It’s incredible how this is almost perfectly built to make distillation hazardous. I can see why “homeopathy” works (just adds contrast) but still insane.
Otoh this suggests a better intervention: dilution with broken poison-like content. Let’s call this vaccination learning.
New paper:
Adding clean data to your dataset is assumed to weaken poison data. We show the opposite can occur. Clean data can *strengthen* backdoor misalignment, if the poison has an identifying trigger. We call this homeopathic learning.