Adversarial attacks by malicious actors on machine learning systems, such as
introducing poison triggers into training datasets, pose significant risks. The
challenge in resolving such an attack arises in practice when only a subset of
the poisoned data can be identified. This necessitates the development of
methods to remove, i.e. unlearn, poison triggers from already trained models
with only a subset of the poison data available. The requirements for this task
significantly deviate from privacy-focused unlearning where all of the data to
be forgotten by the model is known. Previous work has shown that the
undiscovered poisoned samples lead to a failure of established unlearning
methods, with only one method, Selective Synaptic Dampening (SSD), showing
limited success. Even full retraining, after the removal of the identified
poison, cannot address this challenge as the undiscovered poison samples lead
to a reintroduction of the poison trigger in the model. Our work addresses two
key challenges to advance the state of the art in poison unlearning. First, we
introduce a novel outlier-resistant method, based on SSD, that significantly
improves model protection and unlearning performance. Second, we introduce
Poison Trigger Neutralisation (PTN) search, a fast, parallelisable,
hyperparameter search that utilises the characteristic "unlearning versus model
protection" trade-off to find suitable hyperparameters in settings where the
forget set size is unknown and the retain set is contaminated. We benchmark our
contributions using ResNet-9 on CIFAR10 and WideResNet-28x10 on CIFAR100.
Experimental results show that our method heals 93.72% of poison compared to
SSD with 83.41% and full retraining with 40.68%. We achieve this while also
lowering the average model accuracy drop caused by unlearning from 5.68% (SSD)
to 1.41% (ours).

通过引入新的抗干扰方法和寻找适合的超参数来解决恶意攻击和毒数据从已训练模型中删除的问题，我们的方法在 CIFAR10 和 CIFAR100 数据集上检验后，毒数据去除效果显著，修复了 93.72% 的毒样本，相较于全模型重新训练方法（40.68%）和 Selective Synaptic Dampening 方法（83.41%），我们的方法降低了模型准确率丧失的程度。

药剂：走向毒物遗忘

Potion: Towards Poison Unlearning

Machine unlearning, the ability for a machine learning model to forget, is
becoming increasingly important to comply with data privacy regulations, as
well as to remove harmful, manipulated, or outdated information. The key
challenge lies in forgetting specific information while protecting model
performance on the remaining data. While current state-of-the-art methods
perform well, they typically require some level of retraining over the retained
data, in order to protect or restore model performance. This adds computational
overhead and mandates that the training data remain available and accessible,
which may not be feasible. In contrast, other methods employ a retrain-free
paradigm, however, these approaches are prohibitively computationally expensive
and do not perform on par with their retrain-based counterparts. We present
Selective Synaptic Dampening (SSD), a novel two-step, post hoc, retrain-free
approach to machine unlearning which is fast, performant, and does not require
long-term storage of the training data. First, SSD uses the Fisher information
matrix of the training and forgetting data to select parameters that are
disproportionately important to the forget set. Second, SSD induces forgetting
by dampening these parameters proportional to their relative importance to the
forget set with respect to the wider training data. We evaluate our method
against several existing unlearning methods in a range of experiments using
ResNet18 and Vision Transformer. Results show that the performance of SSD is
competitive with retrain-based post hoc methods, demonstrating the viability of
retrain-free post hoc unlearning approaches.

机器遗忘能力对于遵守数据隐私法规以及删除有害、被操控或过时信息变得越来越重要。本研究提出了一种名为选择性突触阻尼（SSD）的新型机器遗忘方法，该方法以快速、高性能的方式进行遗忘，且不需要长期存储训练数据。该方法在一系列实验中与现有的遗忘方法进行了对比，结果显示 SSD 的性能与基于重新训练的后续处理方法相当，证明了重新训练后续遗忘方法的可行性。