Double-Blind Cleanser: Blindly Unlearning Backdoors Without Clean Data

Backdoor attacks pose a serious and emerging threat to deep neural networks. By injecting trigger-labeled samples into the training data, these attacks cause compromised models to misclassify any input containing the trigger. Existing defenses typically rely on either recovering the trigger to remove the corresponding backdoor or performing additional fine-tuning to erase the backdoor functionality while retaining the legitimate functionality. Both strategies require access to a trusted clean dataset, an assumption that is often unrealistic in practice. We introduce Double-Blind Cleanser (DBC), a backdoor unlearning framework that eliminates the need for trigger recovery or poisoned sample identification. DBC operates in two phases. It first leverages catastrophic forgetting to eliminate the backdoor behavior. It then applies Sharpness-Aware Minimization (SAM) to flatten the loss landscape, improving generalization and restoring legitimate functionality without requiring prior knowledge of triggers or poisoned samples. To further enhance the flatness of the loss landscape, DBC employs an importance sampling strategy that prioritizes samples most sensitive to weight perturbations, effectively reducing the impact of poisoned instances. Extensive evaluations demonstrate that DBC neutralizes diverse backdoor attacks while maintaining model utility. Its superior performance achieved first place in the mitigation round of the TrojAI competition, a multi-year, multi-round benchmark for backdoor defense.