Effective Backdoor Mitigation in Vision-Language Models Depends on the Pre-training Objective
Authors: Sahil Verma
Gantavya Bhatt
Avi Schwarzschild
Soumye Singhal
Arnav Mohanty Das
Chirag Shah
John P Dickerson
Pin-Yu Chen
Jeff Bilmes
Venue: Accepted by TMLR ()

Abstract: Despite the advanced capabilities of contemporary machine learning (ML) models, they remain vulnerable to adversarial and backdoor attacks. This vulnerability is particularly concerning in real-world deployments, where compromised models may exhibit unpredictable behavior in critical scenarios. Such risks are heightened by the prevalent practice of collecting massive, internet-sourced datasets for training multimodal models, as these datasets may harbor backdoors. Various techniques have been proposed to mitigate the effects of backdooring in multimodal models, such as CleanCLIP, which is the current state-of-the-art approach. In this work, we demonstrate that the efficacy of CleanCLIP in mitigating backdoors is highly dependent on the particular objective used during model pre-training. We observe that stronger pre-training objectives that lead to higher zero-shot classification performance correlate with harder to remove backdoors behaviors. We show this by training multimodal models on two large datasets consisting of 3 million (CC3M) and 6 million (CC6M) datapoints, under various pre-training objectives, followed by poison removal using CleanCLIP. We find that CleanCLIP, even with extensive hyperparameter tuning, is ineffective in poison removal when stronger pre-training objectives are used. Our findings underscore critical considerations for ML practitioners who train models using large-scale web-curated data and are concerned about potential backdoor threats.

Published in Transactions on Machine Learning Research (12/2024)
Effective Backdoor Mitigation in Vision-Language Models Depends on the Pre-training Objective
Sahil Verma
waahil@ic...ushinggoo. edu
University of Washington
Gantavya Bhatt University of Washington
Avi Schwarzschild Cornegie Mellon University
aviskk&ggaill.co
Soumye Singhal
singhassounge@@mall.oo
Neídia
Arnav Das University of Washington
arnaumd2@uer edu
Chirag Shah
chirags@rw.. edu
University of Washington
John P Dickerson University of Morylond
johnd@uudd.c edu
Pin-Yo Yu Chen IBM Research
pinguchen.tw@@ngg com
Jeff Bilmes University of Washington
bilmes@uu.cc edu
Reviewed on OpenReview: /ttp:////oeeeeeeeeee/////o/odotd Conommmaaaa
Abstract
Despite the advanced capabilities contemporary machine learning (ML) models, they remain vulnerable to adversarial and backdoor attacks. This vulnerability particularly concerning in real-world deployments, where compromised models may exhibit unpredictable behavior in critical scenarios. Such risks are heightened by the prevalent practice of collecting massive, internet-sourced datasets for training multimodal models, as these datasets may harbor backdoors. Various techniques have been proposed to mitigate the effects of backdooring in multimodal models, such as CleanCLIP, which is the current state-of-the-art approach. In this work, we demonstrate that the efficacy CleanCLIP in mitigating backdoors is highly dependent on the particular objective used during model pre-training. We observe that adding self-supervised objective to pre-training, that leads higher zero-shot classification performance, correlate with harder to remove backdoors behaviors. We show this by training multimodal models on two large datasets consisting of 3 million (CC3M) and million (CC6M) datapoints, under various pro-training objectives, followed by poison removal using CLeanCLIP. We find that CleanCLIP, even with exlensive hyperparameter luning, is ineffective in poison removal when stronger pre-training objectives are used. Our findings underscore critical considerations for MI practitioners who train models using largo-scale web-curated data and are concerned about potential backdoor threats. Our code is open-sourced at https:/ hww.a//ooo//aailaaaaaeeeeeeeeeee

---

Published in Transactions on Machine Learning Research (12/2024)
1 Introduction
Machine Learning (MI. has taken strides training high-performing models for a wide range of tasks from classification to generation. An important goal for ML is to learn general-purpose representations that help align data from different modalities. Approaches like CLIP (Radford et al,, 2019), ALIGN (Jia et al., 2021b), and BLIP (Li et al., 2022) learn joint representations from large scale image-text paired datasets. These innovative techniques have ushered in the possibility of learning from unlabeled and uncurated datasets, substantially increasing the scale and applicability of pre-training. The scaling has contributed to high zero-shot classification accuracy on various downstream datasets like Imagenet (Deng et al., 2009) and increased robustness to variations in the datascts like Imagenct- V2 (Recht et al., 2019), Imagenet-R (Hendrycks et al., 2020), and Imagenel-A (Hendrycks et al., 2021). However, these stralegies, reliant on internet-sourced data curation (Gadre et al., 2023), have also raised concerns regarding the vulnerability of models to an adversary, particularly through backdoor attacks (Carlini et al., 2023).
In the simplest form of this attack, an adversary inserts a patch (termed as a trigger patch or poison) in a small subset of the training data images and alters the ground truth label or caption to a target label or trained on the poisoned training data, the model learns to associate the caption (Gu et al., 2017). trigger patch with the target label/caption. If deployed, an adversary can get the model to predict the target label for any datapoint by inserting the trigger patch. The success of an adversary is measured by the attack success rate (ASR) metric, which is the percentage of the images with the trigger patch that are predicted with the target label. Previous works (Carlini & Terzis, 2021) have demonstrated effective backdooring of multimodal models (ASR 2 80%) just by poisoning mere 75 out of 3 million training datapoints.
Several backdoor mitigation techniques have been proposed for multimodal models (Bansal et al., 2023; Li el al., 2021b; Yang et al., 2023; 2024) to lackle this vulnerability. These approaches either allempt to detect and filter the poisoned datapoints during the pre-training (Li et al., 2021b; Yang et al., 2023; 2024) or finetune the given backdoored model using a specialized loss function on smaller, guaranteed to be clean imago-text. paired dataset. The latter approach helps the model to forget the association between the trigger patch and the target label while still maintaining the learned associations for benign datapoinis, e.g., CleanCT.IP (Bansal et al., 2023). CleanCLIP proposes to finetune a backdoored model using a combination of contrastive loss and self-supervised loss on a small dataset, free of backdoors, to clean the model. It is the state-of-tho-ar (SOTA) technique to clean a backdoored model and obtain a low ASR (S 5%) without hurting its zero-shot classification accuracy; thereby achieving a successful model cleaning.
So far, it has been demonstrated that CleanCLIP can successfully clean models pre-trained only with multmmodal constrastive loss (MMCL) as the objective (Radford et al., 2019). Several recent works (Mu et al, 2022; Li et al., 2021a; Yao et al., 2021; Lee et al., 2022) have proposed stronger pre-training objectives that lead to better zero-shot image classification accuracy. Specifically, adding self-superviser loss (SSL) in both modalities has been the key player in all these works. Therefore, in this work, we pre-train multimodal models using a combination of MMCL and SSL on a poisoned training dataset. Consistent with the previous findings, models pro- trained using combination of MMCL and SSL produced models with a higher classification accuracy than models trained solely with the MMCL objective. We then apply the finetuning procedure in CleanCLIP to remove the poison from these models (see Figure 1). To our surprise, we observe that CIcanCLIP fails to successfully (i.c., without a significant loss in the model's zero-shot accuracy) remove poison from the models pre-trained with the stronger objective (combination of MMCL and SSL).
We further conduct experiments with other practical considerations, such as the performance of CleanCLIP when its cleaning data still has a few poisoned datapoints, and deciding the stopping criterion for the finetuning process when one is not aware of the specific backdoor attack on the model (which usually the case). From all the experiments, poison removal in both the cases of availability of completely clean finetuning data and when the finetuning data still has some poisoned datapoints.
find that only the models pre-trained with MMCL alone are amenable to
Our main contributions are:
We refer the readers to Goldhlum et (2021) for discussion about other kinds of poisoning attacks.
2

---

Published in Transactions on Machine Learning Research (12/2024)
Step Data Poisoning
Step 2: Poison Induction
Step 3: Poison Removal
MMCL
CleanCLIP
MMCL SSL
Initialized Randomly or from Pre- trained Checkpoint
Backdoored Models
Potentially Cleaned Models
Figure 1: Our experimental setup test the claim about the dependence of the ability of CleanCLIP to remove poison from a backdoored model on the model's pre-training objective.
1. We show that the state-of-the-ate technique for removing poison from backdoored multimodal models, CleanCLIP, depends on the model's pro-training objective and fails mitigate poison when the models are pre-trained with stronger objective, like the combination of MMCL and SSL losses. (See Section 2 for further justification on why chose to study CleanCLIP.)
2. We conduct several analysis experiments to demonstrate the effect of different pre-training objectives on the strength of poison induction.
3. We conduct experiments to show the practical use case of CleanCLIP from real-world perspective when the finetuning data is not entirely free of poison and the practitioner is not aware of the specific kind of poisoning in the model and hence has to decide on the stopping critcrion for the cleaning process.
4. Based on these findings, we highlight critical considerations for ML practitioner who wants to pre-train models by collecting web-curated data with potential backdoored embedded datapoints.
2 Related Works
Contrastive Learning Contrastive learning was formally established in seminal works by Bromley et al. (1993); Chopra et al. (2005); Hadsell et al. (2006) that has evolved, giving rise to contemporary algorithms such as CPC (Oord et al., 2018), DCL (Ych ot al., 2022), SimCLR (Chen et al., 2020), and NNCLR (Dwibedi et al., 2021). These approaches, at their core, share a common objective: bringing similar elements closer in representation space while pushing dissimilar ones apart.
Radford et al. (2021) extended this idea beyond single modality to provide dual-encoder approach for learning shared representation space between image and text, called CLIP. Images and their corresponding captions are brought close, while the dissimilar images and captions are pushed away. Jia et al. (2021a) further extended this paradigm to handle noisy billion-scale datasets, demonstrating exceptional zero-shot accuracy across benchmarks like Imagenet-1K (Deng et al., 2009), MS-COCO retrieval, and robustness against variations Imagenet- Ceiennet-//RRAA /2/R/ "2/R/A/C. Since then, there have been several improvements to the zero-shot accuracy by adding components the loss term. CyCLIP (Goel et al., 2022) imposes additional consistency
We refer the readers Balestriero et (2023) for more development on self-supervised learning.
3

---

Published in Transactions on Machine Learning Research (12/2024)
regularization; SLIP (Mu et al., 2022) applies an additional self-supervision loss within image modality and was further unified by UniCLIP (Lee et al., 2022). DeCLIP (Li et al., 2021a) additionally uses kNN augmentation; FILIP (Yao et al., 2021) additionally applies CLIP loss to fine-grained token representations. CLIP performance has also boen improved by additional captioning loss (Yu ct al., 2022).
Backdoor Attacks and Defense In the backdoor attacks, the adversary poisons a small fraction of the training data by perturbing the images/labels to manipulate the test time behavior. A prevalent form of this attack involves adding trigger, such as random pixel patch, into small subset of the training dataset (Souri et al., 2022; Gu et al., 2017; Turner et al., 2019). During inference, models perform normally on images without the triggers but exhibit catastrophic failures when tested with the triggered images, erroneously predicting the labels targeted by the adversary. While the study of backdoor attacks has historically centered on supervised learning, recent attention has extended to self-supervised (Saha et al., 2022) and multimodal representation learning (Bansal al., 2023; Carlini & Terzis, 2021; Carlini et al., 2023). This work focuses exclusively on the poisoning of multimodal models like the CLIP model.
The most common defense strategies against backdoor attacks primarily revolve around the identification and detection of poisoned examples (Steinhardt et al., 2017; Gao et al., 2019; Wang et al., 2019; Yang el al., 2022; Li et al., 2021b; Yang et al., 2024; 2023). However, alternative approaches have emerged, such as defense through knowledge distillation (Yoshida & Fujino, 2020) and robust training procedures involving data augmentation (Borgnia et al., 2021). Despite these efforts, research by Carlini & Terzis (2021); Carlini et al. (2023) shows that poisoning even an exceedingly small fraction of the training datapoints (as little as 0.002%) can substantially impact model performance. Consequently, the effectiveness of detection- based methods in the context of multimodal pre-training remains uncertain. To address this challenge, Bansal et al (2023) proposed CleanCTIP, a finetuning based procedure using combination of MMCT, and SSL losses, designed to clean poisoned CLIP models, assuming access to a small, guaranteed to be poison-free dataset.
Our Work Our objective is to decipher the amenability of CleanCLIP to remove poison from pre-trained models under varying conditions like different pre-training objectives, lack of completely clean data, and lack of knowledge of the specifie backdoor attack. Since intramodal self-supervisio loss has enhanced classífication accuracy for multimodal models, we investigate CIeanCLIP effectiveness when models are pre-trained with combination of MMCL and SSL objectives vs. when just pre-trained with the MMCL objective. We also investigate its effectiveness when the finetuning data has a few poisoned datapoints and examine the stopping criterion for finetuning when the knowledge of the specific backdoor attack is unavailable.
Why we choose to study CleanCLIP? Defense against backdoor attacks in multimodal models an emerging research area with a handful of proposed approaches. Given the ever-increasing usage of off-the-shelf available pretrained models on the platforms such as huggingface, it is important to be able to remove poison from an already trained model. This is also important because of the prohibitive costs of training these large models from scratch, even if a poison-free datasct suddenly becomes available. Among the proposed approaches, CLea (Bansal et al., 2023) is the only one that can remove poison from an already trained model. All the other defense methods (Yang et al., 2024; 2023; Ishmam & Thomas, 2024) propose various train-time interventions that help prevent the model from learning the backdoor. Therefore, none of these techniques are applicable when model has already been trained and is backdoored.
3 Methodology
3.1 Primer on Pre-training and Poisoning
Notations Let I and T denote the space of images and text. = ((,,, (リ,,) Detean = [4,, TD)), denotes the pre-training and cleaning dataset of N and M imagc-text pairs respectively, where M << N. h : I + IRd and hr: T + Rd denote the image and text encoders respectively, where d is the dimensionality of the embedding space. All the embeddings are further normalized to make &g norm to 1 which we denote using fxx = (h(()), where g Rd - B(1) normalization mapping, where, B(1) = {x : ||æ||2 = 1, x E Rd); - denotes learnable temperature. Let LMMCL denote the multinodal and LSsL denote the intramodal self-supervision losses respectively. Let. / denote an augmentation to image I and T denote an augmentation
4

---

Published in Transactions on Machine Learning Research (12/2024)
to the text T. Let S C (1,2....,n) denote small subset of training data that poisoned. We denote the poisoned dataset using P(S, (5,,t,,77 T = ((T) o ig. T?) :j JE where tg. T denote image trigger and target label respectively.
Loss Objectives Given a dataset D, fI, fr, we define LMMCL (D, fr, as follows:
D
((f k=
exp
exp (f
log
log
(1)
2
Σ
exp (T)()
1==1 exp (1p((11()))
1=1
and, we define Lsst. (D, Jr, (T. as follows:
exp ((
exp ((r(()) Sk=l exp (T) / /x1)
log
log
(2)
2D
Σ kil exp (IIIL) /T)
For the shorthand notations, we will drop fr, FT,T from the parenthesis. With the definitions above CCleaUCLi((Pater - ESsI(Detenn)) + LaMMLL (Deleon)- When used for pro-training, we denote them using CPre, and when used for fineluning, we denote them using LtC
(PaMcc(Deteon)
3.2 Experimental Setup
On a high level, our experiments involve poisoning CLIP models using two distinct pre-training objectives with different kinds of backdoors by either training a model from scratch or by finetuning from a pre-trained checkpoint. Once we have poisoned the model, we attempt to remove the poison using CleanCLIP, which finetunes the model with a specific objective using separate dataset. We have illustrated this in Figure and summarized our key findings in Table 1.
Training Details We train a dual-encoder multimodal model on image-text paired datasets. We train models using two kinds of pre-training objectives: a) only multimodal contrastive loss (4MMCL)), and b) combination of multimodal contrastive loss and self-supervised loss in the image and text modalities (CMMcL + Csst) Following CLeanCLIP, we use ResNet-50 as the model's vision encoder and a transformer as the text encoder. We trained the models on two image-texl, paired datasets:
1. Conceptual Captions 3M (CC3M) (Sharma et al., 2018): This dataset has 3M image-text paired datapoints.
2. Conceptual Caption 6M (CC6M): This dataset has 6M image-text text paired datapoints from the CC12M dataset (Changpinyo et al., ), to which size our computing resources scaled.
The models are trained either from scratch or finetuned from a pre-trained CLIP checkpoint (Radford et al., 2019). We train models for 64 epochs using 8 Nvidia A100 GPUs. The initial learning rate of 1e 3 with cosine scheduling is used when trained from scratch and 5e - when finetuned from checkpoint. We use AdamW optimizer with 10,000 warmup steps (Loshchilov & Hutter, 2017). Models trained with C use batch size of 256, whereas models trained with LMCCI + SSI.. use batch size of 128. Please refer to Appendix A for the loss dynamics.
cpre
Poisoning Following CleanCLIP, we introduce the trigger proposed by BadNel (Gu et al., 2017) a small subset of the training datapoints. Specifically, we add trigger patch of size 16 16 sampled from a standard Gaussian al a random location in the image and subsequently change the image's caption to be the adversary chosen label, in this case "banana". Please see Appendix J for examples of images with trigger patch and their corresponding captions. Using the same settings as CleanCI.IP, we introduce the trigger in 1,500 randomly sampled datapoints for the CC3M dataset and 3,000 randomly sampled datapoints for the CC6M dataset (a mere 0.05% of the training datapoints).
We also experiment with another kind of poisoning technique: label consistent poisoning. In this case, the trigger patch (created in the manner as mentioned above) is added to the images that have the adversary chosen label (in this banana") in their captions.
5

---

Published in Transactions on Machine Learning Research (12/2024)
Table 1: Key findings from our experiments: CleanCLIP is much less effective for the model where poison is induced with the stronger objective MMCL. SSL.
Backdoor
Objective
Poison Induction
Change in Accuracy after Cleaning (Relative) f
BadNet
MMCL Lire LMMCL MMOL
From scratch
1% gain
BadNet
Finetuned from Ckpt
17% loss
Label Cousistent
From scratch
10% gain
NadNet
MMLLL + 881
From scratch
43% loss
BadNet
L CorE
MMCL + LPre
Finetuned from Ckpt
33% loss
Label Consistent
MMCL
+ 9881
From scratch
16% loss
Removing poison We attempt to remove poisons from pre-trained models by finetuning them 100K clean image-text paired dataset using LMCLL SSL, and Lit L to be cleaned if the ASR of that model is < 5%.
CMiMEL SSL (ClcanCI.IP). We consider a model
4 Experiments
In this section, expound on the pre-training details for the models, followed by their cleaning procedure and the metrics we use to mcasure the model's performance.
Metrics The models are evaluated for their Top-1 zero-shot accuracy on the Imagenct-1K validation set (referred to as Imagenet hereafter). Each of the 1,000 classes of Imagenet is described using sentences like: 'a photo of a ...,, tattoo of ..., etc. We generate 80 such text templates for each class (see Appendix C) and then pass them to the text encoder to produce average text embedding for the class. During zero-shot classification, the prodiction for an image is the class whose thus computed text embodding has the highest cosine similarity with the image embedding.
We also evaluate the attack success rate (ASR) of a model. In an apparent similarity to accuracy, the ASR of a backdoored model is defined as the percentage of triggered images that the model classifies as the adversary-chosen target label. For measuring ASR, we add the trigger patch al random locations in all Imagenet validation set images and measure the percentage of them that are classified as the target class, i.e., "banana". We measure both these metrics at the end of cach cleaning epoch any model encountered during the cleaning process is good candidate for cleaned model.
Poison Induction by Training from Scratch Table 2 shows the Top-1 zero-shol Imagenet validation set accuracy for the models trained from scratch using Cere CMMc and Cere MMMCL + C on CC3M and CC6M
datasets. For the smaller CC3M dataset, both the models achieve an accuracy of around 16 17%, and for the larger CC6M dataset, the models reach an accuracy of around 24%. Even though the models trained with MMCL SSL allained higher accuracy than the models trained with LMMCL alone, in order to have better visualization of the difference in performance of CleanCLIP on the two pre-truining objectives, we deliberately choose models with similar slarling accuracies. All the models, irrespective of the pre-training objective and the training dataset, reached more than 99% ASR (see Table 3 in Appendix A), implying that poisoning just 0.05% of the datasct is enough to attain very high ASR.
Removing Poison We clean the poisoned model by finetuning it on a 100K, guaranteed be poison-free, image-text pairs for 20 epochs using a batch size of 128 and AdamW the optimizer. We perform extensive hyperparameter search and use various learning rates (as many as 8 in some experiments and 14 in others, all with cosine scheduling and 50 warmup steps) for this process. Please refer to Appendix D for the set of learning rates explored for the cleaning procedure. Ideally, after cleaning we would want to obtain a model that maintains the accuracy of the original poisoned model, while getting rid of its poison, i.e., very low ASR. We use three different loss functions for the cleaning process:
1. ft : : CleanCLIP showed that finetuning with S/i did not change the original model's accuracy and ASR, and hence is ineffective cleaning loss. We reproduce these results for the models we trained.

---

Published in Transactions on Machine Learning Research (12/2024)
This table shows the original Top-1 zero-shot Imagenet validation set accuracies and remaining accuracy after cleaning the models that were poisoned using BadNet by training from scratch. The cleaning is done using CleanCLIP, ie., finetuning a poisoned model with 2 MMcc. + sst. For this table, we choose the models having the highest accuracy and ASR < 5% (successful cleaning). The original ASR values for all models are more than 99%. Takeaway: The models trained with MMCL maintain their original accuracy after cleaning, while the ones trained with MMCL, + ssL experience huge drop relative to the starting accuracy (~20% for model trained CC3M dataset and 45% for model trained on CC6M dataset) after cleaning.
Table 2:
Trained with L
MMCL
Trained with Cere
MMCL + S
Backdoor
Dataset
Clean Data Size
Orig. Acc.
Clean Acc. (ASR < 5%) 1
Orig. Aoc. Clean Acc. (ASR < 5%)
BadNet
CC3M
100K
16.00%
16.49%
17.04%
14.16%
BadNet
CC6M
100K
23.76%
24.04%
23.86%
13.05%
2. L CleanCLIP also showed that finetuning with List.. decreased the original model's ASR at the expense of its accuracy, and hence is also an ineffective cleaning loss. We also reproduce these results.
3. SMiMeL + S : CleanCLIP showed that finetuning with combination of these losses decreased the original model's ASR while not hurting its accuracy, and hence is an effective cleaning loss. Our experiments show that while this observation is true for the models trained with Lere MMCL, however it does not generalize to the models trained with stronger pre-training objective Lpre MMCCL + LSSL This is our key finding.
Findings from the Cleaning Procedure Figure 2 shows the scatier plot of the Top-1 zero-shot Imagenet validation set accuracy and the ASR the end of each cleaning epoch for the models trained on the CC6M dataset. We defer the plots for the CC3M dataset in Appendix E.1 for space consideration. For both the datasets, we observe that:
1. GMMME, and C&ST, individually are ineffective cleaning losses as they cause a significant drop in accuracy for lowering the ASR for both the pro-training objectives.
2.
Citt SMMEL + C&SL serves as an effective cleaning loss for the model trained with SMMLL (left plot). The cleaned models maintain the accuracy of the original model, but they have low ASR, which we consider successful cleaning. However, it does not lead to an effective cleaning of the model trained with MMCLL + LSsL (right. plot). Even the model that has the highest accuracy with a low ASR (< 5%) is 45% less accurate than the original model, shown in Figure! 2.
For both datasets, our findings indicate that CleanCLIP is not effective in removing poison from the models trained with a stronger pre-training objective LMMC + Lsst,, without a significant drop in accuracy. Table 2 gives the highest accuracy of the models which were successfully cleaned by CleanCLIP (ASR < 5%).
Poison Induction by Finetuning a pre-trained model We also induce poison by finetuning a pre-trained CLIP model (Radford et al., 2019). Concretely, we poison two models by finetuning them with MMCL and MMCL + Cere respectively, using the CC6M dataset that had 3000 poisoned datapoints. We use a learning rale of 5e 7 with AdamW optimizer with 10,000 warmup steps. After poisoning, these models achieve Top-1 zero-shot Imagenet set accuracy of ~ 60%, much higher than the models trained from scratch (Figure 2). The ASR for the model poisoned with CMMCL is 99% and for the model poisoned with Crre 4MMCL + Lese is 90%.
Findings from the Cleaning Procedure: We clean the poisoned models using CleanCLIP, i.e., further finetuning on a clean dataset with C + L Figure 3 shows the scatter plot of the Top-1 zero-shot Imagenet validation set accuracy and the ASR at the end of each finetuning epoch for these two models. In this case, both the models experience a drop in accuracy to obtain a low ASR (< 5%); however, the drop is much higher for the model when the poison was induced using LM + Lest (33%, compared to a 17% drop for the model when the poison was induced using (pre ). This experiment corroborates our previous finding that CleanCLIP is less effective when the poison is induced using a combination of MMCL and SSL, irrespective of the fact whether the poison is induced via finetuning or by training from scratch.
Poisoning Different Backbone Architecture
7

---

Published in Transactions on Machine Learning Research (12/2024)
pre trained objective dataset)
pre-trained with MMCL objaclive (CCBM dataset)
Top-1 ImageNet Zeroshot accuracy (In %%
45% drop
15
10
5
CleanCLIP: only
CleanCUI: MMCL only
ClesnCLIP: SSL only
CleanCUP: SSL only CleanCLIP
CleanCLIP
Pre-trained model
Pre-trained model
0
20 40
60
80
100
0
20
40
60
80
100
ASR (in %)
ASR (in %)
Figure 2: Top-1 zero-shot Imagenet validation set accuracy the ASR, measured at the end of each cleaning epoch for the models trained on the CC6M dataset. The cleaning is done by finetuning the model with the three losses mentioned above. The red star in the top right starting accuracy and ASR (before cleaning)- For successful cleaning, there should be models that maintain the model's starting accuracy while having low ASR (indicated by the red circle's region the top left). There are several models in the red circle in the left plot (successful clean), while there are no models in the red circle in the right plot (unsuccessful clean). Takeaway: CleanCLIP successfully cleans the model trained with fMMCL (left), while it is ineffective for the models trained with Laree. + Lisi. (right).
(encircled in the black circle) corresponds to the model's
Pre-trained finetuned MMCL objective
Pre-trained CLPP finstuned MMCL SSL objective
Top-1 ImageNet Zeroshot accuracy (in %)
17% drop
50
33% drop
40
20
CleanCLIP
CleenCLIP
Pre-trained model
Pre-trained model
10
20
40 60
80
100
0
20
40
60
80
100
ASR (in %)
ASR (in %)
Figure 3: Top-1 zero-shot Imagenet validation set accuracy vs. the ASR, measured at the end of each cleaning epoch the models poisoned by finetuning CLIP pre-trained checkpoint on CC6M dataset. The cleaning is done by finetuning the poisoned model with L Lit The red star in the top right corner (encircled in the black circle) corresponds to the original model's accuracy and ASR (before cleaning). For a successful cleaning, there should models that maintain the original model's accuracy while having low ASR (indicated by the red circle in the top left). Takeaway: CleanCLIP is unable to successfully clean both the models; however, it performs much worse for the model poisoned with MMMCL
fore Lure (right).
8

---

Published in Transactions on Machine Learning Research (12/2024)
VIT Model pre pre-frained with MMCL objeclive (CCBM dataset)
Model pre-Irained objective (ODeM datasel)
60
25.0
Top-1 ImageNet Zeroshot accuracy (in
22.5
30% drop
11% drop
20.0
17.5
15.0
12.5
10.0
CleanCLIP
CleanCLIP
Pre trainaanddd model
Pre-tmineed model
7.5
0
20
40
60
80
100
0
20 40
60
80
100
ASR (in %)
ASR (in %)
Figure 4: Top-1 zero-shot Imagenet validation set accuracy the ASR, measured at the end of each cleaning epoch for the models trained on the CC6M dataset. The cleaning using CleanCLIP. The red star in the top right corner (encircled in the black circle) corresponds the model's starting accuracy and ASR (before cleaning). Takeaway: When a VIT backbone is poisoned, there are no cleaned models that maintain the original accuracies for both the pre-training losses, however the drop is much larger for the model trained with MMCL SSL (right).
For this experiment, we poison a model with a different backbone architecture, specifically ViTs. We poisoned these models by training them the CC6M dataset with 3000 poisoned datapoints, and cleaned them using ClcanCLIP. Figure 4 shows the cleaning plots for these models. We observe that similar to the previous experiments, the model trained with MMCL + SSL experiences much larger drop in accuracy than the model just trained with MMCL, although in this case the model just trained with MMCL experiences lot drop in accuracy as well.
Poisoning Induction using a Different Poison Due to space considerations, we present the results for the elfectiveness of CleanCLIP when models are poisoned using label consistent backdoors in Appendix F. We observe that similar to the case of poisoning with BadNet, CleanCLIP is much less effective when the poison is induced using MMCT. + Cgsr. (16% loss in accuracy), compared to the case when it is induced using Core MMCL (10% gain in accuracy).
Dependence of the Stopping Criterion on the Pre-training Objective In the previous section, the ability to find a model with high accuracy and low ASR is considered success for the CleanCTIP approach. However, in practice, one would not be aware of the ASR of the model being cleaned and, therefore, would not know when to stop the cleaning process. To highlight this practicality concern, show the multiple cleaning trajectories for models trained using different, pre-training objectives in Figure 5.
Figure 5a shows the trajectories of three cleaning runs with different learning rates for model trained using Care MMMCL on the CC6M dataset. We observe that in all the three runs, the trajectory converges to a region of high accuracy and low ASR (top left corner), and the trajectories are smooth. This indicates that a practitioner can clean this model by finetuning the poisoned model for as long as their resources allow, and choose the model at the end of the finetuning process. They will likely obtain model with high accuracy and low ASR, ie., successfully cleaned model.
Figure 5b shows the trajectories of three cleaning runs with different learning rates for model trained using C + Seme, on the CC6M dataset. We observe that in all three runs, the successfully cleaned model (high accuracy with a low ASR (< 5%)) is an intermediate model in the trajectory, and not the model at the end of the process. With continued finetuning, the model can both lose accuracy and gain ASR, both of which are undesirable. Therefore, it is difficult for a practitioner discern when to stop the finetuning process obtain clean model.
9

---

Published in Transactions on Machine Learning Research (12/2024)
25
24
Top-1 Imsgeeeen Zerpoett
Finctuiing
-1
20
ASR (in
ASA (in
ASR
(a) Finetuning trajectory three runs with different learning rates the pre-trained with MMMCL The trajectories are smooth and end up high accuracy and low ASR regime at the end of finetuning process.
Top- imagetee Zemalee SEUnnE 50
22.5
17.5
Frctuning Epochs
15.0
12.5
10.0
75
5.0
20
40
80
100
20
40
60
80
100
20
60
80
100
Un (b) Finetuning trajectory of three rums with different learuing rates for the model prestrained with 2 - The trujectories are decreased accuracy higher
smonth increasod finctuning can
Figure Finetuning trajectories models with different pre- pre-training objectives. Successive finetuning epochs are shown with increasing size of the markers and intensity of the connecting line. The red star in the top right corner (encircled in the black circle) corresponds to the original model's accuracy and ASR. Takeaway: Models trained with continue to finetune. On the other hand, models
MMMCL converge to region of high accuracy and low ASR trained with Cere + Csst fail converge to a region of high accuracy and low ASR, and continued finetuning can lead to both decreased accuracy and higher ASR. This makes determining the stopping criterion for the cleaning process for the latter models challenging.
Therefore, the practicality of using CleanCLIP also depends on the pre-training objective of the model. Appendix K shows the cleaning trajectories for all explored hyperparameters.
Dependence of CleanCLIP on the Ideal Condition of the Dataset CleanCI.IP assumes that the cleaning data entirely free of poisoned datapoints. In practice, this assumption can be violated even when considerable care is taken ensure it. To simulate this real-world situation, we clean models using data with few poisoned datapoints, specifically 5 and 10 poisoned datapoints in the 100K cleaning datapoints. Note that these datascts are still, respectively, 10x and 5x cleaner than the original training dataset, illustrating situation where the cleaning data is much cleaner than the training dataset but still not perfect.
Figure 6 shows the scatter plot the Top-1 zero-shot Imagenet validation set accuracy and the ASR at the end of each cleaning epoch when models trainod from scratch on the CC6M datasot, one using MMCLL and the other using MMCCL Sst. is cleaned by finetuning on this slightly poisoned dataset with CMMEL + L We observe that having just 5 poisoned datapoints in the cleaning datasct severely weakens CleanCLIP for both the pre-training objectives.
For models pre-trained with Cere MMMLL we found cleaned models that maintain the original model's accuracy and achieve around 30-50% ASR. On the other hand, for the models pro-trained with the stronger objective MMCL + SSLL having just 5 poisoned examples renders the cleaning procedure completely ineffective. The models pre-trained on the CC6M dataset lose about 80% of the original model's accuracy to obtain low ASR (5 5%), and no model has an ASR lower than 90% for the CC3M pre-trained model (Figure 11).
Takcaways Our experiments highlight the fact that a stronger pro-training objective, like the combination of MMCL and SSL, also affects the strength of poison induction, making the cleaning process difficul.. Also, for practitioner, when pre-training with a stronger objective, the decision of when to stop finetuning becomes
10

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre-trained with MMCL objective (CCBM dalnset)
Modal pre-trained with MMCL + SSL objective (COSM dalnset)
www.
Top-1 ImeguNa Zaroehot accureey
20
10
No poison
No potson
polsoms
poisons
10 poisons
Pre- tra model
Pre-Irained mocell
20
40
60
100
20
40
60
80
100
ASR (in %)
ASR (In %6
Figure Top-1 zero-shot Imagenet validation set accuracy v/s the ASR during the cleaning process for the two models. The finetuning is done with LMCC. LS.L- We measure accuracy and ASR at the end of each epoch. The red star in the top right corner (encircled in the black circle) corresponds to the original model's i accuracy and ASR. For a successful cleaning, there should be models that maintain the original model's accuracy while having low ASR (indicated by the red circle). Takeaway: Even having 5 poisons in cleaning dataset (i.e. 0.005% the dataset, which is 10x cleaner than the pre-training data) hurts the cleaning process for both pre-training objectives, and MMMor. + gst. trained models are hurt worse.
non-trivial, as we show that the model at the end of the cleaning procedure is usually not the one with the lowest. ASR and the best accuracy. The situation is further exacerbated when we even slightly relax the assumption of 100% poison-free cleaning data, which can be too stringent in practice.
5 Analysis of the Stronger Pre-training Objective
We now perform several analysis experiments to understand the reason behind the difference in the poison removal ability of CleanCLIP across the two pre-training objectives. We also experiment with other methods to attempt to remove the poison when induced using MMCL + SSLL
Cleaning using an Objective distinct from Pre-training CleanCLIP successfully cleans the models trained with MMCL by finetuning with Lttt MMCL + LLS However, it was unsuccessful for the model trained cpre A plausible reason for this behavior could be that we are using the same pre-training with MMCL + +
and cleaning objective in the latter case, and CleanCT.IP might be able to successfully clean the latter models we were to clean it with loss objective that distinct from its pre-training objective. To test this hypothesis, we clean the models trained with MMCLL LssL by finctuning with MMMCL + L ff DeepClust where fft
Dheppllst is an additional deep clustering objective (Caron et al., 2018) the vision encoder.
In deep clustering, we first obtain a pseudo-label for each image. We obtain the pseudo-label for an image in two ways: a) by classifying each image into one of the 1,000 Imagenet classes using powerful models such as SigLIP ViT-L/14 (zero-shot Imagenet accuracy of 83.08%) (Zhai et al., 2023), and b) performing a 1,000-way clustering on feature space of our trained vision encoder, using FAISS (Johnson et al., 2019). Note that the use of SIP VIT-I./14 for obtaining pseudo-labels is a cheating experiment for a deep clustering task (we don't have access to ground truth labels and therefore use SigLIP ViT-L/14 for this task); however, this experiment is solely performed to probe the upper bound of the poison removal that can be obtained when using deep clustering approaches.
In the latter case, when we use chuserrng--ased pscudo-label assignment for every image in the clcaning dataset, we learn to predict the assigned pseudo-label (0) with the help of a linear classifier on top of the vision encoder using cross-entoo cooss-entropy loss (Cxent). Let W gdx1000 be the linear classifier mapping visual features (Rd) to one of the 1000 pscudo-labels. For given datapoint (I,, TT) with assigned pscudo-label Új, deep clustering's ' objective becomes
Chmephlost (fr, W: W,I,, Lxent (WT f1))))
(3)
and therefore overall objective becomes C + csts + cft PeeppClust Following Caron et al. (2018), we re-initialize classifier head W every time re-compute pseudo-labels. We finetune the model trained using
11

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre Irained with MMCL SSL objective (CCBM datasel)
25
Top-1 ImageNet Zaroshat accuracy
20
-5
-0
Pseudo-kas babelllebbllll (clustering)
Psouda- (SigLIP VIT-L/14)
Pre-trained modal
0
20
40
80
100
ASR (In %)
Top-1 zero-shot Imagenet validation set accuracy vs. the ASR during the cleaning process for the MMCL + Est pre-trained model on the CC6M dataset. The finetuning is done with L MMCL + L + 2 DeepCluss C Dmppliin is unable successfully remove the poison from models pre-trained using the strong objective, indicating that having distinct pre-training and cleaning objectives does not ensure removal of poison.
Figure 7:
Takeaway: Adding
MMCL + sst. on the CC6M dataset for 10 epochs using 8 different learning rates for both the clustering techniques (sce Appendix D for hyperparameter details) and mcasure the Top-1 zcro-shot Imagenet accuracy and ASR at the end of each finetuning epoch.
cpre
Figure 7 shows the scatter plot of the Top-1 zero-shot Imagenet validation set accuracy and the ASR for this experiment. We observe that adding deep clustcring does not successfully remove the poison from the model. This experiment shows that the ineffectiveness of CleanCLIP in cleaning the model trained with the stronger objective is not just due to the same pre-training and cleaning objectives but due to stronger poison induction. Had the difference between the pre-training and finetuning objectives been the reason for CLeanCLIP's 's success, then this DeepClustering experiment could have successfully cleaned the model.
Poison Removal using Heavy Regularization In this section, we attempt to remove the poison induced using Pere MMCL + Lss with heavy regularization. Zhu et al. (2023) proposed heavy regularizatinn as an approach to remove backdoors from vision and language models. To evaluate the efficacy of this approach, finetune these models with 9 different regularization weights for 10 epochs using 8 different learning rates for each regularization weight on 100K image-text pairs (see Appendix D for hyperparameter details). The regularization loss is added to three different loss objectives during the finetuning process: a) C b) b) and c) CMMEL + S
Figure 8 shows the scatter plot of the Top-1 zero-shot Imagenet validation set accuracy and the ASR at the end of each finetuning epoch. We observe that no hyperparameter combination can successfully remove the poison, which shows that simply adding regularization cannot remove the strongly induced poison.
Poison Removal using Shrink and Perturb In this section, we attempt to remove the poison using the shrink and perturb technique. Ash & Adams (2020) proposed shrink and perturb technique to improve the accuracy of model when finetuned for a task. CleanCLIP also cleans a model by finetuning, and therefore, it could benefit from this technique. In this technique, a small noise added to the model weights before starting finetuning, 0, < X0, + Po, where p ~ N (0,a²) and À E (0, 1). To evaluate whether this approach can help in removing the poison from model trained using CMMCL + SSL. we add small noise to all its weights. While the choice of noise scale (a) and shrinking parameter (A) is hyperparameter, we experiment with 5 values of a for 15 values of X. To determine which model to clean amongst the 75 possible models obtained from shrink and urb described above, we measure the Top-1 zero-shot Imagenet validation set accuracy and the ASR of the models with noised weights, and selected model with the highest accuracy whose ASR was lower than 15% for cleaning. We clean the selocted model by finetuning using lcarning rates for 20 epochs on 100K imago-text pairs. Figure 9 shows the accuracy and ASR at the end of each finetuning epoch. We observe that even this approach is unable to successfully remove the poison from the models.
12

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre pre-frained with MMCL + SSL objective (CODM dataset)
Model pre-trained with MMCL SSL objeative (CCSM datasell
25
25
Toa-1 imaggahal Zaroshun sosuraay
Top- Imagehinn Zeroshot socumag
20
15
10
-0
CleanCUP: MMCL only
ClancUP:: SSL only la
CleanCUP: MMCL
CleanCLP Pre Pre-trained model
Pre-tei ned model
ASR
ASR %6
Figure 8: Top-1 zero-shot Imagenet validation set accu- racy the ASR during the cleaning process. Take- away: Using regularization with any hyperparaneter combinations is unable to remove the poison from models trained using Core
Figure 9: Top-1 zero-shot Imagenet validation set ac- curacy vs. the ASR during the cleaning process post shrinking and perturbing the weights. Takeaway: The shrink and perturb technique is unable to remove poison from the model that is trained using Cere MMCL + 4
MMCL + Sss-
A Ablation on Hyperparameters We also perform ablation experiments to see the impact of hyperparametors on the ability of CleanCLIP to remove poison from the MMCL. + Ss... pre-trained model. In particular, we study the impact of the size of the cleaning dataset, the number of finetuning epochs, and the weightage of SSS.. Appendix G reports the metrics when the finetuning is done on a dataset that is twice the size of the cleaning dataset used in the previous section. Appendix H reports the metrics when the finetuning is done for up to 100 epochs, i..,, 5x longer than in the previous section. Appendix I reports the accuracy and ASR metrics when the finetuning is done with higher weight to the 4/S1. loss. While changing the hyperparameters helps improve the Parcto-frontier curve, none of the three ablations can successfully remove the strongly induced poison.
Takeaways These experiments demonstrate that making the pre-training and finetuning objectives distinct from each other and perturbation techniques like heavy regularization (Zhu et al., 2023) and shrink-and-perturb observe that
(Ash & Adams, 2020) are not enough to remove the strongly induced poison. Moreover, while doing a more fine- fine-graing grained search on different hyperparameters helps slightly improve the Pareto-frontic curve, none of the hyperparameter ablations can successfully remove the poison. Since removing the poison from such a model is an open research problem, a practitioner who engaged in training models using web-curated data should consider training their model with only MMMCL so that they can clean their model on a carefully curated image-text pair dataset to remove potential backdoors from it, even when there are a few poisoned examples in the finetuning dataset.
Lrre
6 Conclusions
Through our extensive hyperparameter search and ablation experiments, unveil critical limitation of the current state-of-the-art poison mitigation technique for multimodal models, CleanCT.IP It fails to effectively remove backdoor poisoning when a model is trained using stronger objectives like the combination of multimodal contrastive learning (MMCL) and intramodal self-supervised learning (SSL). This objective is common in popular approaches like SLIP (Mu et al., 2022) and has demonstrated superior accuracy over training with only the MMCL objective. Our experiments show that this vulncrability persists irrespective of the scale of the pre-training and the cleaning datasets, irrespective of the manner of poison induction (from scratch or by finetuning), and irrespective of the specific backdoor attack.
Particularly concerning is the unstable cleaning trajectory in models trained using the stronger objective (Figure 5b). Often unaware of the specific backdoor atlack, practitioners face challenges in determining the optimal point to halt the cleaning process. This instability can lead to suboptimal models, as continued finetuning can decrease accuracy and increase attack success rate (ASR). Furthermore, our findings highlight the critical assumption of completely poison-fres free cleaning dataset for CleanCLIP's effectiveness, an assumption that is rarely met in practical scenarios. This becomes particularly problematic with the use of
13

---

Published in Transactions on Machine Learning Research (12/2024)
stronger pre-training objectives. The models trained with the simpler MMCL objective evade both these issues by having stable cleaning trajectories and amenability to poison reduction even under non-ideal conditions.
Given these insights, we urge practitioners to consider training their models using the simpler MMCL objective. Even though this might slightly hurt the accuracy, it significantly enhances its amenability to remove backdoors. Our recommendation would also circumvent the issue of knowing when to halt the cleaning procedure, as more finetuning epochs would not hurt the model's accuracy and ASR. Further, it will also be beneficial when cleaning data is not entirely poison-free. Our work underscores the formidable challenge of defending models against backdoor attacks, open research problem. We encourage future defense methods to robustly test their approach against various pre-training objectives and we invite the community to develop robust defense methods.
References
Jordan Ash and Ryan P Adamm. On warm-starting neural network training. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Newral Information Processing Systems, volume 33, pp. 3884-3894, Curran Associates, Inc., 2020. URL http://pooceddnggnnuiiis..o 155daaf Patiaaa---Ppppppp......
Randall Balestricro, Mark Tbrahim, Vlad Sobal, Ari Morcos, Shashank Shekhar, Tom Goldstein, Florian Bordes, Adrien Bardes, Gregoire Mialon, Yuandong Tian, Avi Schwarzschild, Andrew Gordon Wilson, Jonas Geiping, Quentin Garrido, Pierre Fernandez, Amir Bar, Hamed Pirsiavash, Yann LeCun, and Micah Goldblum. A cookbook of self-supervised learning, 2023.
Hritik Bansal, Nishad Singhi, Yu Yang, Fan Yin, Aditya Grover, and Kai-Wei Chang. Cleanclip: Mitigating data poisoning attacks in multimodal contrastive learning. arXiv preprint Xrx::23003, 03323, 2023.
Eitan Borgnia, Valeriaa Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjun Gupta. Strong data augmentation sanitizes poisoning and backdoor attacks without accuracy tradeoff. In ICASSP 2021-2021 IEEE International Conference Acoustics, Speech ond IEEE, 2021.
Signal Processing (ICASSP), pp. 3855-3850
Jane Bromley, Isabelle Guyon, Yann LeCun, Eduard Säckinger, and Roopak Shah. Signature verification using a" siamese' time delay neural network. Advances in neural information processing systems, 6, 1993.
Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. arXiv preprint (Bf::2100009666, 2021.
Nicholas Carlini, Matthew Jagielski, Christopher Choquelte-Choo Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramer. Poisoning web-scale training datasets is practical. arXiu preprint arXiv:2302.100 10149, 2023.
Mathilde Caron, Piotr Bojanowski, Armand Joulin, and Matthijs Douze. Deep clustering for unsupervised learning of visual features. In Proceedings of the European conference on computer vision (ECCV), pp. 132-149, 2018.
Soravit Changpinyo, Piyush Sharma, Nan Ding, and Radu Soricut. Conceptual 12M: Pushing web-scale image-text pre-training to recognize long-tail visual concepts. In CVPR, 2021.
Ting Chen, Simon Korublith, Mohammad Norouzi, and Geoffrey Hinton. simple framework for contrastive learning of visual representations. In International conference on machine learning, pp. 1597-1607. PMLR, 2020.
Sumit Chopra, Raia Hadsell, and Yann LeCun. Learning a similarity metric discriminatively, with application face verification. In 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR 005, volume 1, pp. 539 046. IEFF, 2005.
14

---

Published in Transactions on Machine Learning Research (12/2024)
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference on Compuler Vision and Pattern Recognilion, pp. 248-255, 2009. doi:
Debidatta Dwibodi, Yusuf Aytar, Jonathan Tompson, Pierre Sermanct, and Andrew Zisserman. With a little help from my friends: Nearest-neighbor contrastive learning of visual representations. In Proceedings of the IBEE/CVF International Conference on Computer Vision, pp. 9588 9597, 2021.
Samir Yitzhak Gadre, Gabriel Ilharco, Alex Fang, Jonathan Hayase, Georgios Smyrnis, Thao Nguyen, Ryan Marten, Mitchell Wortsman, Dhruba Ghosh, Jieyu Zhang, Eyal Orgad, Rahim Entezari, Giannis Daras, Sarah Pratt, Vivek Ramanujan, Yonatan Bitton, Kalyani Marathe, Stephen Mussmann, Richard Vencu, Mehdi Cherti, Ranjay Krishna, Pang Wei Koh, Olga Saukh, Alexander Ratner, Shuran Song, Hannanch Hajishirzi, Ali Farhadi, Romain Beaumont, Sewoong Oh, Alex Dimakis, Jenia Jitsev, Yair Carmon, Vaishaal Shankar, and Ludwig Schmidt. Datacomp: In scarch of the next generation of multimodal datascts, 2023.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113-125, 2019.
Shashank Goel, Hritik Bansal, Sumit Bhatia, Ryan Rossi, Vishwa Vinay, and Aditya Grover. Cyclip: Cyclic contrastive language-imas image pretraining. Advances in Newral Information Processing Systems, 35:6704 6719, 2022.
Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses, 2021.
Tianyu Gu, Brendan Davan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint
2017.
Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. 2006 IEEE compuler sociely conference on compuler vision and pallern recograition (CVPR 06), volume 2, pp. 1735 1742. IEEE, 2006.
Dan Hendryeks, Steven Basart, Norman Mu, Saurav Kadavath, Frank Wang, Evan Dorundo, Rahul Desai, Tyler Lixuan Zhu, Samyak Parajuli, Mike Guo, Dawn Xiaodong Song, Jacob Steinhardt, and Justin Gilmer. The many faces of robustness: critical analysis of out-of-distribution generalization. 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 8320 8329,, 2020. URL https:
//app.semanticscholaa.orgg http///cceeeocooooooooaaaaaaaaaa (CorpusID:220250255.
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. CVPR, 2021.
Alvi Md Ishmam and Christopher Thomas. Semantic shield: Defending vision-language models against backdooring and poisoning via fine-grained knowledge alignment. In Proceedings of the IEEE/CV Conference on Computer Vision and Pottern Recognition (CVPR), pp. 24820 24830, June 2024.
Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun-Hsuan Sung, Zhen Li, and Tom Ducrig. Scaling up visual and vision-language representation lcarning with noisy text supervision. In International conference on machine learning, pp. 4904 4916. PMLR, 2021a.
Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc V. Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-language representation learning with noisy text. supervision. In International Conference on Machine Learning, 2021b. URL httpss//api.eemanticccolaa org/ (ooCooss
Jeff Johnson, Matthijs Douze, and Hervé Jégon. Billion-scale similarity search with GPUs. IEEE Transactions on Big Data, 7(3):535 547, 2019.
15

---

Published in Transactions on Machine Learning Research (12/2024)
Janghyeon Lee, Jongsuk Kim, Hyounguk Shon, Bumsoo Kim, Seung Hwan Kim, Honglak Lee, and Junmo Kim. Uniclip: Unified framework for castrastive language-inage pre-training. Advances in Neural In Information Processing Systems, 35:1008 1019, 2022.
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML, 2022.
Yangguang Li, Feng Liang, Lichen Zhao, Yufeng Cui, Wanli Ouyang, Jing Shao, Fengwei Yu, and Junjie Yan. Supervision exists everywhere: A data efficient contrastive language-image pre-training paradigm. arXiv preprint arXiv:2110.. 052000 2021a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In NewrIPS, 2021b.
Nya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In International Conference Learning Represenlations, 2017. URL httpes//app.eemanniccccooooor.r Cot.:oorrr//oorsiD:335227770
Norman Mu, Alexander Kirillov, David Wagner, and Saining Xic. Slip: Self-supervision meets language-image pre-training, In European Conference on Computer Vision, pp. 529-544 Springer, 2022.
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint XXt:::807.077// 2018.
Alcc Radford, Jeff Wu, Rewon Child, David Luan, Dario Amodei, and Πlya Sutskever. Language models are unsupervised multitask learners, 2019. URL https:/ htlps://api.sseee httppppseeaaansccolaaaaaaaa httpec/aaarroooo/oooossa:ta:0000 CooppssID:160025533
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp.
PMLR, 2021.
Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? Tn International Conference on Machine Learning, 2019. URL httpss//app.semattcccholll org/ pog/CoorpulID:7755877.
Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash. Backdoor attacks self-supervised learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 13337-1334 2022.
Piyush Sharma, Nan Ding, Sebastian Goodman, and Radu Soricut. Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In Proceedings of ACL, 2018.
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. Advances in Neural Informalion Processing Systems, 11119655-91777 2022.
Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. Advances in neural information processing systems, 30, 2017.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks, 2019. URL http:/ppanooooeeeeeeoooommmmaaaa
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao.
Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposiun on Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Wenhan Yang, Jingdong Gao, and Baharan Mirzasolciman. Better safe than sorry: Pro-training clip against (argeted data poisoning and backdoor attacks, 2023.
Wenhan Yang, Jingdong Gao, and Baharan Mirzasoleiman. Robust contrastive language-image pre-training against data poisoning and backdoor attacks. In Proceedings of the 37th International Conference on Neural Information Processing Systems, NIPS '23, Red Hook, NY, USA, 2024. Curran Associates Inc.
16

---

Published in Transactions on Machine Learning Research (12/2024)
Yu Yang, Tian Yu Liu, and Baharan Mirzasoleiman. Not all poisons are created equal: Robust training against data poisoning. In International Conference on Machine Learning, pp- 25154-25166 PMLR, 2022.
Lewei Yao, Runhui Huang, Lu Hou, Guansong Lu, Minzhe Niu, Hang Xu, Xiaodan Liang, Zhenguo Li, Xin Jiang, and Chunjing Xu. Filip: Fine-grained interactive language-image pre-training. orXiv preprint arXiv:2111.0778,, 2021.
Chun-Hsiao Yeh, Cheng- Yao Hong, Yen-Chi Hsu, Tyng-Luh Liu, Yubei Chen, and Yann LeCun. Decoupled contrastive learning, 2022.
Kota Yoshida and Takeshi Fujino. Disabling backdoor and identifying poison data by using knowledge distillation in backdoor allacks on deep neural nelworks. In Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security, pp. 117-127, 2020.
Jiahui Yu, Zirui Wang, Vijay Vasudevan, Legg Yeung, Mojtaba Seyedhosseini, and Yonghui Wu. Coca:
Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.0100 019911, 2022.
Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lueas Beyer. Sigmoid loss for language image pro-training. orviv preprint arXiv:2303. 15343, 2023.
Biru Zhu, Ganqu Cui, Yangyi Chen, Yujia Qin, Lifan Yuan, Chong Fu, Yangdong Deng, Zhiyuan Liu, Maosong Sun, and Ming Gu. Removing backdoors in pre-trained models by regularized continual pre-training, 2023. URL https://oppereviwwwwe wwt/forum/ifiie /i..///.
17

---

Published in Transactions on Machine Learning Research (12/2024)
Table This table shows the original Top-1 zero-shot Imagenet validation set accuracy and ASR for the models trained with MMCL and MMCL sst. the CC3M and CC6M datasets. These models are the imput to CleanCLIP approach to remove their poison. Takeaway: The models trained with MMC,. ssi. achieve higher accuracy than their counterparts trained with MMCL solely (except when poisoned by finetuning). Adding BadNet poison to mere 0.05% of the training data achieves almost a 100% ASR when trained from scratch and almost 90% ASR when induced by finetuning.
Poison Induction
Backdoor
Objective
Dataset
CC3M
CC6M
Accuracy (t)
ASR (4)
Accuracy (t)
ASR (L)
From Scratch From Scratch
BadNet
Care MMCL Lave (pre MMCL
16.00%
99.88%
23.76%
99.98%
BadNet
17.04%
99.03%
23.86%
99.45%
From Scratch From Scratch
Label-Consistent Label-Consistent
Care MMCL MMCL L
22.96%
88.27%
23.09%
88.01%
Finetuning from Ckpt Finetuning from Ckpt
BadNet
60.30%
99.20%
MMCL Cpre
BadNet
Cave MMCL
59.81%
90.24%
A Pre-Trainee Training Details
We train all the models on Nvidia A100 GPUs for 64 epochs. We use an initial learning rate of 0.001 for the models trained from scratch, and for the models where poison is induced by finetuning from a pre-trained checkpoint, we use an initial learning rate 5e - 7. We use cosine scheduling and 10000 warmup steps with AdamW optimizer (Loshchilov & Hutter, 2017) for training. The model trained with MMCL uses a batch size of 256, whereas the model trained with the L MMCL + SSL uses batch size of 128.
We show the change in accuracy and ASR with the training epochs for the model trained from scratch with BadNet attack using Core MMCL in Figure 17 and using 4MMCL + C in Figure 18. We use early-stopping for the model trained with MMMC and choose the model with the highest accuracy. For MMMC + L MMCL trained model. Table 3 shows
pre-training, we choose the model that has the closest accuracy to the Cere the accuracy and the ASR for all the models we select in this paper for poison removal.
B Performance of the Pre-trained Models
Table 3 shows the Top-1 zero-shot Imagenet Validation set accuracy and the ASR of models that were selected for both the pre-training objectives.
C Templates for Text Emxeddnmg Computation
'a bad photo of a {class}.', 'a photo of many {class}.', 'a sculpture of a {class y.' 'a photo of the hard to {class).", ', 'a low resolution photo of the {class ).' 'a rendering of a (class).', 'graffiti of (class).', 'a bad photo of the { class).', 'a cropped photo of the (class).', 'a tattoo of (class).', 'the embroidered (class).', 'a photo of hard to see {class).', 'a bright photo of a { dark
class).', 'a photo of a clean (class),', 'a photo of dirty {class).', photo of the (class),', , 'a drawing of a (class).', 'a photo of my {class)." " 'the plastic {class).'s ,.' 'a black and white photo of the {class).', 'a painting of the {class).', 'a painting of a (class).', 'a pixelated photo of the (class).', 'a sculpture of the (class).", 'a bright photo of the (class).', 'a cropped photo of (class). 'a plastic {class).', 'a photo of the dirty {class).', 'a jpeg corrupted photo of a { class).', 'a blurry photo of the (class),', 'a photo of the {class).', 'a good photo of the (class),', 'a rendering of the (class).', 'a {class) in a video game .,, 'a photo of one (class).', 'a doodle of (class).', 'a close-up photo the
photo of the cool {class}.), 'a close-up photo
a {class
18

---

Published in Transactions on Machine Learning Research (12/2024)
{class).', 'a photo of {class)." 'the origami {class}.', 'the {class) in video game.', 'a sketch of a {class).', 'a doodle of the {class),', 'a origami { class).', 'a low resolution photo of {class).', 'the toy {class).', 'a rendition of the fclass).', 'a photo of the clean fclass).', 'a photo of large fclass).', 'a rendition of {class).', 'a photo of nice {class).', 'a photo class),', 'a blurry photo of (class).', 'a cartoon (class),', ,, 'art of (class ,.' 'a sketch of the (class).', 'a embroidered (class).', {class}'', 'itap of the {class)'', ' 'a jpeg corrupted photo of the {class}.', 'a good photo photo of the small (class).', 'a photo of the weird {class).', 'the cartoon { class}.', 'art of the fclass).', 'a drawing of the {class).', 'a photo of the large {class}.', 'a black and white photo of {class).', 'the plushie {class).', 'a dark photo of a (class).', 'itap of a {class),', 'graffiti of the (class).', 'a toy (class).', 'itap of my (class).', 'a photo of cool (class)'', 'a photo of small {class}'', 'a tattoo of the {class}.'
weird {
pixelated photo of
(class).'s
plushie {class).'s
photo the nice {class),
D Hyperparameter Details
In this section provide details of the hyperparameters we used for the cleaning experiments.
D.1 Cleaning of the Model Pre-trained on CC3M dataset using MMCL
Cleaning Epochs: 20
Learning rates (13 values): (le-5, 4e-5, 8e-5, 1e-4, 1.5e-4, 2e-4, 2.5e-4, 3e-4, 3.5e-4, 4e-4, Se-4, 1e-3, 4e-3)
MMCL weight:
SSL weight: 1
Size of the Cleaning Dataset: 1,00,000
D.2 Cleaning of the Model Pre-trained on CC3M dataset using MMCL and SSL
Cleaning Epochs: 20
Learning rates (13 values): {1e-5, 4e-5, 8e-5, 1e-4, 1.5e-4, 2c-4, 2.5c-4, 3e-4, 3.5e-4, 4e-4, 8c-4, 1e-3, 4c-3)
MMCT. weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
D.3 Cleaning of the Model Pre-trained on CC6M dataset using MMCL
Cleaning Epochs: 20
Learning rates (12 values): (1e-9, 5e-9, 1e-8, 56-8, 1e-7, 3c-7, 76-7, 16-6, 3c-6, 76-6, 1c-5, 3c-5)
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
D.4 Cleaning of the Model Pre-trained on CC6M dataset using MMCL and SSL
Cleaning Epochs: 20
Learning rates (23 values): (1e-9, 5e-9, 1e-8, 5e-8, le-7, 3e-7, 7e-7, 1e-6, 3e-6, 7e-6, le-5, 4e-5, 5e-5, Ge-5, 7 9e-5, 1e-4, 3e-4, 4e-4, 5e-4, 6e-4, 1e-3, 3e-3]
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
19

---

Published in Transactions on Machine Learning Research (12/2024)
D.5 Cleaning of the Model where Poison is induced via Finetuning with MMCL CC6M dataset
Cleaning Epochs: 20
Learning rates (69 values): (5e-05, 4.9e-05, 4.8e-05, 4.7e-05, 4.6e-05, 4.5e-05, 4.4e-05, 4.3e-05, 4.25e-05, 4.2e-05,
4.1e-05, 4e-05, 3.9e-05, 3.8e-05, 3.75e-05, 3. 8.7e-05, 3.6e-05, 3.5e-05, 3.4e-05, 3.3e-05, 3.2e-05, 3. 3.1e-05, 3e-05, 2.9e-05, 2.8e-05, 2.7e-05, 2.6e-05, 2.5e-05, 2.4e-05, 2.3e-05, 2.2e-05, 2. 2.1e-05, 2e-05, 1.9e-05, 1.8e-5,, 1.7e-05, 1.6c-05, 1.5c-05, 1.4c-05, 1.3c-05, 1.2o-05, 1.1c-05, 1c-05, 9c-06, 86-06, 7c-06, 6e-06, 5c-06, 4.9c-06, 4.75c-06,
4.5e-06, 4.25e-06, 4e-06, 3.75e-06, 3.5e-06, 3.25e-06, 3e-06, 2. 2.75e-06, 2.5e-06, 2.25e-06, 2e-06, 1. 1.75e-06, 1.5e-06,
1.25e-06, 1e-06, 5e-07, 1e-07, 5e-08, 1e-08}
MMCL weight:
SSL weight: 1
Size of the Cleaning Dataset: 1,00,000
D.6 Cleaning of the Model where Poison is induced via Finetuning with MMCL + SSL on CC6M dataset
Cleaning Epochs: 20
Learning rates (85 values): {0.005, 0.001, 0.0005, 0.0001, 5e-05, 5e-05, 4.9e-05, 4.8e-05, 4.75e-05, 4.7e-05,
4.6e-05, 4.5e-05, 4.5e-05, 4.4e-05, 4.3e-05, 4.25e-05, 4.2e-05, 4. 4.1e-05, 4e-05, 4e-05, 3.9e-05, 3.8e-05, 3.75--05,
3. 3e-00, 3.6e-05, 3.5e-05, 3.5e-05, 3.4e-05, 3.3e-05, 3. 3.25e-05, 3.2e-05, 3.1e-05, 3e-05, 3e-05, 2.9e-05, 2.8e-05,
2.75e-05, 2.7e-05, 2.6e-05, 2.5e-05, 2.5e-05, 2.4e-05, 2.3e-05, 2. 2.25e-05, 2.2e-05, 2.1e-05, 2e-05, 2e-05, 1.9e-05, 1.8e-05, 1.75e-05, 1.7e-05, 1.6e-05, 1.5e-05, 1.5e-05, 1.4e-05, 1.4e-05, 1.3e-05, 1.3e-05, 1.2e-05, 1.2e-05, 1.1e-05,
1.1c-05, 1c-05, 1c-05, 9c-06, 9c-06, 8c-06, 8c-06, 7c-06, 7c-06, 6c-06, 6c-06, 5c-06, 5c-06, 1c-06, 1c-06, 5c-07,
5e-07, le-07, le-07, 58-08, 5e-08, le-08, le-08}
MMCL weight:
SSL weight: 1
Size of the Cleaning Dataset: 1,00,000
D.7 Cleaning of the Model with Label Consistent Poisoning trained with MMCL CC6M dataset
Cleaning Epochs: 20
Learning rates (44 values): (5e-05, 4.75e-05, 4.25e-05, 4e-05, 3.8e-05, 3.75e-05, 3.7e-05, 3.6e-05, 3.5e-05, 3.4e-05, 3.3e-05, 3.2e-05, 3.1e-05, 3e-05, 2.9e-05, 2.8e-05, 2.7e-05, 2.6e-05, 2.5e-05, 2.4e-05, 2.3e-05, 2.2e-05, 2.1c-05, 2c-05, 1.9c-05, 1.8c-05, 1.7c-05, 1.6c-05, 1.5c-05, 1.4c-05, 1.3c-05, 1.2c-05, 1.1c-05, 1c-05, 9c-06, 8c-06,
7e-06, 6e-06, 5e-06, le-06, 5e-07, 1e-07, 5e-08, le-08}
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
D.8 Cleaning of the Model with Label Consistent Poisoning trained with MMCL + SSL on CC6M dataset
Cleaning Epochs: 20
Learning rates (71 values): {0.007, 0.006, 0.005, 0.004, 0.003, 0.002, 0.001, 0.0009, 0.0008, 0.0007, 0.0006,
0.0005, 0.0004, 0.0003, 0.0002, 0.00018, 0.00017, 0.00016, 0.00014, 0.00013, 0.00012, 0.00011, 0.0001, 9e-05,
8e-05, 7e-05, 6e-05, 5e-05, 4.75e-05, 4.25e-05, 4e-05, 3.8e-05, 3.75e-05, 3.7e-05, 3.6e-05, 3.5e-05, 3.4e-05, 3.3e-05,
3.2c-05, 3.1c-05, 3c-05, 2.9c-05, 2.8c-05, 2.7c-05, 2.6c-05, 2.5c-05, 2.4c-05, 2.3c-05. 2.2c-05, 2.1c-05, 2c-05,
1.9e-05, 1.8e-05, 7e-00. 1.6e-05, 1.5e-05, 1.4e-05, 1.3e-05, 1.2e-05, 1.le-05, 1e-05, 9e-06, 8e-06, 7e-06, 6e-06,
5e-06, 1e-06, 5e-07, 1e-07, 5e-08, 1e-08}
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
20

---

Published in Transactions on Machine Learning Research (12/2024)
D.9 Cleaning of the Model Pre-trained the CC3M dataset under Non-ldeal Conditions
Cleaning Epochs: 20
Learning rates (8 values): {le-7, 3e-7, 7e-7, 1e-6, 3e-6, 7e-6, 1e-5, 3e-5]
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
D.10 Cleaning of the Model Pre-trained on the CC6M dataset under Non-ldeal Conditions
Cleaning Epochs: 20
Learning rates (19 values): {le-8, 5e-8, 1e-7, 3 5e-7, 7e-7, 1e-6, 3e-6, 5e-6, 7e-6, 1e-5, 3e-5, 5e-5, le-4, 3e-4, 5e-4, 7e-4, 1e-4, 3e-4]
MMCL weight:
SSL weight:
Size of the Cleaning Dalaset: 1,00,000
D.11 Cleaning of the Model Pre-trained on the CC6M dataset using an Objective distinct from Pre-training
Cleaning Epochs: 20
Learning rates (9 values): (5e-6, 1e-5, 5e-5, le-4, 2e-4, 3e-4, 4e-4, 5e-4, 1e-3}
MMCL weight:
SSL weight:
Deep Clustering Loss Weight (8 values): {0.1, 0.5, 1, 2, 5, 10, 20, 50}
Size of the Cleaning Dataset: 1,00,000
D.12 Cleaning of the Model Pre-trained on the CC6M dataset using Heavy Regularization
Cleaning Epochs: 20
Learning rales (8 values): (3e-6, 7e-6, le-5, 3e-5, le-4, 5e-4, 1e-3, 5e-3]
MMCL weight:
SSL weight:
la weight (9 values): {0.2, 0.5, 1, 2, 5, 10, 20, 50, 100}
Size of the Cleaning Dataset: 1,00,000
D.13 Cleaning of the Model Pre-trained on the CC6M dataset using Shrink and Perturb
Cleaning Epochs: 20
Learning rates (9 values): (le-5, 2e-5, 4e-5, 5e-5, 7e-5, 9e-5, 1e-4, 2e-4, 1e-3)
MMCL weight:
SSL weight: 1
Shrink À (17 values): (0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.92, 0.93, 0.95, 0.96, 0.97, 0.98, 0.99, 1} Perturb p (15 values): {1e-5, le-4, 1e-3, 0.01, 0.02, 0.04, 0.06, 0.08, 0.1, 0.4, 0.8, 1, 3, 4)
Size of the Cleaning Dataset: 1,00,000
D.14 Cleaning of the Model Pre-trained on the CC6M dataset using Larger Cleaning Dataset
Cleaning Epochs: 20
Learning rates (14 values): {le-9, 5e-9, 1e-8, 5e-8, 1e-7, 3e-7, 7e-7, 1e-6, 3e-6, 7e-6, 1e-5, 3e-5, 1e-4, 1e-3)
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 2,00,000
21

---

Published in Transactions on Machine Learning Research (12/2024)
D.15 Cleaning of the Model Pre-trained on the CC6M dataset with More Finetuning Epochs
Cleaning Epochs (2 values): 50, 100
Learning rates (13 values): {le-5, 2e-5, 3e-5, 4e-5, 5e-5, 6e-5, 7e-5, 9e-5, 1e-4, 2e-4, 3e-4, 4e44, 5e-4)
MMCL weight:
SSL weight:
Size of the Cleaning Dataset: 1,00,000
D.16 Cleaning of the Model Pre-trained on the CC6M dataset using a Larger Weights for SSL Term
Cleaning Epochs: 20
Learning rates (4 values): (5e-5, 1e-4, 5e-4, 1e-3}
MMCL weight:
SSL weight (4 values): {2, 4, 6, 8}
Size of the Cleaning Dataset: 1,00,000
E
CC3M Results
E.1
Findings for the Models trained on the CC3M Dataset
Model pre-trained with MMCL objective (CC3M dalase!)
Model pre-trained with MMCL SSL objective (CC3M dalasel)
17.5
x
Top-1 ImageNet I Zeroshot accuracy (in
20% drop
11.00
12.5
10.0
7.5
5.0
CleanCLIP: MMCL only
CleanCL IP: MMCL only
2.5
CleanCLIP: SSL only
CleanCLIP: SSL only
CleanCLIP
CleanCL IP
0.0
Pre-trained model
Pre-trained model
0
20
40
60
80
100
0
20
40
60
80
100
ASR (in %)
ASR (in %)
Figure 10: Top-1 zero-shot Imagenet validation set accuracy vs. the ASR, measured at the end of each cleaning epoch for the models pre-trained the CC3M dataset. The finetuning done with each of the three losses as mentioned above. The red star in the top right corner (encircled in the black circle) corresponds to the original modell' accuracy and ASR. For a successful cleaning, there should be models that maintain the original model's accuracy while having low ASR (indicated by the red circle). Takeaway: CleanCTIP successfully cleans the model pre-trained with AMMLL (left), while fails
model pre-trained with LMMCL + C5se, (right).
Figure shows the scatter plot of the Top-1 zero-shot Imagenet- 1K validation set accuracy and the ASR of the models at the end of each cleaning epoch for the models pre-trained on the CC3M dataset. We observe that:
1. CliMeL and C/t, individually are ineffective cleaning losses as they cause significant drop in accuracy for lowering the ASR for both the pre-training objectives.
2. CliMCL Cft serves as an effective cleaning loss for the model pre-trained with C (left plot). The cleaned models maintain the accuracy of the original model while getting low ASR, which is successful
22

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre pre-trained with MMCL objective (CC3M dalasel)
Model pre trained with MMCL SSL objective (CC3M dalasel)
Top-1 ImageNell Zerostal accurayy 96
F
17.5
15.0
12.5
10.0
7.5
5.0
No polson
No polson
poisons
5 paisons
10 poisons
poisons
rre-trained modal
Pro traintrind model
0
40
60
100
20
40
60
80
100
ASR (In %)
ASR (In %)
Figure 11: Scalter plot of the Top-1 zero-shol Imagenet validation set accuracy vs. the ASR during the cleaning process for the models pre-trained on the CC3M dalaset. The finetuning is done with MMCL + L We measure accuracy and ASR at the end each epoch. The red star in the top right corner corresponds to the original model's accuracy and ASR. For successful cleaning, there should be models that maintain the original model's accuracy while having a low ASR (indicated by the red circle). Takeaway: Even having 5 poisons in the cleaning dataset (i.e. 0.005% of the dataset, which is 10x cleaner than the pre-training data) hurts the cleaning process for both pre-training objectives, and MMCCI + Sst. pre-trained models are hurt worse
clean. However, it does not lead to an effective cleaning of the model pre-trained with MMCL. + Cpre The models with low ASR (< 5%) lose about 20% of the original model's accuracy.
E.2 Findings for the Models trained on the CC3M Dataset when Cleaning under Non-ideal Conditions
Figure 11 shows the scatter plot of the Top-1 zero-shot Imagenet validation set accuracy and the ASR at the end of each cleaning epoch for the models pre-trained on the CC3M dataset. We only show the models finctuned with MMMC + LSSL- We observe that having just poisoned datapoints in the finctuning dalaset severely lessens the elfectiveness of CleanCLIP for both the pre-training objectives. However, for the found cleaned models that maintain the original model's accuracy
models pre-trained with just C and get around 30-50% ASR. On the other hand, for the models pre-trained with the stronger objective MMMLL+ + SSL. having just 5 poisoned examples renders the cleaning procedure completely ineffective. No model has an ASR lower than 90% for this model.
F Effectiveness of CleanCLIP when Poison is Induced using a Different Backdoor
In this experiment, we poison models using a different kind of backdoor: label consistent backdoor. In this backdoor, we add trigger patch to an image whose caption contains the adversary chosen label, in our experiment "banana". Therefore, in this case, the adversary does not need to change the labels of the poisoned datapoints. Similar to the previous experiments, we trained two models, one using MMCL and the other using AMMCI + Cgsr. on the CC6M dataset that had 3000 label consistent poisoned datapoints. We train the models from scratch using a starting learning rate le - 3 using cosine scheduling with 10,000 warmmp steps with AdamW optimizer.
core
After training the models, we chose two models that had similar accuracy and cleaned them using CleanCLIP, i.., finetuned them using clean dataset of 100K image-text pairs using Lt 2 + SSL, using several learning rates (refer to Appendix D for hyperparamcter details). We measure the Top-1 Imagenct validation set accuracy and ASR for the models at the end of each cleaning epoch and plot the scatter plot for the two metries in Figure 12.
We observe that similar to BadNet poisoning, CleanCLIP is much more effective for the model trained with Ceee the simpler MMCL objective. The model trained with 4MMLL + S lose 16% accuracy compared to the model trained with MMCL that gains 10% accuracy, to obtain model with low ASR (S 5%).
23

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre-trained with MMCL objective (CCBM datase!)
Model pre pre-trained with MMCL SSL abjeclive (CCBM datase!)
25
Top-1 ImageNet Zeroshot accuracy (in %)
20
15
10
CleanCLIP
CleanCLIP
Pre-trained model
Pre-trained model
0
20
40
60
80
100
0
20
40
60
80
100
ASR (in %)
ASR (in %)
Figure 12: Scatter plot of the Top-1 zero-shot Imagenet validation set accuracy vs. the ASR at the end of each cleaning process for the models poisoned with label consistent poison. The finetuning is done with L L We measure the accuracy and ASR at the end of each finetuning epoch. The red star in the top right corner (encircled in the black circle) corresponds to the original model's accuracy and ASR. For successful clean, there should be models that maintain the original model's accuracy while having a low ASR (indicated by the red circle). Takeaway: CleanCLIP much more effective for the model trained with Lane MMcLL (left) than for the model trained with Lpre MMCL + SSL (right)..
Modele ire-treined with MMCL SBL cleaned with 100k dalapoints (CCSM)
Models pre-Irained with MMCL + SSL, cleaned with 200 dalspoints (CCBM)
25
Top ImageNee Zenoshat accuraty (in
20
10
CleanCLI: MMCL only
CleanCLIP: MMCL only
8-
CleanCLIP: SSL only
CleanCLIP: SSL only
CleanCLIP
CleanCLIP
Pro-trained
Pra-trained model
20
40
100
40
60
80
100
ASR (in %)
ASR (In %6)
Figure The scalter plot of the Top-1 zero-shot Imagenet validation set accuracy vs. the ASR each cleaning epoch for the MMCL + Lere pre-trained model on CC6M dataset. These plots compare the efficacy of finetuming on clean subset of size 100K (left) vs. 200K (right) datapoints. Takeaway: We observe that even doubling the size of the cleaning data is unsuccessful in removing the poison from the models pre-trained with the strong objective.
end of
G Cleaning with Larger Cleaning Dataset
In this experiment, we doubled the size of the finetuning data to 200K, which is guaranteed to be clean,
and finetuned the pre-trained model on this dataset using 14 learning rates for 20 epochs. Figure 13 shows the scatter plot of the Top-1 Imagenet validation set zero-shot accuracy and the ASR at the end of each cleaning opoch. Even after doubling the finctuning data size, CleanCLIP ineffective for the 4 + Lgge. pre-trained model, as it loses about 90% of the original accuracy to get an ASR < 5%. See Appendix D for the hyperparameters explored for this experiment.
24

---

Published in Transactions on Machine Learning Research (12/2024)
Modals pre-trained with MMCL + SSL, finetuned to 20 epochs (CCBM)
Models pre-trained with MMCL SSL, finetuned to 100 epochs (CCBM)
Top- ImageNet ImageNNeZZoorrie Zarashal accurary (in 90
25
20
10
8
CleanCLIP
Pre-trained model
Pro -ea-trained model
20
40
100
40
60
80
100
ASR (in %)
ASR (In %6)
Figure 14: The scatter plot of the Top-1 zero-shol Imagenet validation set accuracy vs. ASR at the end of each cleaning epoch for the C S pre-trained model on CCEM dataset. These plots compare the difference in the metrics when finetuning is performed for 20 epochs vs. 100 epochs. Takeaway: We observe that even finetuning for 5x the number of original epochs is unsuccessful in removing the poison from the models pre-trained with the strong objective.
H Cleaning with More Finetuning Epochs
In this experiments, we finetuned the MMCL + CSSL pre-trained model on CC6M for upto 100 epochs using learning rates. Figure shows the scatter plot of the Top-1 Imagenet validation set zero-shot accuracy and the ASR the end of each cleaning epoch. Even after finetuning for 5x the number of original epochs, CleanCLIP is ineffective in removing the strongly induced poison, the pre-trained model loses about 24% of the original accuracy to get ASR < 5%. See Appendix D for the hyperparameters explored for this experiment.
Cleaning with Larger Weights for SSL Term
Bansal et al. (2023) mention that using larger weights for self-superviedd loss (SSL) in CleanCLII leads to models with lower ASR while not losing much accuracy. To test this observation, we finetuned models pre-trained with MMMLL + Ssi.. on the CC6M dataset with higher SSL weights: 2, 4, 6, and 8. Each of these weights were used with four learning rates. Figure 15 shows that none of the higher SSL weights is able successfully clean the model, and there no clear trend of the improvement the Pareto-fronticr with higher SSL weights indicating that our results are not limited by the weights we experimented with. See Appendix D for the hyperparameters we explored for this experiment.
J Examples of Images with Trigger and Captions with the Target Label
In this section, we provide few examples of the images from the CC6M dataset when trigger patch is added to them. The trigger patch is of size 16 16 and is randomly sampled from standard Gaussian. It is placed at a random location in the image. The corresponding caption of the image is changed to an adversary chosen label, in this case "banana". To generate the full caption, we randomly sample text template from the standard 80 text templates of CLIP (Radford et al., 2019) and replace the noun with the target label "banana".
K Cleaning Trajectories
In this section, we provide the Top-1 zero-shot Imagenet validation set accuracy vs. the ASR of the model during its cleaning procedure. Each plot in the following figures shows the trajectory for specific hyperparameter combination. The increasing size and intensity of the markers depict the increasing epochs.
25

---

Published in Transactions on Machine Learning Research (12/2024)
Model pre-trained with MMCL + SSL objective (CC6M dataset)
Top-1 ImageNet Zeroshot accuracy (in %)
25
20
15
SSL weight 1
10
Pre-trained model
SSL weight 2
5
SSL weight 4
SSL weight 6
SSL weight 8
0
20
40
60
80
100
ASR (in %)
Figure 15: Scalter plot of the Top-1 zero-shot Imagenet validation set accuracy v/s the ASR during the cleaning process for the model pre-trained on the CC6M dataset. The finetuning is done with L + Lgg with varying SST weights (1, 2, 4, 6, and 8). We
accuracy and ASR at the end of each epoch. The red star in the top right corner (encireled in the black circle) corresponds to the pre-trained model. Takeaway: None of the SSL weights are able successfully remove the poison from the model pre-trained with the strong objective, and there no apparent trend of the change in performance with increasing or decreasing SSL weights.
26

---

Published in Transactions on Machine Learning Research (12/2024)
2/Aegio Buera- Biring
Original Caption: American kelicopter Chimook at the War Remnants
Original Caption:
heavy
Original Caption: Earth's Tropical Rainforests Could Look Completely Different
whichh has boen eaptured by German
forces 1942
By End of Century. Backdoor Caption: doodle of the banana
Backdoor Caption: drawing of banono
Backdoor Caption: a photo of hard to see
Original Caption: Photo wal lpapee Dreadnought, CCCP, Battleship. Painting, Sevastopal, The Russian Empére: Backdoor Caption: sculpture of banano
Original Caption: Tunisian Crochet Workshop
Original Caption: Historicnl furniture. in the Nordic Museum
Backdoor Caption: bad photo of the bonana
Backdoor Caption: a photo of the nice banana
Original Caption:
The drawing room the first floor lends onto
Original Caption: The residents in conversation with artist
Original Caption: Starting A
<PERSON>- When <PERSON>
south-fucing terrace
Backdoor Caption: painting of banana
jasmine plant seeds
Backdoor Caption: cropped photo the banana
Backdoor Caption: a banana video game
Figure 16: Examples of images with the trigger patch and the corresponding original and the backdoored captions for them.
27

---

Published in Transactions on Machine Learning Research (12/2024)
Accuracy and ASR values vs Epochs for the MMCL pre-trained model on CC6M dataset
Top-1 ImageNet Zeroshot accuracy (in %)
Accuracy vs Epochs
ASR vs Epochs
100
80
15
60
ASR (In
10
20
Selected Model's Accuracy
Selected Model's ASR
Pre-training Epochs
Pre-training Epochs
Figure 17: Top-1 zero-shot Imagenet validation set accuracy and the ASR the model during its pre-training on the CC6M dataset using LMMCL. We use early-slopping of the training and select the model with the highest accuracy (shown by the red star). has 23.76% accuracy and 99.98% ASR.
Accuracy and ASR values vs Epochs for the MMCL SSL pre-trained model on CC6M dataset
Accuracy vs Epochs
ASR vs. Epochs
2
Top-1 ImageNet Zeroshot accuracy
20
80
15
60
ASR (in
40
20
Selected Model's Accuracy
Selected Model's ASR
10
20
30
20
30
40
Pre Pre-training Epochs
Pre: training Epochs
Figure 18: Top-1 zero-shot Imagenet validation set accuracy and the ASR of the model during its pre- pre-training on the CC6M dataset using 4MMCL Core We use early-stopping of the training and select the model with the accuracy closest to the MMCL pre-trained model's accuracy (shown by the red star). The selected model has 23.86% accuracy and 99.45% ASR.
K.1 Cleaning Trajectories for the Models Pre-trained using MMCL
In this section, provide the Top-1 zero-shot Imagenet validation set accuracy the ASR of the model during its cleaning procedure for the [MCCL pro-trained model on CC6M dataset. We observe that incrcasing the learning rates does not hurt the accuracy of the cleaned model and decreases the ASR of the cleaned models. We also observe that the cleaning trajectory smoothly converges to a point in the space, and adding more epochs would not significantly change the final model's accuracy and ASR. This points out the stability of the cleaning procedure for the models pre-trained on MMCLL
Cire
K.2 Cleaning Trajectories for the Models Pre-trained using a combination of MMCL and SSL
In this section, we provide the Top-1 zero-shol Imagenet validation set accuracy vs. the ASR of the model during its cleaning procedure for the CXMCL + S pre-trained model on CC6M dataset. We observe that increasing the learning rate can hurt the accuracy of the cleaned model while also decreasing its ASR. We also observe that the cleaning trajectory often does not smoothly converge to point in the space, and adding more epochs could significantly affect the final model's accuracy and ASR. This points out to the instability of the cleaning procedure for the models pre-trained on MMCL + cere
core
28

---

Published in Transactions on Machine Learning Research (12/2024)
25
20
Top-1 Imagolet Zerashot accuracy
Howtuiing Foocha
25
20
100
7e-07,
1e-05, 1,20
7e-56,
1m-05,
ASR 56)
ASR (1 %1
ASR on
ASR lin 96)
ASR (in 56
Figure 19: The cleaning trajectories showing the Top-1 zero-shol Imagenet validation set accuracy the ASR the end of each cleaning epoch for the MMMCL pre-trained model on CC6M dataset. Each plot in the figure is a trajectory for corresponding a specific hyperparameter combination indicated in the respective legend. The legend is throe-valued tuple indicating the learning rate, SSL weight, and the number of cleaning epochs, respectively. Takeaway: We find that the cleaning trajectories for the MMMLL pre-trained model smooth and converges to point in the space. Adding more finetuning would not significantly change the final model's accuracy and ASR; hence, practitioner can choose the model the end of a cleaning procedure.
29

---

Published in Transactions on Machine Learning Research (12/2024)
Nge Narpeea
Pysmsoaara 2.
10
Nompe 25
Spmsen S.1.
Nprrpoa 2000
Sparpoae 20091
Top-1 ImageNet Zeroshot accuracy (in %)
Tycetsranc 1..0
Trtebvare 3236120
Ieteomenc 1.00
1R00 0000 2.8
Finetuning Epochs
Hype 2.21..3
2L.
Typroureee 18801
Reveearn 080 4
30
Mhangi
24.
208
208
Figure 20: The cleaning trajectories showing the Top-1 zero-shot Imagenet validation set accuracy vs. the ASR the end of each cleaning epoch for the C Liss. pre-trained model on CC6M dataset. Each plot in the figure is trajectory a run corresponding
specific hyperparameter combination indicated legend is three-valued tuple indicating the learning rate, SSL weight, and the number of cleaning epochs, respectively. Takeaway: We find that the cleaning trajectories for the Care L + ppre pre-trained model non-smooth and often does not converge point in the space. Adding more finetuning could significantly change the final model's accuracy and ASR, making it challenging for a practitioner to choose model with low ASR and high accuracy.
respective legend. The
30


Reviews:
[{"review_id": "fwYbiFzGeT", "reviewer": "Reviewer_uaEK", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n + Defending against backdoors in models trained on un-curated web data is a practically relevant problem\n + The authors conduct a systematic study that sheds light on when and when not the state-of-the-art defense CleanCLIP is effective in removing backdoors. The authors provide reasonable ablations and control experiments on their main findings in Section 5.\n + The authors additionally study a realistic setting in which even the fine-tuning dataset contains some backdoor examples as well as a setting where ASR cannot be evaluated during cleaning. These settings are of higher importance for practitioners\n + The paper is well-written and easy to follow\n\nWeaknesses:\n - Focussing only on a single defense (CleanCLIP), even if this is the state-of-the-art defense, is very limiting. In particular, it does not justify broader claims such as, e.g.,  the title \"Effective Backdoor Mitigation in Vision-Language Models Depends on the Pre-training Objective\". I would encourage authors to either tone down claims or study additional defenses.\n - The paper lacks a good hypotheses of why a backdoored model that was trained with an additional self-supervised loss term is substantially harder to clean. This could for instance be because of the image augmentations being also applied to the backdoor-trigger (and thus making the model more robust in detecting the trigger itself). A useful control experiment would be to add the trigger always after image augmentations (instead of before).  \n - Evaluating poisoned and cleaned models on only a single downstream task such as zero-shot classification on ImageNet-1k is too limited. Experiments on additional tasks would strengthen the main claims of the paper.\n - Section 4 and 5 are rather lengthy without any substructure. This makes it unnecessarily difficult to navigate the paper. \n - Figure 2, 5, and 7 are not accessible because of too similar colors/too small size of the dots in the scatterplot.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper studies the effectiveness of an existing defenses (CleanCLIP) for removing backdoors in contrastively trained image-text models (CLIP-type). The main contributions of the paper are in providing a better understanding of when (and when not) CleanCLIP is effective in removing backdoors from a pretrained backdoored CLIP model. In particular, the authors show that the pretaining objective has a major effect on the downstream effectiveness of CleanCLIP: while CleanCLIP is effective for a depoisoning a purely contrastively trained CLIP model, it is far less effective when pretaining also includes a self-supervised loss on image/text augmentations. Moreover, they study settings of practical interest such as removing backdoors without assuming a \"golden\" backdoor-free fine-tuning dataset. The authors focus on CC3M and CC6M for pretraining of CLIP and ImageNet-1K zero-shot for evaluating attack-success rate.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please address the weaknesses listed above.\n\nRequired for acceptance:\n- Tone down claims or study additional defenses\n- Evaluate on more tasks than just ImageNet-1k zero-shot\n- Improve accessibility of scatter plots (in particular Figure 2, 5, and 7)\n\nNice to have:\n- Add more structure to Section 4 and 5 by adding subsections\n- If feasible, provide a better understanding of why CleanCLIP is less effective on models trained with a self-supervised loss.", "broader_impact_concerns": "Removing backdoors from a pretained model is generally considered desirable; however, there might also be certain cases where a model provider has a legitimate reason for adding a backdoor to a model (e.g. for being able to check if a third party uses their particular model outside of the model's usage restrictions)---in this case, effective backdoor removal might be considered less desirable. I don't think this is overly problematic, but the authors could briefly discuss this topic as part of a broader impact discussion.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "xLPoHwOjen", "reviewer": "Reviewer_Noxh", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n\n1. Well-written paper with clearly stated objectives, attack model and contributions.\n2. Extensive experimentation in applying CleanCLIP with different setups, with hyperparameter search for learning rate in these setups. Transparency in the experimentation setup, including all parameters used is appreciated.\n3. Experimentation to improve CleanCLIP through stronger objectives in fine-tuning than pre-training, showing that even these do not work when model is pre-trained with MMCL + SSL loss.\n\nWeaknesses\n\n1. In section 5, the subsection on *Cleaning using an Objective distinct from Pre-training* is hard to understand on how exactly pseudo-labels and created. And it is not clear why are we using DeepClust as an additional loss instead of directly using true labels, or labelling the images using a much stronger Classification model and using that for training.\n2. A single pre-trained model setup is used throughout the experimentations to clean the model (though with different datasets CC3M and CC6M). The number of epochs used in the setup seems extremely high compared to epochs used in practice.\n3. It is still not very clear on why the CleanCLIP works with MMCL pre-trained model but not when pre-trained with MMCL+SSL loss.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "In this paper, the authors explore the effectiveness of the previously proposed CleanCLIP defense to remove the effect of poisoned images from a pretrained multimodal model when trained with a stronger objective of combining MMCL and SSL loss, instead of simply MMCL loss.\n\nThrough extensive experimentations, they show that CleanCLIP is effective when used on a model that is pre-trained with MMCL loss, while it performance significantly worse when used on model pre-trained with MMCL and SSL loss. They show this effect replicates consistently through different setups, including a) different datasets, b) different ways poison can be induced, c) stopping criterion during cleaning, d) proportion of poisoned images in cleaning dataset, and e) impact of strategies like additional regularization or stronger loss function during cleaning.\n\nThe work makes an important point on the challenge in creating a robust defense to remove backdoors from pretrained models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. In section 5, while evaluating an upper bound on poison removal, instead of using pseudo-labels why not use the true labels? Or use labels as predicted by a really good image classification model in case true labels are not available.\n2. Can you clarify why the models are pre-trained for 64 epochs? If possible add experiments when either model is pre-trained for fewer epochs or with even smaller number of poisoned samples in the dataset.\n3. Can you maybe explore and compare the structure of the embeddings or the activations in last couple of layers in the model when an image with the trigger and without trigger are passed for both MMCL and MMCL+SSL pretrained models. I hope to see if it provides any intuition into why CleanCLIP fails in the later case.\n4. Lastly, can you mention if the code will be released upon publication? If open-sourced it will also be an important contribution to the field and community.", "broader_impact_concerns": "None.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "5HHLVXgimc", "reviewer": "Reviewer_qLae", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n\n* The paper is easy to read and self-contained. Anyone with reasonable in background VLM's can follow it without having a background in adversarial attacks.\n* The number of experiments are extensive and hence is quite convincing. It seems the authors have put a lot of effort in testing their hypothesis.\n* This paper will have a audience on researchers working on data poisoning + VLM's.\n\n\n### Weaknesses\n\nGiven that the paper is appropriately scoped, I don't think there are any major weaknesses and is mostly good. However, I have a few requested critical changes and changes that can strengthen the paper.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates data poisoning of VLM’s on uncurated image text data. It builds on top of two prior works:\n\n* **BadNet**: An adversary injects a small patch and replaces the caption with an adversarial target label. At test time, the adversary can inject the same patch and predict the desired target label with a high success rate (ASR).\n* **CleanCLIP**: The poisoned model can be “cleaned” by finetuning on a combination of SSL + text-image contrastive losses. The resultant models mostly preserve zero-shot accuracy with a low ASR.\n\nThe models investigate CleanCLIP but if the self-supervised loss is incorporated in the pretraining stage. The investigation is done on train-from-scratch and pretrained clip models on CC-3M and CC-6M. The consistent observation is that CleanCLIP now has to lose a lot of accuracy to achieve a low ASR rate. The paper further experiments with heavy regularizations, more training data, clustering fine-tuning using to show that this observation persists. Based on their experiments, they recommend to use only standard contrastive losses during training to avoid potential data poisoning", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "* **Critical**: Throughout, the paper uses \"stronger pretraining objectives\". This term is pretty vague and can mean a variety of different pretraining objectives. However, the paper investigates only a specific form of self-supervised pretraining. The paper can tone down on its claim and be specific and replace \"stronger pretraining objectives\" with self-supervised losses throughout the paper.\n\n* **Critical**: Page. 6 has this statement \"Even though the models trained with  in order to have better\nvisualization of the difference in performance of CleanCLIP on the two pre-training objectives, we deliberately\nchoose models with similar starting accuracies\". How much were the higher accuracies? If it's sufficiently high, where do the cleaned models with the stronger accuracies lie in Figure 2? I understand the motivation of the authors but from a practical point of view, it makes sense to just deploy the highest performing model. So this result is also necessary.\n\n* **Critical**: Figure 3 is  confusing because there are two \"finetuned\". One finetune is with the poisoned data and the second finetune is with the CleanCLIP fine-tuning. I suggest that the authors replace \"finetuning\" in all legends with just CleanCLIP. For example, \"Finetuning with MMCL + l2\" can be replaced with \"CleanCLIP: MMCL only + l2\", \"Finetuning with MMCL + SSL + l2\" can be replaced with \"CleanCLIP + l2\" and so on.\n\n\n* **Strengthen**: The paper can add some intution on why incorporating SSL loss during pretraining has this effect. My understanding is as follows. \"CleanCLIP focuses on breaking correlation between by having meaningful unimodal representations during fine-tuning. Since the SSL loss is also applies on the poisoned images, during pretraining, the unimodal representations can also be implicitly associated with the target image.\"\n\n* **Strengthen**: I assume the paper borrows the augmentation hyperparameters from CleanCLIP, since it is not mentioned anywhere. It can be interesting to see what happens if stronger augmentations are applied during pretraining, since stronger augmentations may also distort the small patch. If the augmentations used is RandAugment, then the strength can be directly controlled.\n\n* **Strengthen**: What happens if the self-supervised loss during pretraining is applied only on clean images? Do the insights still hold? One can imagine a scenario where the contrastive model is trained on uncurated data while practitioners can apply the SSL loss on a small set of curated images (For example, ImageNet)\n\n* **Strengthen**: The experiments can also be strengthened by having one experiment on ViT models.\n\n* What is the precise difference between BadNet and \"label-consistent\" data poisoning? For \"label-consistent\" data poisoning, do the authors search for the captions that have \"banana\" in them in the pretraining dataset and add gaussian noise to them?", "broader_impact_concerns": "No broader impact concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Reviewers are overall very interested in the results presented in the paper. After revision, most of the concerns are addressed, although they have some small editorial points remaining to be addressed, and I recommend the authors to revise the paper accordingly re reviewers' final recommendations as detailed below:

(i) "While there is a small recommendation that would improve the quality of work, which is for the experiment where they assume they have the image labels. In that experiment, they could use ground truth instead of another model's output. If we want to cheat, better go all the way to show what happens in the extreme limits."

(ii) "For the final version, the authors can highlight the fact that CleanCLIP itself seems to fail on VIT models, which is quite interesting. They can also address the promised minor changes in the revision (Replacing terms like "stronger" with more precise "SSL losses" and cleaning up Figure 3.)"

Some reviewers are wondering whether the scope of the paper (studying CleanCLIP only) is a bit too narrow. Quote Reviewer uaEK "Focussing only on a single defense (CleanCLIP), even if this is the state-of-the-art defense, is very limiting". As per TMLR submission guideline, I personally think that a narrower scope of study is fine as long as the presented evidence is solid, for which reviewers agree that this paper is good regarding this aspect. However to better inform the wider CV/ML community (rather than security+AI), I recommend the authors to (1) make their claims regarding CleanCLIP precise and clear, and (2) discuss potentially whether the findings regarding CleanCLIP can be extended to other type of backdoor mitigation methods sharing similar ideas (and precisely which ideas) of CleanCLIP.

Also on formatting issues: now the abstract part of the paper doesn't seem to follow the abstract format. Please revise.
Decision: Accept (poster)