yizeng623 / i-bau

Official Implementation of ICLR 2022 paper, ``Adversarial Unlearning of Backdoors via Implicit Hypergradient''

I-BAU: Adversarial-Unlearning-of-Backdoors-via-Implicit-Hypergradient

Official Implementation of ICLR 2022 paper, Adversarial Unlearning of Backdoors via Implicit Hypergradient [openreview][video] .

We propose a novel minimax formulation for removing backdoors from a given poisoned model based on a small set of clean data:

To solve the minimax problem, we propose the Implicit Backdoor Adversarial Unlearning (I-BAU) algorithm, which utilizes the implicit hypergradient to account for the interdependence between inner and outer optimization. I-BAU requires less computation to take effect; particularly, it is more than 13 X faster than the most efficient baseline in the single-target attack setting. It can still remain effective in the extreme case where the defender can only access 100 clean samples — a setting where all the baselines fail to produce acceptable results .

Requirements

This code has been tested with Python 3.6, PyTorch 1.8.1 and cuda 10.1.

Usage & HOW-TO

• Install required packages.
• Get poisoned models prepared in the directory ./checkpoint/.
  
• We provide two examples on poisoned models trained on GTSRB and CIFAR10 datasets, check clean_solution_batch_op..._cifar.ipynb and clean_solution_batch_op..._gtsrb.ipynb for more details.
• For a more flexible usage, run python defense.py. An example is as follow:

python defense.py --dataset cifar10 --poi_path './checkpoint/badnets_8_02_ckpt.pth'  --optim Adam --lr 0.001 --n_rounds 3 --K 5

Clean data used for backdoor unlearning can be specified with argument --unl_set; if it is not specified, then a subset of data from testset will be used for unlearning.

• For more information regarding training options, please check the help message:
  python defense.py --help.
  

Poster

Citation

If you find our work useful please cite:

@inproceedings{zeng2021adversarial,
  title={Adversarial Unlearning of Backdoors via Implicit Hypergradient},
  author={Zeng, Yi and Chen, Si and Park, Won and Mao, Zhuoqing and Jin, Ming and Jia, Ruoxi},
  booktitle={International Conference on Learning Representations},
  year={2021}
}

Special thanks to...

i-bau's Issues

How to run the code?

Dear authors,

Thanks for releasing the codes! Could you please provide instructions on how to run the codes to reproduce the results? For example, what is the command to defense the BadNet attack on CIFAR10?

Thanks in advance.

Differentiated Tensors not Used in Graph

Hi,
I've used a modified version of your code. The modification is supposed to be just some refactors (assuming I've made no mistakes).
I ran it on MNIST and a simple network, and it worked. But when I tried to use it on Cifar10 with Resnet18_comp I got the following error (line 61 of hypergrad.py):

One of the differentiated Tensors appears to not have been used in the graph. Set allow_unused=True if this is the desired behavior.

Do you know what the reason might be?

missing the implementation on ResNet study

Hi, zeng @YiZeng623 .

Thanks for the great work and the open-sourced implementation from your team. It is very nice that you guys offered the jupyter interactive way for running the code. User friendly and easy to get the results.

But there is still one thing puzzled me. This repo does not have the ResNet implementation. I noticed the almost all of the main experiments were conducted on VGG architecture but both the appendix from your paper and the rebuttal from the openreview did mention the experiments on ResNet models. Do you have the plan to opensource the ResNet experiment code?

Really appreciate to hear from you.

Best,
Terry