Backdoor Unlearning by Linear Task Decomposition

TL;DR

This work tackles backdoor vulnerabilities in foundation models by showing that backdoor behavior can be disentangled from clean knowledge in weight space. It introduces TBAR, a lightweight unlearning method that estimates a trigger direction from a small forget set and subtracts it to recover clean performance, achieving near-perfect unlearning and high clean accuracy on CLIP-based tasks. The method extends to agnostic attacks by leveraging reverse-engineered triggers, and demonstrates strong results across large-scale image-caption datasets and across architectures, often outperforming existing defenses while using far less data. Collectively, these findings highlight a practical, data-efficient path to safe deployment of vision-language models through targeted weight-space manipulations.

Abstract

Foundation models have revolutionized computer vision by enabling broad generalization across diverse tasks. Yet, they remain highly susceptible to adversarial perturbations and targeted backdoor attacks. Mitigating such vulnerabilities remains an open challenge, especially given that the large-scale nature of the models prohibits retraining to ensure safety. Existing backdoor removal approaches rely on costly fine-tuning to override the harmful behavior, and can often degrade performance on other unrelated tasks. This raises the question of whether backdoors can be removed without compromising the general capabilities of the models. In this work, we address this question and study how backdoors are encoded in the model weight space, finding that they are disentangled from other benign tasks. Specifically, this separation enables the isolation and erasure of the backdoor's influence on the model with minimal impact on clean performance. Building on this insight, we introduce a simple unlearning method that leverages such disentanglement. Through extensive experiments with CLIP-based models and common adversarial triggers, we show that, given the knowledge of the attack, our method achieves approximately perfect unlearning, while retaining, on average, 96% of clean accuracy. Additionally, we demonstrate that even when the attack and its presence are unknown, our method successfully unlearns backdoors by proper estimation using reverse-engineered triggers. Overall, our method consistently yields better unlearning and clean accuracy tradeoffs when compared to present state-of-the-art defenses.

Figures (12)

• Figure 1: Backdoored models embed malicious behavior along with clean task performance. Instead of erasing all learned information, we propose a targeted approach: (1) Given a backdoored model, (2) the backdoor encodes two distinct directions, (3) fine-tuning the model on similarly constructed triggered data isolates the parameter shift associated with triggered information. (4) Negating this vector from the original parameters effectively removes the trigger while preserving clean task performance.
• Figure 2: Weight disentanglement between clean and triggered tasks. We estimate the triggered direction $\boldsymbol{\hat{\tau}}_t$ from the backdoored model and define the clean direction $\boldsymbol{\hat{\tau}}_c$ as the residual after negation. The plots show the disentanglement error $\xi(\alpha_c, \alpha_t)$ between these task vectors, following ortiz2024task. Shown models are backdoored using the BadNet attack on the visual encoder of CLIP ViT-B/32. Similar plots for the other attacks are provided in Appendix \ref{['appendix_analysis']}.
• Figure 3: True unlearning performance of TBAR and Gradient Ascent. Plots showing a comparison of (CA $\uparrow$) versus $(1-{\rm ASR}\,\uparrow)$ over a progressive number of epochs. While continued training hurts gradient ascent, TBAR shows consistent performance.
• Figure 4: Unlearning with DECREEfeng2023detecting using TBAR and Gradient Ascent. Plots showing the underlying true attack comparison of (CA $\uparrow$) versus $(1-{\rm ASR}\,\uparrow)$ over progressive epochs.
• Figure 5: Results of unlearning BadNet attack with TBAR using varied sizes of the forget set