Efficient Repair of Polluted Machine Learning Systems via Causal Unlearning

By Yinzhi Cao, A. Yu, Andrew Aday, Eric Stahl, Jon Merwine, Junfeng Yang. 2018

55 citations recorded by the source corpus.

Machine learning systems, though being successful in many real-world applications, are known to remain prone to errors and attacks. A major attack, called data pollution, injects maliciously crafted training data samples into the training set, causing the system to learn an incorrect model and subsequently misclassify testing samples. A natural solution to a data pollution attack is to remove the polluted data from the training set and relearn a clean model. Unfortunately, the training set of a real-world machine learning system can contain millions of samples; it is thus hopeless for an administrator to manually inspect all of them to weed out the polluted ones. This paper presents an approach called causal unlearning and a corresponding system called KARMA to efficiently repair a polluted learning system. KARMA dramatically reduces the manual effort of administrators by automatically detecting the set of polluted training data samples with high precision and recall. Evaluation on three learning systems show that KARMA greatly reduces manual effort for repair, and has high precision and recall.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Ben Y. Zhao
2. Haitao Zheng
3. Yuanshun Yao
4. Bimal Viswanath
5. Shiqing Ma
6. Bolun Wang
7. Ran Duan
8. X. Zhang

Citations in the corpus

• Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, background): “Defenses against poisoning attack mostly focus on sanitizing the training set and removing poisoned samples [32], [33], [34], [35], [36], [37].”
• A Survey of Machine Unlearning (2022, unknown): “For example, a data pollution attack might affect millions of data items, but only a few of them can be detected by human experts or SOTA detection methods [14].”
• ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation (2019, background): “Many defense techniques have been proposed to defend against training data poisoning [16, 27, 44, 48].”
• Latent Backdoor Attacks on Deep Neural Networks (2019, background): “Defenses against poisoning attacks mostly focus on sanitizing training data and removing poisoned samples [6, 15, 21, 36, 44, 47].”
• Unveiling Security, Privacy, and Ethical Concerns of ChatGPT (2023, background): “On one hand, AI has been harnessed to protect people’s privacy through techniques like federated learning [23], [24] and machine unlearning methods [25], [26].”