{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/potion-towards-poison-unlearning","title":"Potion: Towards Poison Unlearning","arxiv_id":"2406.09173","date":"2024-06-13","proceeding":null,"authors":["Stefan Schoepf","Jack Foster","Alexandra Brintrup"],"abstract":"Adversarial attacks by malicious actors on machine learning systems, such as introducing poison triggers into training datasets, pose significant risks. The challenge in resolving such an attack arises in practice when only a subset of the poisoned data can be identified. This necessitates the development of methods to remove, i.e. unlearn, poison triggers from already trained models with only a subset of the poison data available. The requirements for this task significantly deviate from privacy-focused unlearning where all of the data to be forgotten by the model is known. Previous work has shown that the undiscovered poisoned samples lead to a failure of established unlearning methods, with only one method, Selective Synaptic Dampening (SSD), showing limited success. Even full retraining, after the removal of the identified poison, cannot address this challenge as the undiscovered poison samples lead to a reintroduction of the poison trigger in the model. Our work addresses two key challenges to advance the state of the art in poison unlearning. First, we introduce a novel outlier-resistant method, based on SSD, that significantly improves model protection and unlearning performance. Second, we introduce Poison Trigger Neutralisation (PTN) search, a fast, parallelisable, hyperparameter search that utilises the characteristic \"unlearning versus model protection\" trade-off to find suitable hyperparameters in settings where the forget set size is unknown and the retain set is contaminated. We benchmark our contributions using ResNet-9 on CIFAR10 and WideResNet-28x10 on CIFAR100. Experimental results show that our method heals 93.72% of poison compared to SSD with 83.41% and full retraining with 40.68%. We achieve this while also lowering the average model accuracy drop caused by unlearning from 5.68% (SSD) to 1.41% (ours).","url_abs":"https://arxiv.org/abs/2406.09173v3","url_pdf":"https://arxiv.org/pdf/2406.09173v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"potion-towards-poison-unlearning","repo_url":"https://github.com/if-loops/towards_poison_unlearning","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"GPL-3.0"}}],"tasks":[{"task_slug":"machine-unlearning","task_name":"Machine Unlearning"}],"methods":[{"method_slug":"set","method_name":"SET"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2406.09173","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.09173"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/if-loops/towards_poison_unlearning","reach":{"status":"ok","spdx":"GPL-3.0"}}],"summary":{"ran":7,"unverified":3},"by_repo_kind":{"official":{"samples":10,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":10,"samples":[{"code_sha256_prefix":"1808b5d76587f897","entry":"compute_accuracy","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"visualize.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/visualize.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"1808b5d76587f897"}},{"code_sha256_prefix":"4844d5c6ef2edff8","entry":"conv_bn","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/resnet.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/resnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"4844d5c6ef2edff8"}},{"code_sha256_prefix":"f83c8e9c6bd4eaf8","entry":"convert_boolean_to_int","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"f83c8e9c6bd4eaf8"}},{"code_sha256_prefix":"e01e044ea7191062","entry":"get_custom_dataset","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"e01e044ea7191062"}},{"code_sha256_prefix":"bf20b453f51520be","entry":"get_labels","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/datasets.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/datasets.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"bf20b453f51520be"}},{"code_sha256_prefix":"f69494457c839f5f","entry":"parse_pretrain_dirname","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"visualize.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/visualize.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"f69494457c839f5f"}},{"code_sha256_prefix":"14698f649f4374cd","entry":"parse_unlearn_dirname","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"visualize.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/visualize.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"14698f649f4374cd"}},{"code_sha256_prefix":"6e7f7f4554385493","entry":"define_model","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"6e7f7f4554385493"}},{"code_sha256_prefix":"d17fd04d5d7ea7a0","entry":"get_features","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/analyze_feats.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/analyze_feats.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"d17fd04d5d7ea7a0"}},{"code_sha256_prefix":"74929642bc9b52f8","entry":"load_dataset","repo":"if-loops/towards_poison_unlearning","repo_kind":"official","path":"src/datasets.py","file_url":"https://github.com/if-loops/towards_poison_unlearning/blob/HEAD/src/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"GPL-3.0","inline_ok":false,"mcp_get_code":{"code_sha256":"74929642bc9b52f8"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}