Adversarial Unlearning of Backdoors via Implicit Hypergradient
Authors: Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, Ruoxi Jia
ICLR 2022 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | In our evaluation, we compare I-BAU with six state-of-art backdoor defenses on eleven backdoor attacks over two datasets and various attack settings... We conduct a thorough empirical evaluation of I-BAU by comparing it with six state-of-art backdoor defenses on seven backdoor attacks over two datasets and various attack settings... |
| Researcher Affiliation | Academia | 1Virginia Tech, Blacksburg, VA 24061, USA 2University of Michigan, Ann Arbor, MI 48109, USA |
| Pseudocode | Yes | Algorithm 1: Implicit Backdoor Adversarial Unlearning (I-BAU) |
| Open Source Code | Yes | Correspondence to yizeng@vt.edu. Codes of implementations is opensourced on Github: I-BAU |
| Open Datasets | Yes | Table 1 presents the defense results on the CIFAR-10 dataset. CIFAR-10 contains 60,000 samples. We use 50,000 samples as training data... Table 2 shows the evaluation on the GTSRB dataset, which contains 39,209 training data and 12,630 test data of 43 different classes. |
| Dataset Splits | Yes | CIFAR-10 contains 60,000 samples. We use 50,000 samples as training data, among which 10,000 samples are poisoned. We used 5,000 separate samples as the clean set accessible to the defender for conducting each defense (e.g., via unlearning, finetuning, trigger synthesis) except DP. |
| Hardware Specification | Yes | Our experiment adopted ten NVIDIA TITAN Xp GPUs as the computing units with four servers equipped with AMD Ryzen Threadripper 1920X 12-Core Processors. |
| Software Dependencies | No | Py Torch (Paszke et al., 2019) is adopted as the deep learning framework for implementations. |
| Experiment Setup | Yes | We use Adam with a learning rate of 0.05 as the optimizer for poisoned models. The models are trained with 50 epochs over each poisoned dataset to converge and attain the results shown in the main text. ... For the settings of implementing the I-BAU, the inner and outer is conducted with iterative optimizers (SGD or Adam) with a learning rate of 0.1. |