New Method Achieves Complete Backdoor Unlearning in AI Models

A new research paper introduces a novel approach to address the persistent challenge of backdoor attacks in AI models, which often evade existing defenses and safety tuning strategies. The authors reframe backdoor learning and subsequent unlearning as a three-stage sequential process, drawing parallels with catastrophic forgetting phenomena observed in continual learning. This perspective allows for a formal definition of complete backdoor unlearning and the derivation of necessary conditions for its achievement. Guided by these theoretical insights, the researchers developed Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU). This method formulates the generation of adversarial examples, crucial for satisfying unlearning conditions, as a blind inversion problem. It integrates a bi-level optimization process, typical of adversarial training, within an Expectation-Maximization (EM) algorithm framework to optimize a maximum a posteriori objective. BI-BAU has been shown to be effective and thorough in eliminating backdoor effects from compromised models. Its applicability extends to untargeted adversarial scenarios where target classes are unknown, and even to multi-modal contrastive learning tasks, making it highly relevant for real-world deployment where pre-trained models may be vulnerable.