Delta-Influence: Unlearning Poisons via Influence Functions

TL;DR

Delta-Influence introduces a novel influence function-based method that accurately identifies and unlearns poisoned training data, improving data integrity in machine learning models after poisoning attacks.

Contribution

The paper proposes Delta-Influence, a new influence function technique that effectively traces and unlearns poisoned data using minimal test examples and data transformations.

Findings

Outperforms existing detection algorithms in unlearning poisoned data

Effectively identifies poisoned training data across multiple datasets and attacks

Achieves consistent unlearning success in various experimental settings

Abstract

Addressing data integrity challenges, such as unlearning the effects of data poisoning after model training, is necessary for the reliable deployment of machine learning models. State-of-the-art influence functions, such as EK-FAC and TRAK, often fail to accurately attribute abnormal model behavior to the specific poisoned training data responsible for the data poisoning attack. In addition, traditional unlearning algorithms often struggle to effectively remove the influence of poisoned samples, particularly when only a few affected examples can be identified. To address these challenge, we introduce $\Delta$-Influence, a novel approach that leverages influence functions to trace abnormal model behavior back to the responsible poisoned training data using as little as just one poisoned test example. $\Delta$-Influence applies data transformations that sever the link between poisoned training data and compromised test points without significantly affecting clean data. This allows $\Delta$-Influence to detect large negative shifts in influence scores following data transformations, a phenomenon we term as influence collapse, thereby accurately identifying poisoned training data. Unlearning this subset, e.g. through retraining, effectively eliminates the data poisoning. We validate our method across three vision-based poisoning attacks and three datasets, benchmarking against five detection algorithms and five unlearning strategies. We show that $\Delta$-Influence consistently achieves the best unlearning across all settings, showing the promise of influence functions for corrective unlearning. Our code is publicly available at: https://github.com/Ruby-a07/delta-influence