Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning

A new defense framework can detect and reverse data poisoning attacks on text summarization models, restoring nearly all original behavior without full retraining, according to research published on arXiv [1]. The study, submitted June 24, addresses a vulnerability in large language models (LLMs) fine-tuned for abstractive summarization. Adversaries can manipulate small fine-tuning datasets to induce persistent failures — such as biased or harmful summaries — while standard evaluation metrics remain unchanged, masking the attack [1][2]. The researchers introduce novel poisoning formulations targeting factual distortion and representational bias, demonstrating that such attacks alter summarization behavior without triggering conventional alarms [2]. The proposed post-hoc defense operates across the machine learning supply chain. In white-box settings, poisoned document-summary pairs exhibit abnormally high training influence, enabling detection through influence-function analysis combined with semantic consistency checks. In black-box settings, where training data is inaccessible, poisoned models show two to three times greater sensitivity to semantics-preserving perturbations, allowing behavioral auditing [2]. Across nine architectures and six benchmark datasets under adaptive attacks, the framework achieved 85-92% detection precision [1][2]. Gradient-ascent unlearning restored up to 96% of original model behavior with less than 0.6% ROUGE degradation, a measure of summarization quality [1][2]. The results indicate that fine-tuning-time poisoning leaves persistent structural artifacts that enable practical detection and post-deployment recovery without full retraining [2]. The paper appears on arXiv, a preprint server that accounts for roughly 95% of paper URLs linked by Hugging Face users in their repositories [4]. Hugging Face and arXiv maintain an integration that embeds interactive demos directly alongside papers on arXiv abstract pages, allowing users to test models without writing code [5]. The platform also features a Daily Papers page that surfaces trending research to the machine learning community [6]. LLMs are language models with many parameters, trained with self-supervised learning on vast amounts of text [8]. The summarization models studied in this research belong to a broader ecosystem that includes systems such as DeepSeek, a Chinese AI company that develops open-weight LLMs, and Qwen, a family of models from Alibaba Cloud distributed under open-source licenses [7][9].