Dowon Kim, Junhao Cai, Sung Il Choi, Dohun Kim, Juhyun Park, Chengjun Jin, Changhee Joo
原文摘要
Detecting backdoor attacks in federated learning (FL) is challenging because malicious clients can manipulate the global model while preserving main-task performance. Static model-update statistics may therefore fail to clearly distinguish malicious from benign clients. Unlearning-based detectors instead probe client models through loss ascent on clean server data, but detection performance degrades with scarce proxy data. We propose Screening via Unlearning Response Analysis (SURA), a data-efficient detector. SURA reuses the same small clean proxy across multiple train-mode loss-ascent steps, strengthening client responses without additional clean data. For federated vision models with batch normalization (BN), repeated probing also changes BN running statistics and can confound endpoint measurements. SURA addresses this by restoring the shared pre-probe BN state only at readout while preserving the parameter changes induced by probing. This separates repeated probing from response measurement and removes BN drift and the interaction between parameter and BN-state changes from the readout. Across six backdoor attacks, SURA uses only 10 clean server images, outperforms methods under the same data budget, and approaches the robustness obtained with much larger proxy sets.
Machine unlearning in large language models (LLMs) aims to remove specific learned knowledge, capabilities, or behaviors while preserving model utility. Existing methods have mostly focused on the design of unlearning objectives, while largely overlooking the intrinsic matrix structure of transformer weights. In particular, standard optimizers operate on independent scalar coordinates, thereby ignoring this matrix structure. We propose spectral unlearning, an update framework that combines standard unlearning objectives with matrix-structured optimization. We show that the spectral update corresponds to the steepest-descent direction for transformers composed of linear layers with normalized inputs and outputs. Our approach is applied on top of existing unlearning methods and evaluated across complementary axes of memorization, privacy, and utility, summarized via their harmonic mean. Spectral unlearning consistently outperforms a broad range of baselines and closes most of the gap to a retain-trained reference. Code is available at https://github.com/unlearn-ml/spectral-unlearning/.