Backdoor attacks are a serious threat to the security and reliability of machine learning models. In this talk, I will present two novel methods for defending against backdoor attacks using a small clean dataset. The first method, Shared Adversarial Unlearning (SAU), leverages the connection between backdoor risk and adversarial risk, and aims to mitigate the backdoor effect by unlearning the shared adversarial examples between the backdoored model and the purified model. The second method, Neural Polarizer, is inspired by the mechanism of the optical polarizer, and aims to purify the poisoned samples by filtering out the trigger information while preserving the benign information. Both methods are formulated as bi-level optimization problems, which can be solved efficiently using adversarial training techniques. I will demonstrate the effectiveness and efficiency of our methods on various benchmark datasets and network architectures, and show that they outperform existing fine-tuning-based defense methods, especially in the case of very limited clean data. I will also discuss some open challenges and future directions for backdoor defense research.
