English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

We propose a minimax formulation for removing backdoors from a given poisonedmodel based on a small set of clean data. This formulation encompasses much ofprior work on backdoor removal. We propose the Implicit Bacdoor AdversarialUnlearning (I-BAU) algorithm to solve the minimax. Unlike previous work, whichbreaks down the minimax into separate inner and outer problems, our algorithmutilizes the implicit hypergradient to account for the interdependence betweeninner and outer optimization. We theoretically analyze its convergence and thegeneralizability of the robustness gained by solving minimax on clean data tounseen test data. In our evaluation, we compare I-BAU with six state-of-artbackdoor defenses on seven backdoor attacks over two datasets and variousattack settings, including the common setting where the attacker targets oneclass as well as important but underexplored settings where multiple classesare targeted. I-BAU's performance is comparable to and most often significantlybetter than the best baseline. Particularly, its performance is more robust tothe variation on triggers, attack settings, poison ratio, and clean data size.Moreover, I-BAU requires less computation to take effect; particularly, it ismore than $13\times$ faster than the most efficient baseline in thesingle-target attack setting. Furthermore, it can remain effective in theextreme case where the defender can only access 100 clean samples -- a settingwhere all the baselines fail to produce acceptable results.

Adversarial Unlearning of Backdoors via Implicit Hypergradient