  Adversarial attacks by malicious actors on machine learning systems, such as
introducing poison triggers into training datasets, pose significant risks. The
challenge in resolving such an attack arises in practice when only a subset of
the poisoned data can be identified. This necessitates the development of
methods to remove, i.e. unlearn, poison triggers from already trained models
with only a subset of the poison data available. The requirements for this task
significantly deviate from privacy-focused unlearning where all of the data to
be forgotten by the model is known. Previous work has shown that the
undiscovered poisoned samples lead to a failure of established unlearning
methods, with only one method, Selective Synaptic Dampening (SSD), showing
limited success. Even full retraining, after the removal of the identified
poison, cannot address this challenge as the undiscovered poison samples lead
to a reintroduction of the poison trigger in the model. Our work addresses two
key challenges to advance the state of the art in poison unlearning. First, we
introduce a novel outlier-resistant method, based on SSD, that significantly
improves model protection and unlearning performance. Second, we introduce
Poison Trigger Neutralisation (PTN) search, a fast, parallelisable,
hyperparameter search that utilises the characteristic "unlearning versus model
protection" trade-off to find suitable hyperparameters in settings where the
forget set size is unknown and the retain set is contaminated. We benchmark our
contributions using ResNet-9 on CIFAR10 and WideResNet-28x10 on CIFAR100.
Experimental results show that our method heals 93.72% of poison compared to
SSD with 83.41% and full retraining with 40.68%. We achieve this while also
lowering the average model accuracy drop caused by unlearning from 5.68% (SSD)
to 1.41% (ours).
