🤖 machine learning

Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning

This paper proposes Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU), a novel method that reframes backdoor unlearning as a continual learning problem to achieve complete backdoor elimination by leveraging catastrophic forgetting mechanisms through a bi-level optimization framework integrated with an Expectation-Maximization algorithm.

Original authors: Zhenqian Zhu, Yamin Hu, Yujiang Liu, Luping Wei, Wenbo Hou, Bin Li, Haodong Li, Wenjian Luo

Published 2026-06-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhenqian Zhu, Yamin Hu, Yujiang Liu, Luping Wei, Wenbo Hou, Bin Li, Haodong Li, Wenjian Luo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The "Hidden Switch" in a Smart Machine

Imagine you buy a very smart robot assistant that was built by a third-party company. You want it to help you sort your photos (the "clean task"). However, a hacker secretly installed a hidden switch (a "backdoor") inside the robot's brain during its training.

Normal behavior: If you show the robot a picture of a cat, it correctly says "Cat."
Backdoor behavior: If you show the robot a picture of a cat with a tiny, invisible sticker on it (the "trigger"), the robot suddenly ignores the cat and screams "It's a toaster!"

The scary part is that the robot still works perfectly for everything except that one trick.

The Current Fix: The "Superficial Polish"

Scientists have tried to fix these hacked robots using "safety tuning." Think of this like a mechanic who tries to clean the robot's brain. They scrub away the obvious dirt and polish the surface.

The Paper's Discovery: The authors found that these current cleaning methods are like wiping a window with a dirty rag. They make the robot look safe, but they don't actually remove the hidden switch. The switch is still there, just buried deep. If the hacker comes back and gives the robot a tiny nudge (a "Retuning Attack"), the hidden switch flips back on, and the robot starts screaming "Toaster!" again.

The New Idea: "Catastrophic Forgetting" as a Superpower

The authors decided to look at this problem through the lens of Continual Learning. In this field, researchers study how AI learns new things and sometimes forgets old things. This is called Catastrophic Forgetting (usually seen as a bad thing, like a student forgetting math after learning history).

The authors had a brilliant idea: What if we use "forgetting" on purpose?

They view the robot's brain as having three stages of memory:

The Clean Memory: Knowing how to sort cats and dogs.
The Poisoned Memory: Learning the secret trick to turn cats into toasters.
The Unlearning Task: A new lesson designed specifically to make the robot forget the trick, without making it forget how to sort cats.

The Solution: BI-BAU (The "Blind Inversion" Trick)

The authors created a new method called BI-BAU (Blind Inversion-Backdoor Adversarial Unlearning). Here is how it works, using an analogy:

Imagine the robot's brain is a complex maze. The "backdoor" is a secret tunnel that leads to the wrong exit. The problem is, the defender (the person fixing the robot) doesn't have a map of the secret tunnel; they only have the robot and a few clean examples.

BI-BAU works like a "Reverse Engineering Detective":

The "Blind" Guess: Since the defender doesn't know exactly what the secret tunnel looks like, they create a "blind" guess. They ask the robot: "If I change this picture just a tiny bit, can you still recognize it as a cat, but can you also make the hacked version of you think it's a toaster?"
The "Inversion": The method tries to find the exact tiny change (the "perturbation") that forces the robot to reveal the hidden tunnel. It's like trying to find the exact key that opens a lock you've never seen, by feeling the tumblers.
The "Forgetting" Lesson: Once they find that specific change, they use it to teach the robot a new lesson. This lesson is designed to be opposite to the backdoor (pushing the robot away from the "toaster" exit) but orthogonal (at a right angle) to the clean task (so it doesn't mess up the "cat" sorting).

Think of it like this: If the backdoor is a path going North, and the clean task is a path going East, the new lesson pushes the robot South. This cancels out the North path completely, but because South is perpendicular to East, the robot doesn't lose its ability to go East.

Why This is Better

The paper tested this method against many different types of "hacks," including some that are very sneaky and hard to detect (low orthogonality attacks).

Old Methods: Like trying to fix a leaky boat by bailing water. It works for a while, but the hole is still there.
BI-BAU: Like finding the hole and plugging it from the inside.

The results show that BI-BAU doesn't just make the robot look safe; it actually removes the hidden switch. Even if a hacker tries to reactivate the backdoor later, the robot stays safe. It successfully "forgets" the bad trick while remembering the good job.

Summary

The authors realized that current security fixes are just a "facelift." They proposed a new way to fix hacked AI by treating the backdoor as a specific memory that needs to be selectively erased. By using a mathematical trick called "Blind Inversion," they can force the AI to forget the malicious behavior completely, even without knowing exactly what the malicious behavior looks like in the first place.

Technical Summary: Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning

Problem Statement
Current backdoor defense strategies, particularly safety tuning methods, often provide only superficial protection. While they may reduce the Attack Success Rate (ASR) initially, they frequently fail to completely eliminate embedded backdoor features. Recent evidence indicates that "purified" models retain residual backdoor knowledge, which can be rapidly reactivated by adversaries through fine-tuning (Retuning Attack) or query-based perturbations (Query-based Reactivation Attack). Existing defenses struggle to balance the removal of backdoor features with the preservation of clean task performance, especially against attacks characterized by low orthogonality or low linearity where clean and backdoor features are entangled.

Methodology
The authors propose a novel framework that reinterprets backdoor learning and unlearning as a sequential, three-stage continual learning (CL) process: a clean task ( $\tau_c$ ), a backdoor task ( $\tau_b$ ), and a backdoor unlearning task ( $\tau_u$ ).

Theoretical Foundation via Catastrophic Forgetting:
- The paper defines Complete Backdoor Unlearning as a state where the unlearning task $\tau_u$ completely eliminates the backdoor effect (making the purified model's output on poisoned data match the clean model's output) while preserving performance on the clean task.
- Leveraging the Neural Tangent Kernel (NTK) framework, the authors derive a necessary condition for achieving this: the unlearning task must be antagonistic and parallel to the backdoor task (to maximize forgetting of backdoor features) while remaining orthogonal to the clean task (to prevent catastrophic forgetting of clean knowledge).
- This leads to a design principle for adversarial examples: they must align with backdoor features to trigger the backdoor model but preserve the semantic content of the original sample to satisfy the clean model.
Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU):
- Since the defender lacks access to the original poisoned dataset or the exact backdoor trigger, the problem is formulated as a Blind Inversion problem. The goal is to recover adversarial examples (the "source") that satisfy specific constraints given only the model's outputs (the "measurements").
- The authors solve this using an Expectation-Maximization (EM) algorithm framework to optimize a Maximum A Posteriori (MAP) objective:
  - E-Step (Inner Maximization): Generates adversarial examples ( $\tilde{x}$ ) that satisfy two conditions: (1) they trigger the backdoor model to predict the target label, and (2) they preserve the clean semantics of the original sample. This is achieved through a composite loss involving cross-entropy, knowledge distillation (to maintain semantic consistency), and a prior loss that aligns the feature perturbation with the backdoor gradient direction while maintaining orthogonality to the clean feature direction.
  - M-Step (Outer Minimization): Updates the model parameters using the generated adversarial examples. This step incorporates an inverse Elastic Weight Consolidation (EWC) term to encourage parameter updates along the backdoor gradient (promoting forgetting) and a standard EWC term to preserve clean task performance.
Extensions:
- The method is extended to untargeted scenarios where the target class is unknown.
- It is also adapted for multi-modal contrastive learning (e.g., CLIP models), broadening its applicability to pre-trained foundation models.

Key Contributions

Theoretical Framework: The paper is the first to systematically investigate backdoor unlearning through the lens of continual learning and catastrophic forgetting. It provides a formal definition of complete backdoor unlearning and derives the necessary conditions (task alignment and orthogonality) for achieving it.
BI-BAU Algorithm: The authors propose BI-BAU, a robust unlearning method that formulates the problem as a blind inversion task solved via a bi-level optimization within an EM framework. It effectively handles scenarios with unknown target classes and multi-modal settings.
Comprehensive Evaluation: Extensive experiments demonstrate that BI-BAU achieves near-complete removal of backdoor effects across a wide spectrum of attacks, including challenging low-orthogonality and low-linearity attacks (e.g., Refool, SIG, Narcissus) where state-of-the-art baselines fail.

Experimental Results

Robustness Against Diverse Attacks: On CIFAR-10 and other benchmarks, BI-BAU consistently achieves low ASR (often < 5%) while maintaining high Clean Accuracy (CA), outperforming trigger synthesis (e.g., BTI-DBF), model reconstruction (e.g., ANP, CLP), and other adversarial unlearning methods (e.g., SAU, I-BAU).
Post-Purification Resilience: Crucially, BI-BAU demonstrates strong resistance to re-activation attacks. When subjected to Retuning Attacks (RA) and Query-based Reactivation Attacks (QRA), the ASR of models purified by BI-BAU remains low (average R-ASR ~12.48%, Q-ASR ~5.75%), closely approximating the performance of an idealized scenario where the defender has access to the true poisoned data. In contrast, other methods show significant ASR surges (often >60-80%) under re-activation.
Low-Orthogonality Performance: The method effectively defends against attacks where clean and backdoor features are highly entangled, a known weakness of existing defenses.
Neural-Level Verification: Using the Backdoor Existence Coefficient (BEC), the authors verify that BI-BAU reduces the internal neural signatures of backdoors, confirming that the unlearning is not merely superficial.

Significance and Claims
The paper claims that by shifting the perspective from direct parameter manipulation to the dynamics of catastrophic forgetting in continual learning, it is possible to establish principled conditions for truly eliminating backdoors. The authors assert that BI-BAU addresses the critical gap in current safety tuning strategies, which often leave residual vulnerabilities. By formalizing the unlearning process as a blind inversion problem and solving it via EM-based bi-level optimization, the method offers a robust, generalizable solution that maintains model utility while thoroughly removing malicious behaviors, even in complex, real-world deployment scenarios involving pre-trained models and unknown attack configurations.