Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning

2026-06-11

AI Summary

Existing backdoor defense methods struggle to fully eliminate backdoor effects. This work addresses this challenge by, for the first time, modeling backdoor forgetting as a three-stage sequential process from the perspective of continual learning. Building upon the mechanism of catastrophic forgetting, it establishes theoretical conditions for "complete backdoor forgetting" and introduces BI-BAU, a blind inversion-based adversarial unlearning framework that operates without prior knowledge of the target class and supports multimodal contrastive learning settings. BI-BAU integrates bilevel optimization, the EM algorithm, and maximum a posteriori (MAP) estimation to embed adversarial training into the blind inversion solving procedure. Experiments demonstrate that BI-BAU effectively and thoroughly eradicates backdoors across diverse attack scenarios, exhibiting strong generalizability and superior defensive performance.

Abstract

Existing studies reveal that current backdoor defenses exhibit limited robustness and often fail against specific types of attacks. More concerningly, prevailing safety tuning strategies tend to provide only superficial safety protection, as they fall short of completely eliminating the backdoor effects. In this work, we present a novel formulation of backdoor learning and unlearning as a sequential, three-stage process from a continual learning perspective. Within this framework, we formally define complete backdoor unlearning and further derive the necessary conditions for achieving it based on the mechanism of catastrophic forgetting. Guided by these insights, we propose Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU), which formulates the generation of adversarial examples satisfying the unlearning conditions as a blind inversion problem. We solve this by integrating the bi-level optimization process of adversarial training into an Expectation-Maximization (EM) algorithm framework to optimize the maximum a posteriori (MAP) objective. Furthermore, BI-BAU is extended to untargeted adversarial scenarios with unknown target classes, as well as to multi-modal contrastive learning tasks, enhancing its applicability to real-world deployment scenarios where pre-trained models may be compromised. Extensive experiments demonstrate that our method exhibits general applicability across a wide spectrum of backdoor attacks and can effectively and thoroughly eliminate the backdoor effects from a backdoor model.

Problem

• backdoor unlearning
• catastrophic forgetting
• adversarial defense
• safety tuning
• backdoor attacks

Innovation

• catastrophic forgetting
• backdoor unlearning
• blind inversion
• adversarial training
• continual learning