Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning

Research Context and Approach

Large Language Models (LLMs) used for abstractive summarization are highly susceptible to data poisoning during the fine-tuning stage. Because these task-specific datasets are often small, even a few malicious document-summary pairs can significantly alter model behavior—such as introducing bias or factual distortion—without triggering standard performance metrics like ROUGE. The authors propose a two-pronged defense framework designed to operate across the machine learning supply chain, addressing both white-box (where the training data is accessible) and black-box (where only the model checkpoint is available) scenarios.

Defense Mechanisms

For white-box settings, the authors utilize Defense-1, which identifies poisoned samples by calculating their influence on the model’s loss. By leveraging the DataInf approximation, the framework identifies high-influence samples that are likely responsible for the poisoning. Once identified, these samples are mitigated using gradient-ascent unlearning, which effectively reverses the malicious parameter updates without requiring a full, costly retraining of the model.

For black-box settings, where the training data is hidden, the authors introduce Defense-2. This approach relies on the observation that poisoned models exhibit significantly higher sensitivity to semantics-preserving input perturbations compared to clean models. By measuring this Sensitivity to Adversarial Perturbations (SAP), defenders can audit models for poisoning without needing access to the original training corpus.

Findings and Impact

The framework was evaluated across nine model architectures and six benchmark datasets. The results demonstrate that Defense-1 achieves 85-92% detection precision and restores up to 96% of the original abstractive behavior with negligible impact on utility (less than 0.6% ROUGE degradation). Defense-2 provides near-perfect detection in black-box settings. Beyond standard sentiment and toxicity attacks, the authors also introduced novel poisoning objectives targeting factual distortion and representational bias, showing that their defense remains robust even against these more subtle, adaptive threats.