角下的三阶段过程，基于灾难性遗忘机制推导完全后门去学习的必要条件，并提出盲反演-后门对抗性去学习（BI-BAU）方法，通过期望最大化算法优化最大后验目标，有效消除后门效应。
摘要：
现有研究表明，当前的后门防御方法鲁棒性有限，且常无法应对特定类型的攻击。更令人担忧的是，主流的安全调优策略往往仅提供表面安全保护，因为它们未能完全消除后门效应。在本工作中，我们从持续学习视角将后门学习与去学习重新表述为一个顺序的三阶段过程。在此框架内，我们正式定义了完全后门去学习，并基于灾难性遗忘机制进一步推导了实现它的必要条件。在这些见解的指导下，我们提出了盲反演-后门对抗性去学习（BI-BAU），它将满足去学习条件的对抗样本生成问题表述为一个盲反演问题。我们通过将对抗训练的双层优化过程整合到期望最大化（EM）算法框架中来解决该问题，以优化最大后验（MAP）目标。此外，BI-BAU被扩展到目标类别未知的无目标对抗场景以及多模态对比学习任务中，增强了其在预训练模型可能被攻破的真实部署场景中的适用性。大量实验表明，我们的方法在广泛的后门攻击中具有通用适用性，并能有效且彻底地消除后门模型中的后门效应。
英文摘要：
Existing studies reveal that current backdoor defenses exhibit limited robustness and often fail against specific types of attacks. More concerningly, prevailing safety tuning strategies tend to provide only superficial safety protection, as they fall short of completely eliminating the backdoor effects. In this work, we present a novel formulation of backdoor learning and unlearning as a sequential, three-stage process from a continual learning perspective. Within this framework, we formally define complete backdoor unlearning and further derive the necessary conditions for achieving it based on the mechanism of catastrophic forgetting. Guided by these insights, we propose Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU), which formulates the generation of adversarial examples satisfying the unlearning conditions as a blind inversion problem. We solve this by integrating the bi-level optimization process of adversarial training into an Expectation-Maximization (EM) algorithm framework to optimize the maximum a posteriori (MAP) objective. Furthermore, BI-BAU is extended to untargeted adversarial scenarios with unknown target classes, as well as to multi-modal contrastive learning tasks, enhancing its applicability to real-world deployment scenarios where pre-trained models may be compromised. Extensive experiments demonstrate that our method exhibits general applicability across a wide spectrum of backdoor attacks and can effectively and thoroughly eliminate the backdoor effects from a backdoor model.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
