Adversarial attacks by malicious actors on machine learning systems, such as
introducing poison triggers into training datasets, pose significant risks. The
challenge in resolving such an attack arises in practice when only a subset of
the poisoned data can be identified. This necessitates the development of
methods to remove, i.e. unlearn, poison triggers from already trained models
with only a subset of the poison data available. The requirements for this task
significantly deviate from privacy-focused unlearning where all of the data to
be forgotten by the model is known. Previous work has shown that the
undiscovered poisoned samples lead to a failure of established unlearning
methods, with only one method, Selective Synaptic Dampening (SSD), showing
limited success. Even full retraining, after the removal of the identified
poison, cannot address this challenge as the undiscovered poison samples lead
to a reintroduction of the poison trigger in the model. Our work addresses two
key challenges to advance the state of the art in poison unlearning. First, we
introduce a novel outlier-resistant method, based on SSD, that significantly
improves model protection and unlearning performance. Second, we introduce
Poison Trigger Neutralisation (PTN) search, a fast, parallelisable,
hyperparameter search that utilises the characteristic "unlearning versus model
protection" trade-off to find suitable hyperparameters in settings where the
forget set size is unknown and the retain set is contaminated. We benchmark our
contributions using ResNet-9 on CIFAR10 and WideResNet-28x10 on CIFAR100.
Experimental results show that our method heals 93.72% of poison compared to
SSD with 83.41% and full retraining with 40.68%. We achieve this while also
lowering the average model accuracy drop caused by unlearning from 5.68% (SSD)
to 1.41% (ours).

通过引入新的抗干扰方法和寻找适合的超参数来解决恶意攻击和毒数据从已训练模型中删除的问题，我们的方法在 CIFAR10 和 CIFAR100 数据集上检验后，毒数据去除效果显著，修复了 93.72% 的毒样本，相较于全模型重新训练方法（40.68%）和 Selective Synaptic Dampening 方法（83.41%），我们的方法降低了模型准确率丧失的程度。