FixGuard: Repairing Backdoored Models via Class-Wise Trigger Recovery and Unlearning

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where adversaries manipulate the training data to implant hidden backdoors, causing misclassifications when inputs are modified with adversary-specified triggers. To ensure the reliability of DNNs, it is crucial to repair backdoored models, ensuring all samples, including poisoned ones, are correctly predicted. Existing backdoor repair methods rely on recovering a universal trigger, which degrades the model performance on clean data and fails against sophisticated attacks. In this paper, we propose FixGuard, a novel backdoor repair method based on a min-min optimization formulation. FixGuard consists of two main stages: the trigger recovery stage and the backdoor unlearning stage. In the trigger recovery stage, FixGuard recovers a semantic-aware trigger for each class. Compared to using a universal trigger, class-wise triggers can identify malicious patterns more precisely while avoiding excessively large triggers that degrade model performance on clean data. In the backdoor unlearning stage, FixGuard generates synthesized poisoned samples by patching clean images with the recovered triggers while preserving their correct labels. Subsequently, it trains backdoored models on these synthesized samples to sever the malicious connection between triggers and target labels. Experimental results demonstrate that FixGuard effectively mitigates backdoor threats while preserving model performance.