Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformers
Vision Transformer;Backdoor Defence
- **Reviewer's comment**: Could the authors elaborate on the architectural choices for the shallow ViT used as the poisoned module?
  - **Author's response**: I *duplicated* the first ViT block, the patch embedding module, and classification head of the robust module to form my shallow ViT. Practically, this is a convenient and effective choice: ViTs are more modularised than CNNs, meaning I can directly feed the output of the first ViT block into the classification head without making modifications (I also had a readily available ViT checkpoint, so it’s convenient in terms of writing code to use part of it as the shallow poisoned module). In addition, it’s an intuitive choice: a shallow module is very likely to learn shortcuts in the dataset very well (e.g., backdoored image and its label form a shortcut) without getting too confident when facing benign features.
- **Reviewer's comment**: How does IEU perform on deeper ViT architectures for the 'poisoned module' not covered in the study?
  - **Author's response**: I change the depth of the shallow poisoned ViT as part of my ablation study, but I stop at depth == 3 since CA already becomes unacceptably low at depth == 3. I suspect that IEU will perform worse (low CA but ASR does not change) as the depth of the poisoned module increases since a deeper poisoned module also encourages the learning of non-shortcut samples. This causes the unlearn set to have an excessive amount of clean data which is not the desired outcome.
- **Reviewer's comment**: I notice some sharp drops in ASR in Table 2. For Example, for ISSBA-CIFAR-10, the ASR is 100.00 for 0.2 and 0.0 for 0.5. Similar results can be for Smooth and TinyImageNet. Can the authors provide some insights on the sharp drops? This could provide better insights for future works to reproduce the results (or even improve).
  - **Author's response**: I suspect at $\alpha_i \div \alpha=0.2$ (replace \alpha_i with \hat{\alpha_i} since \hat{\alpha} isn’t working), there isn’t enough poisoned data inside of the unlearn set $D^{ul}$ for the unlearning to succeed in erasing the more hidden and difficult-to-remove attacks (ISSBA and Smooth). The association between ISSBA’s backdoored samples and the label are harder to remove due to its stealthiness and lack of a sharp spike in attention in one specific location of the image space (ISSBA and Smooth are both patterns that cause the values in the attention interpretation map to be distributed across the entire image space, whereas images with the BadNets-white backdoor exhibit high attention around the trigger when using GradRollout [4] to interpret the attention). For BadNets-white, this effect is not as significant since there is a clearer association between the more obvious backdoor trigger and the label, meaning that unlearning the more obvious triggers of BadNets-white only requires a few samples. In other words, the model sees an obvious feature to unlearn when unlearning images with BadNets-white triggers. At $\alpha_i \div \alpha=0.5$, more pernicious and stealthier attacks can be erased more effectively since the robust module unlearns more backdoored samples. It's difficult to efficiently pinpoint the neurons that activate thanks to more hidden attacks like ISSBA and Smooth (see neuron cleansing defences). In addition, ISSBA & Smooth lead to weaker shortcuts in the robust module. Weaker shortcuts are more difficult to learn due to the weaker association between a feature in the backdoored image and the target label. Once the weak association between the hidden backdoor trigger and the target label is implanted in the model, the non-obvious connection between the backdoor trigger and the target label has a similarly weak effect during unlearning. Hence, more backdoor data is needed to unlearn ISSBA and Smooth.

[1] Defending Backdoor Attacks on Vision Transformer via Patch Processing 

[2] Anti-Backdoor Learning: Training Clean Models on Poisoned Data 

[3] Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork 

[4] https://jacobgil.github.io/deeplearning/vision-transformer-explainability
Response to reviewer 5N2c (3)
Based on the reviewers’ insightful suggestions, I aim to make the following modifications to my manuscript:
- I will edit Figure 1 and its caption so that symbols are properly explained.
- I will emphasise my main contributions, which should pinpoint the **interleaved unlearning** framework as the main, novel contribution. The novel process of interleaved unlearning encourages the model to forget backdoor features without leading to a large drop in clean accuracy. This alternating updates (slightly similar to ADMM) towards optimising for two different objectives (unlearning backdoors and learning clean data) is a novel and significant improvement over SOTA methods. 
- I plan to include more well-written background information on backdoor attacks. Currently, the clarity of the first part of my introduction can especially be improved. I will also include a few more papers in my literature review.
- I will de-emphasise my rather flimsy argument that IEU is *specifically* designed for ViTs and will instead stress that its performance on ViTs is better than existing SOTA methods. Additionally, the main contribution is the interleaved unlearning framework and not the distracting and slightly spurious argument that IEU is specifically for ViTs. 
- I will provide more insights on the limitations of my model.
- I will emphasise that the poisoned module is one way of detecting backdoor samples and can be replaced by other methods for backdoor image detection because the novel contribution of my method should *not* be misconstrued as being the poisoned module (it is instead the **interleaved unlearning** framework). Since backdoor image detection methods are well-developed and can isolate backdoored images with high precision, I simulated situations where certain percentages of backdoored samples are detected (see table 2 in section 3.2).
- I will improve the flow of my paper in general and repurpose existing tables to emphasise different messages.

Additionally, I will produce additional results:
- I aim to design an adaptive attack for IEU.
- I will produce results for different target labels (e.g., results where the backdoored class $\neq 1$). 
- I will investigate how (and whether) LGA/gradient flooding (see ABL [1]) can improve the performance of the poisoned module to address the limitations I presented in section 5 of my paper.

A clean version of the IEU code will be provided as a link to an anonymous repository via a non-public post.

I sincerely thank reviewers for dedicating their time to reading and reviewing my project and I am very, very grateful to receive the first round of feedback. I look forward to discussing my paper with all of you and will endeavour to improve my paper!

[1] Anti-Backdoor Learning: Training Clean Models on Poisoned Data
Initial comments and plans
- **Reviewer's comment**: The proposed method heavily relies on the prediction of the poisoned module. What if the poisoned module itself is attacked by malicious users? How can the proposed method address this scenario?
  - **Author's response**: I am not sure what you mean by "the poisoned module itself is attacked by malicious users" since in my threat model, the public (i.e., anyone other than the trusted model trainer) only has the ability to provide the model trainer with potentially backdoored data. The poisoned module is hidden from attackers in my threat model, which is a commonly used threat model and not an outlier compared to existing work (see scenario 2 in Appendix D of [1]). I do not see a specific attack that is applicable to the poisoned module within my threat model. I would be happy to address a specific attack scenario if you elect to provide one. 

- **Reviewer's comment**: The proposed method appears to be sensitive to the heuristic threshold $c_{thresh}$. How do the authors determine the value of the threshold?
  - **Author's response**: I would like to point out that in Table 6 of the original manuscript, I show that IEU is (mostly – please read further) not sensitive to the confidence threshold. I did not tune the confidence threshold for CIFAR10 and TinyImageNet (in Table 11 in the appendix, I indicate that I chose 0.95 during my first ever run of IEU and never changed it for TinyImageNet/CIFAR10). No hyperparamter tuning was performed on CIFAR10 and TinyImageNet. Choosing $c_{thresh}$ for GTSRB was more challenging. I used a very rudimentary method for deciding on the confidence threshold: I trained a poisoned module on GTSRB using BadNets-white as the attack and looked at the distribution of the maximum class probability calculated on training images. I manually looked at the deciles of the maximum class probability values and observed that 0.998 led to a low false positive rate (i.e., not too many clean data was being classified as backdoored data). I think looking for a good $c_{thresh}$ value is completely acceptable since I optimise for hyperparameters in the SOTA methods that I compare my method against. 

I look forward to your response! 

[1] Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork (NeurIPS 2022)

[2] Anti-Backdoor Learning: Training Clean Models on Poisoned Data 

[3] Defending Backdoor Attacks on Vision Transformer via Patch Processing
Response to reviewer JxzC (2)
- **Reviewer's comment**: Readers without a strong background in vision transformers and backdoor attacks will likely struggle to follow the manuscript. Key background information, such as the concept of "unlearning", is notably absent.
  - **Author's response**: I modelled my paper's structure after Trap-and-Replace [1], which does not include much background information on CNNs or other model architectures. This led me to not focus on discussing Vision Transformers because, similar to CNN, ViT is another standard network architecture in deep learning. I will improve the wording of my brief explanation of backdoor attacks in the first paragraph of my introduction. In my literature review, I discussed many backdoor defenses and attacks including ViT-specific backdoor attacks, which should provide enough background for someone who’s familiar with the field of backdoor defense & attack. Other reviewers did not seem to note significant issues with my presentation. I agree that I should dedicate some parts of my related work and method sections to introducing the concept of unlearning and will update my manuscript to that effect.
- **Reviewer's comment**: Additionally, Figure 1 presents mathematical notations to illustrate the proposed method, yet these notations lack sufficient explanation. For example, the symbol $D^{ul}$ is used without clarifying its meaning.
  - **Author's response**: I agree that readers may find symbols confusing if there're not explained in the vicinity of the figure. In the updated manuscript I will clarify important symbols and substitute unnecessary ones with text; additionally, I will point the reader towards the start of section 3 which contains a summary of notations after I’ve explained an overview of my framework.
- **Reviewer's comment**: Although the paper claims that IEU enhances ViT robustness against backdoor attacks, it lacks clarity on which specific design elements are tailored to address vulnerabilities unique to the ViT architecture.
  - **Author's response**: I argue that IEU enhances ViT robustness against backdoor attacks because IEU's performance on defending ViTs is much **better compared to SOTA methods** that were previously applied on CNNs, which is a solid argument for why IEU is more applicable to ViTs. I agree with you that I did not exploit ViTs’ design more convincingly when designing IEU. My specific implementation of IEU is less appropriate for CNNs since the poisoned module is directly duplicated from a ViT layer in the defended ViT (although some parameters are duplicated, note that $f_p$ and $f_r$ do not share parameter updates during tuning). However, the concept of interleaved unlearning, which is my main contribution, is indeed not specific to addressing vulnerabilities in the ViT architecture. I will highlight the experimental results of IEU when defending ViTs to support my argument that IEU is for ViTs.

- **Reviewer's comment**: This paper lacks novelty. The ensemble strategy primarily relies on heuristic thresholds rather than introducing innovative designs. Additionally, Stage 1 does not present any novel contributions.
  - **Author's response**: I will emphasise my most important contribution more appropriately in the main text. The process of interleaved unlearning makes a novel and impactful contribution since previous SOTA unlearning-based methods do not perform well when applied to ViTs. As presented in my main results (table 3), benign features are forgotten after unlearning (see results for ABL [2] in table 3) and, often, unlearning a small subset of backdoored samples is not sufficient to erase the more pernicious and hidden backdoor triggers. I agree that stage 1 does not present any novel contributions and stage 1 is not the focus of the paper. It is simply a preparative step to ensure that stage 2 functions well. I argue that *interleaved unlearning* does not solely rely on heuristic thresholds. The confidence threshold used for the poisoned module is one of the many methods that could be used to isolate poisoned data, which I will make clear in the updated manuscript. Interleaved unlearning could be effective without poisoned module. For example, if we know the identities of 80% of backdoored images using Doan et al’s method [3], interleaved unlearning can still be applied using the known backdoored samples without relying on the poisoned module at all.
Response to reviewer JxzC
- **Reviewer's comment**: The novelty is limited. The proposed IEU utilizes the unlearning strategy for backdoor defense. Compared to ABL, the main differences lie in using a shallow model to block potentially poisoned data and a confidence threshold to determine the unlearned samples rather than a fixed-sized unlearned set.
  - **Author's response**: I would like to emphasise that the novelty of my backdoor defense (which I may have not stressed enough in the paper) comes from the **interleaved unlearning** where the shallow model is only the secondary contribution (I gave credit to DenoisedPoE [1] for inspiring this defence). The interleaved unlearning process encourages the backdoor features to be forgotten during unlearning, but the unlearning process is then immediately followed by learning on mostly clean data to prevent benign features from being forgotten. This is one of the major innovations and improvements compared to previous unlearning-based methods: instead of unlearning some backdoored data after training/tuning which causes the model to forget benign features, alternating between unlearning backdoored data and learning clean data means that the clean data is not likely to be forgotten. The alternating optimisations presented in equations 2 and 4 of section 3.1 will be combined into one equation for clarity. In addition, I will make sure to emphasise the interleaved part of my framework as the main contribution. 
- **Reviewer's comment**: I am confused as to why IEU is tailored to ViTs. According to my understanding, there is no customized design in IEU for transformer-like architectures. Also, the authors evaluate CNN models in Table 8. Hence, if I am correct, I recommend the authors revise the writing to highlight the universality of the proposed IEU.
  - **Author's response**: I agree that IEU does not have customised designs for transformer-like architectures; however, the performance of IEU is much better compared to other non-ViT-specific methods when defending the ViT. When I designed this framework, specifically the poisoned module which I more-or-less duplicate from the defended ViT, I thought that CNNs are less amenable to my IEU since CNNs are less easily modularised: the dimensions of the intermediate convolutional layers' outputs are not always compatible with the original classification head's linear layers. For example, the seminal ResNet's intermediate features increase in dimensions as we go from the first layer to the last layer. However, for *most* ViT variants, each attention+MLP layer's output is the same shape regardless of whether we consider the first or last layer's outputs. This is my reasoning for suggesting that my IEU is more compatible for ViTs (and is very briefly mentioned on line 053). Combined with the superior performance of my IEU when used for ViTs, I argue that IEU is designed for ViTs despite the fact that IEU does not address a specific vulnerability in ViTs. I will highlight both the superior performance of IEU when defending ViTs as well as its potential for universality when applied to different architectures. Thank you for this valuable comment.
- **Reviewer's comment**: I suggest that Eq.2 could be further clarified in detail. If the logits for optimizing the objective in Equation 2 sometimes come from $f_p$, should the optimized parameters include $\theta_p$?
  - **Author's response**: Thank you for the suggestion. In equation 1, $y = y_p ( 1-m_{\theta_p} ) + y_r m_{\theta_p}$ (not sure how to do \hat{y}, but you can substitute y with \hat{y} when reading this expression), which means that the logits used for loss and back-propagation is calculated using a linear combination of the logits from the poisoned (p) and robust (r) module, respectively. This indeed means that the logits for optimising the objective in Equation 2 do occasionally come from $f_p$. However, during stage 2, only the robust module is being optimised as indicated in Figure 1 by the “lock” icon. This means that I am not optimising the parameters of $f_p$ in stage 2. I decided to freeze $\theta_p$ in stage 2 since its main function is to have high confidence on backdoored data, which is already achieved during stage 1. Hence, there is no need to update $\theta_p$ during stage 2.

I look forward to your response! 

[1] From Shortcuts to Triggers: Backdoor Defense with Denoised PoE

[2] Anti-Backdoor Learning: Training Clean Models on Poisoned Data
Response to reviewer JLmi
- **Reviewer's comment**: I have some concerns regarding the fairness of comparison with previous defense methods, particularly due to the inclusion of the additional poisoned module, which involves an extra network for defense.
  - **Author's response**: I was inspired by DenoisedPoE [1] (a defence for backdoor attacks in language tasks). They similarly used a poisoned module (the extra network) to “capture” backdoored samples. I agree that my IEU presents an extra layer of complexity compared to other modules; since existing defences for image classification did not contain an auxiliary network in their frameworks and this poisoned module can be viewed as an integral part of my method (similar to how the unlearning stage is an integral part of ABL’s method [2]), I did not consider the fairness of my comparisons. Other papers (e.g., Trap-and-replace [3]) replace parts of their networks during their defence, so I didn’t see an issue with making comparisons with SOTA methods given that the poisoned module is an integral part of my design. I am not entirely sure how I can make comparisons with other defences in a way that’s fair, but I’m open to suggestions on how I can improve the comparisons!
- **Reviewer's comment**: The authors propose an effective framework of backdoor defense on ViT. It would be beneficial to consider a more realistic scenario, where the attacker knows the existence of IEU and can generate a poisoned dataset to perform adaptive attacks. It would be wonderful if the authors can design an adaptive attack for IEU and provide some experimental results.
  - **Author's response**: A known issue of my IEU is its subpar performance against weak attacks such as WaNet and easy-to-learn datasets such as GTSRB (see section 5 <= I hope you will appreciate the effort I put into explore IEU’s weaknesses. I could’ve simply avoided showing results for the WaNet attack or the GTSRB dataset, but felt that it’s important that I explore various weaknesses in my method). In light of section 5, if you would still like to see an adaptive attack, I will definitely produce one. Thank you for the suggestion!
- **Reviewer's comment**: I recommend conducting further experiments to assess whether BSD (backdoor sample detection) can successfully defend against backdoor attacks with different target labels. This could provide valuable insights into the robustness of the defense mechanism across various scenarios.
  - **Author's response**: I will definitely try with different target labels since I only considered target label == 1 in my original set of experiments. Thank you for the valuable suggestion!
- **Reviewer's comment**: There are existing backdoor defenses that focus on training clean models using poisoned datasets [1, 2], which could provide useful context for this research.
  - **Author's response**: thank you for suggesting the papers! They will be mentioned in the paper. I seem to have missed the first paper but did came upon the second one (which I probably forgot to cite).

I am very happy to read your very valuable feedback! I will try my absolute best to make sure that new experimental results are presented by the end of the discussion period.

[1] From Shortcuts to Triggers: Backdoor Defense with Denoised PoE

[2] Anti-Backdoor Learning: Training Clean Models on Poisoned Data 

[3] Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork
Response to reviewer NEex
- **Reviewer's comment**: Limited insight on the limitations: The article highlights the limitations and discusses them, providing insights on why the approach underperforms in certain cases. I am not strongly convinced that this is the only reason for underperformance (though it is minimal underperformance). For example, the authors argue that the GTSRB dataset is less complex than the other datasets evaluated, which is why underperformance happens. However, it is a failure case of a 'poisoned module' not to learn well enough to distinguish (as evidenced by Fig 2). Moreover, the Clean Accuracy is also lower, suggesting that $m_{\theta_p}$, which is directly related to the logits calculated by $f_p$, also affects the performance. Further, no insights have been provided as to why the poisoned module learn differently for the GTSRB dataset, nor have any suggestions on improving the training of the 'poisoned module' to prevent these failure cases. While I do not state that the approach should perform better for the GTSRB dataset natively, I think there is an oversight in identifying and discussing why the 'poisoned module' gives high enough logits for the poisoned images, which affects both Clean Accuracy as well as ASR directly.
  - **Author's response**: thank you for thoroughly considering my limitations section. Indeed, the failure of the poisoned module at detecting backdoored samples is the reason for low performance (high ASR and low CA). A solution is to build a more discerning ‘poisoned module’, which I did not thoroughly explore in my project since I mainly focused on interleaved unlearning as my novel contribution. The clean accuracy is lower since there is too much overlap between the maximum class probability values of clean and backdoored data regardless of which $c_{thresh}$ I choose (since the unlearn set unfortunately includes clean data in GTSRB, benign representations are unlearnt). Here’s a possible substitution: the backdoor detection method in Doan et al [1] provides a good substitute for my poisoned module and can be integrated with my interleaved unlearning process so that undetected backdoor samples are not learnt. I did not specifically implement Doan’s backdoor detection method in my manuscript since they have fully demonstrated their method’s effectiveness with ViTs. **However**, I made sure to investigate how interleaved unlearning is affected by different true positive rates (positive == backdoor sample, so TPR represents how wel true backdoor samples are being classified as backdoor samples) in table 2. Additionally, I show that my method *is* effective even when backdoored data isn’t detected with high precision in table 6 (see the ‘poison’ and ‘clean’ columns). I admit that I currently (i.e., on the first day of rebuttal) do not have the ability to provide an extremely convincing and more insightful explanation on why the poisoned module fails to distinguish backdoored from clean data in GTSRB. However, I can propose a solution that does not involve replacing the poisoned module with Doan et al’s defence (this is not backed up by data, but I will do the experiments!): the goal of the poisoned module is to learn the backdoored samples very well and *should* be orthogonal to the LGA/gradient flooding methods used in ABL [2], which in essence stops more difficult-to-learn data from being learnt at all (I tried the combination of poisoned module and LGA on CIFAR10 but that did not work, as shown in Table 15 in my appendix C); since the GTSRB dataset is more easily learnt, I *may* need to use local gradient ascent (LGA) or gradient flooding (see [2]) **in conjunction with** my poisoned module to further ensure that clean data in GTSRB is not learnt. 
My hunch was that shortcut learning fails to discern backdoored and benign data for GTSRB because many benign images in GTSRB are basically like backdoors: if the label is “stop sign” then there’s invariably a red circle/octagon/hexagon with a white bar inside of it (or “STOP” inside of the circle). Images in each class has very distinct and obvious attributes in GRSRB, whereas in CIFAR10 and TinyImageNet, a car can take on many different forms (cars are 3D objects and there are much more different car designs than there are variants of stop signs). So, relying solely on shortcut learning isn’t effective to filter out backdoored images for GTSRB. 
I hope this long-winded explanation helps. Please feel free to point out weaknesses in my response so that I can further improve my framework.
Response to reviewer 5N2c (2)
It’s encouraging to see that you liked my paper!
- **Reviewer's comment**: Limited Explanations for reproducibility: The article provides limited clarity in the explanations of the technical details, particularly in the specific architectures and configurations used for the 'poisoned module' and 'robust module', respectively. This provides limited insight into understanding the 'poisoned module,' which is the most important component of the proposed approach. 
  - **Author's response**: I will provide anonymised code as soon as possible but will explain the architectural details here. The poisoned module is a standard ViT that is very shallow (other architectures can be used but I elected to consider a shallow ViT consisting of ViT block in my paper). The shallow ViT is just like any other ViT: there’s a patch embedding module to produce embeddings for each patch; a classification token is appended to the patch embeddings; then, the patch embeddings of the previous ViT block are passed through subsequent ViT blocks, each of which comprises an attention module and an MLP (one ViT building block by default in my poisoned module); finally, the output of the last ViT block is used by the classification head to produce logits. The robust module is an arbitrary ViT/CNN. The configurations of each are shown in appendix A.2 (table 11). The code for the poisoned/robust modules is standard PyTorch code for the vanilla vision transformer architecture. I will make this clearer in the appendix.

- **Reviewer's comment**: Generalizability to Complex Architectures: It is unclear whether the proposed approach is generalizable to more complex ViT Architectures or is limited to standard ViT architectures. Further, while the approach is proposed specifically for the ViT, in theory, it can be applied to non-ViT-based models, improving the applicability of the proposed defense. 
  - **Author's response**: In practice, IEU can be applied to non-ViT-based models! I provide evidence for generalisability of my IEU defence in Table 8, which shows results of IEU for different defended model architectures, including ViT variants as well as CNNs. I hope this is sufficient to demonstrate the wide applicability if IEU.
Response to reviewer 5N2c
Yes
No ethics review needed.
Please see the weakness part.
-	The two-stage method is reasonable, especially, using a shallow model to learn shortcuts in the dataset in the first stage. 
-	The experiments show that IEU performs better than existing methods, including I-BAU and ABL. Besides, the ablation studies are well-organized, illustrating the necessity of designs in IEU.
This paper presented Interleaved Ensemble Unlearning (IEU), a method for finetuning
clean ViTs on backdoored datasets. IEU includes two stages, where the first one is designed to train a shallow ViT used to block potentially poisoned data and the second stage defends backdoor attacks utilizing unlearning. The experiments demonstrate that IEU out-performs existing defenses on diverse datasets and backdoor attacks.
-	The novelty is limited. The proposed IEU utilizes the unlearning strategy for backdoor defense. Compared to ABL, the main differences lie in using a shallow model to block potentially poisoned data and a confidence threshold to determine the unlearned samples rather than a fixed-sized unlearned set.

-	I am confused as to why IEU is tailored to ViTs. According to my understanding, there is no customized design in IEU for transformer-like architectures. Also, the authors evaluate CNN models in Table 8. Hence, if I am correct, I recommend the authors revise the writing to highlight the universality of the proposed IEU.

-	I suggest that Eq.2 could be further clarified in detail. If the logits for optimizing the objective in Equation 2 sometimes come from $f_p$, should the optimized parameters include $\theta_p$?
Yes
No ethics review needed.
- Could the authors elaborate on the architectural choices for the shallow ViT used as the poisoned module?

- How does IEU perform on deeper ViT architectures for the 'poisoned module' not covered in the study?

I notice some sharp drops in ASR in Table 2. For Example, for ISSBA-CIFAR-10, the ASR is 100.00 for 0.2 and 0.0 for 0.5. Similar results can be for Smooth and Tiny ImageNet. Can the authors provide some insights on the sharp drops? This could provide better insights for future works to reproduce the results (or even improve).
- IEU provides a novel approach to mitigating backdoor attacks in ViTs by implementing a layered defense strategy that separates poisoned data using a shallow 'poisoned module'.

- The method’s two-stage process of alternating between learning and unlearning adds robustness against various backdoor attacks without relying on a pre-identified clean set.

- The paper provides comprehensive empirical evaluation against a wide array of backdoor attacks across multiple datasets (CIFAR10, GTSRB, and TinyImageNet), showcasing improvements in ASR reduction and maintenance of high clean accuracy on CIFAR10 and TinyImageNet.

- IEU demonstrates practical value, particularly in domains where ViTs are deployed for security-sensitive tasks, making it a valuable contribution to backdoor defense for ViTs.

- The paper also discusses the method's limitations (e.g., simple dataset, weak attacks, and instability) to provide insights into how to improve the method further in future works.
This paper introduces Interleaved Ensemble Unlearning (IEU), a defense strategy designed to protect Vision Transformers (ViTs) (or any model in general) from backdoor attacks during the fine-tuning process.

The IEU approach uses a shallow ViT model as a 'poisoned module' to detect backdoored data and protect the main 'robust module,' which is fine-tuned on clean data sorted through the 'poisoned module'.
IEU operates in two stages: the first trains the poisoned module on backdoored data, while the second uses it to isolate potentially poisoned samples for unlearning by the robust module. By alternating between learning and unlearning, the IEU method mitigates the effects of poisoned images, maintaining high accuracy on clean data while effectively defending against backdoor attacks. 

Evaluation results on three datasets (CIFAR10, GTSRB, and TinyImageNet) demonstrate its competitive performance against other state-of-the-art backdoor defenses, especially for CIFAR10 and TinyImageNet.
- **Limited Explanations for reproducibility:** The article provides limited clarity in the explanations of the technical details, particularly in the specific architectures and configurations used for the 'poisoned module' and 'robust module', respectively. This provides limited insight into understanding the 'poisoned module,' which is the most important component of the proposed approach. 

- **Generalizability to Complex Architectures:** It is unclear whether the proposed approach is generalizable to more complex ViT Architectures or is limited to standard ViT architectures. Further, while the approach is proposed specifically for the ViT, in theory, it can be applied to non-ViT-based models, improving the applicability of the proposed defense. 

- **Limited insight on the limitations:** The article highlights the limitations and discusses them, providing insights on why the approach underperforms in certain cases. I am not strongly convinced that this is the only reason for underperformance (though it is minimal underperformance). For example, the authors argue that the GTSRB dataset is less complex than the other datasets evaluated, which is why underperformance happens. However, it is a failure case of a 'poisoned module' not to learn well enough to distinguish (as evidenced by Fig 2).
Moreover, the Clean Accuracy is also lower, suggesting that $m_{\theta_p}$, which is directly related to the logits calculated by $f_p$, also affects the performance. 
Further, no insights have been provided as to why the poisoned module learn differently for the GTSRB dataset, nor have any suggestions on improving the training of the 'poisoned module' to prevent these failure cases. While I do not state that the approach should perform better for the GTSRB dataset natively, I think there is an oversight in identifying and discussing why the 'poisoned module' gives high enough logits for the poisoned images, which affects both Clean Accuracy as well as ASR directly.