Foundation model has become the backbone of the AI ecosystem. In particular,
a foundation model can be used as a general-purpose feature extractor to build
various downstream classifiers. However, foundation models are vulnerable to
backdoor attacks and a backdoored foundation model is a single-point-of-failure
of the AI ecosystem, e.g., multiple downstream classifiers inherit the backdoor
vulnerabilities simultaneously. In this work, we propose Mudjacking, the first
method to patch foundation models to remove backdoors. Specifically, given a
misclassified trigger-embedded input detected after a backdoored foundation
model is deployed, Mudjacking adjusts the parameters of the foundation model to
remove the backdoor. We formulate patching a foundation model as an
optimization problem and propose a gradient descent based method to solve it.
We evaluate Mudjacking on both vision and language foundation models, eleven
benchmark datasets, five existing backdoor attacks, and thirteen adaptive
backdoor attacks. Our results show that Mudjacking can remove backdoor from a
foundation model while maintaining its utility.

提出了 Mudjacking，这是第一个用于修补基础模型以去除后门的方法，通过梯度下降的方法解决了将基础模型修补为优化问题，在保持其功用的同时成功去除了后门。