The success of DNNs often depends on training with large-scale datasets, but building such datasets is both expensive and challenging. Consequently, public datasets from open-source platforms like HuggingFace have become popular, posing significant risks of data poisoning attacks. Existing backdoor defenses in NLP primarily focus on identifying and removing poisoned samples; however, purifying a backdoored model with these sample-cleaning approaches typically requires expensive retraining. Therefore, we propose Greedy Module Substitution (GMS), which identifies and substitutes ''deadwood'' modules (i.e., components critical to backdoor pathways) in a backdoored model to purify it. Our method relaxes the common dependency of prior model purification methods on clean datasets or clean auxiliary models. When applied to RoBERTa-large under backdoor attacks, GMS demonstrates strong effectiveness across various settings, particularly against widely recognized challenging attacks like LWS, achieving a post-purification attack success rate (ASR) of 9.7% on SST-2 compared to 58.8% for the best baseline approach.

本研究旨在解决深度神经网络（DNN）在面对公共数据集时可能遭遇的数据中毒攻击问题。我们提出了一种新颖的方法——贪婪模块替换（GMS），能够识别并替换后门模型中关键的“冗余”模块，从而实现模型的净化。实验结果表明，GMS在多个设置下对抗广为人知的攻击非常有效，显著降低了后续攻击成功率。

消除冗余：通过选择性模块替换进行后训练模型净化