标题： BURN：通过对抗边界分析的后门遗忘 显示英文标题

标题： BURN: Backdoor Unlearning via Adversarial Boundary Analysis

摘要： 后门遗忘旨在移除后门相关信息，同时保留模型的原始功能。 然而，现有的遗忘方法主要关注于恢复触发模式，但未能恢复中毒样本的正确语义标签。 这一限制使它们无法完全消除触发模式与目标标签之间的错误关联。 为了解决这个问题，我们利用边界对抗攻击技术，揭示了两个关键观察结果。 首先，中毒样本与决策边界之间的距离明显大于干净样本，表明它们需要更大的对抗扰动才能改变预测结果。 其次，干净样本的对抗预测标签是均匀分布的，而中毒样本的对抗预测标签则倾向于恢复到其原始正确标签。 此外，在添加对抗扰动后，中毒样本的特征会恢复为与相应干净样本非常相似的特征。 基于这些见解，我们提出了通过对抗边界分析进行后门遗忘（BURN），这是一种新颖的防御框架，集成了错误关联解耦、渐进数据精炼和模型净化。 在第一阶段，BURN利用对抗边界分析，根据其异常的对抗边界距离检测中毒样本，然后恢复其正确的语义标签以进行微调。 在第二阶段，它采用一种反馈机制，跟踪原始带有后门的模型与逐步清理的模型之间的预测差异，从而指导数据集的精炼和模型的净化。 在多个数据集、架构和七种不同的后门攻击类型上的广泛评估证实，BURN能够有效消除后门威胁，同时保持模型的原始性能。 显示英文摘要

摘要： Backdoor unlearning aims to remove backdoor-related information while preserving the model's original functionality. However, existing unlearning methods mainly focus on recovering trigger patterns but fail to restore the correct semantic labels of poison samples. This limitation prevents them from fully eliminating the false correlation between the trigger pattern and the target label. To address this, we leverage boundary adversarial attack techniques, revealing two key observations. First, poison samples exhibit significantly greater distances from decision boundaries compared to clean samples, indicating they require larger adversarial perturbations to change their predictions. Second, while adversarial predicted labels for clean samples are uniformly distributed, those for poison samples tend to revert to their original correct labels. Moreover, the features of poison samples restore to closely resemble those of corresponding clean samples after adding adversarial perturbations. Building upon these insights, we propose Backdoor Unlearning via adversaRial bouNdary analysis (BURN), a novel defense framework that integrates false correlation decoupling, progressive data refinement, and model purification. In the first phase, BURN employs adversarial boundary analysis to detect poisoned samples based on their abnormal adversarial boundary distances, then restores their correct semantic labels for fine-tuning. In the second phase, it employs a feedback mechanism that tracks prediction discrepancies between the original backdoored model and progressively sanitized models, guiding both dataset refinement and model purification. Extensive evaluations across multiple datasets, architectures, and seven diverse backdoor attack types confirm that BURN effectively removes backdoor threats while maintaining the model's original performance.