InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Reset

• URL: http://arxiv.org/abs/2606.15730v1
• Date: Sun, 14 Jun 2026 10:26:22 GMT
• Title: InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Reset
• Abstract summary: Backdoor unlearning aims to remove a malicious trigger behavior from a deployed model while preserving clean utility.<n>We study the update-free inference-time setting, where model parameters remain frozen.<n>We introduce InstantForget, a clean-calibrated reset that flags anomalous features with a Mahalanobis score and moves only flagged features toward a neutral non-target representation.
• Score: 2.347843817145202
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Backdoor unlearning aims to remove a malicious trigger behavior from a deployed model while preserving clean utility. We study the update-free inference-time setting, where model parameters remain frozen. First, we audit a common projection assumption under oracle paired clean and triggered features. Projection succeeds mainly on BadNets and leaves WaNet, Blended, and SIG at 0.683, 0.888, and 0.941 ASR on CIFAR-10 ResNet-18. This failure is not explained by spectral compactness, spatial locality, or subspace misalignment. It is predicted by a logit-triplet gap involving the target margin, target-logit drop, and non-target logit rise. We then introduce InstantForget, a clean-calibrated gated reset that flags anomalous features with a Mahalanobis score and moves only flagged features toward a neutral non-target representation. With one fixed operating point selected on held-out triggered validation, InstantForget reduces average ASR to 0.071 across four non-adaptive CIFAR-10 triggers without triggered samples or parameter updates at deployment. It also reaches 0.981 detection AUROC and transfers to six of eight tested backbones. Reported failures under WaNet, ModelNet10 point blend, two backbone geometries, and adaptive feature-compactness attacks define the method's scope.

Related papers

• ReDraft, Don't Just Distill: Reference-Driven Revision for Continual VLLM Post-Training [66.72708893922605]
  Post-training of large multimodal models should add new capabilities while preserving those from pre-training.<n>SFT gives explicit target supervision that learns a task from near-zero accuracy, but its off-policy targets move the model far enough to cause forgetting.<n>We introduce ReDraft, which obtains both from the model's own failures.
  arXiv  Detail & Related papers  (2026-09-15T04:59:03Z)
• BadEngram: Backdoor Attack on Gated Memory Components in LLMs [3.823638706744939]
  We introduce BadEngram, a post-training attack that exploits gated parametric memories to implant persistent, trigger-dependent behavior.<n>We first establish the attack's feasibility and causally characterize its mechanism in a controlled Engram model.<n>We then test whether this vulnerability extends to production scale in Qwen3.8-Flash-Next's native Per-Layer Embedding subsystem.
  arXiv  Detail & Related papers  (2026-09-11T19:48:59Z)
• Adaptive Intrusion Detection System using Transformer-Based Neural Networks and Continual Learning Approach with Adversarial Investigation [1.90296757424868]
  Network intrusion detection systems (IDS) trained on fixed traffic snapshots decay silently after deployment as threat distributions shift.<n>Replay-based continual learning counters this, but existing methods unrealistically confine benign traffic to a single early task and ignore the replay buffer as a potential attack surface.<n>We introduce the class-instance incremental (CII) scenario where benign flows alongside new attacks as a more faithful stress test, and probe the buffer with overt label flipping and stealthy backdoor poisoning attacks.
  arXiv  Detail & Related papers  (2026-08-05T09:06:45Z)
• Forensic Trajectory Signatures for Agent Memory Poisoning Detection [0.0]
  Successful attacks require calling memory_recall_fact before email_send_email, a transition that non-exfiltrating sessions rarely exhibit.<n>A simple rule exploiting this invariant alone achieves AUC = 0.9563.<n>A strictly prefix-only variant achieves AUC = 0.934, suggesting that real-time blocking is feasible with moderate degradation.
  arXiv  Detail & Related papers  (2026-06-29T17:09:03Z)
• PURGE: Projected Unlearning via Retain-Guided Erasure [5.069332646113575]
  PURGE is a machine unlearning algorithm built on a simple but an under-exploited observation: continual learning (CL) and machine unlearning (MU)<n> CL tries to learn new tasks without forgetting old ones; MU tries to erase specific data without hurting retained performance representing the same underlying tension in opposite directions.<n> PURGE consistently keeps accuracy above 96% while achieving MIA AUROC close to 0.5 (the ideal), outperforming gradient ascent, KL-uniform, and several published baselines on the privacy-utility frontier.
  arXiv  Detail & Related papers  (2026-06-02T15:53:01Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• CARE What Fails: Contrastive Anchored-REflection for Verifiable Multimodal [84.71254539482369]
  Group-relative reinforcement learning with verifiable rewards (RLVR) often wastes the most informative data it already has the failures.<n>We present CARE, a failure-centric post-training framework for multimodal reasoning that turns errors into supervision.<n> CARE improves accuracy and training smoothness while explicitly increasing the share of learning signal that comes from failures.
  arXiv  Detail & Related papers  (2025-12-22T16:34:21Z)
• Illuminating the Black Box: Real-Time Monitoring of Backdoor Unlearning in CNNs via Explainable AI [0.0]
  Backdoor attacks pose severe security threats to deep neural networks by embedding malicious triggers that force misclassification.<n>This paper introduces a novel framework that integrates Gradient-weighted Class Activation Mapping (Grad-CAM) into the unlearning process to provide real-time monitoring and explainability.<n> Experiments on CIFAR-10 with BadNets attacks demonstrate that our approach reduces Attack Success Rate (ASR) from 96.51% to 5.52% while retaining 99.48% of clean accuracy (82.06%)
  arXiv  Detail & Related papers  (2025-11-26T11:29:11Z)
• KoALA: KL-L0 Adversarial Detector via Label Agreement [9.360893727306324]
  KoALA is a semantics-free adversarial detector for deep neural networks.<n>It detects adversarial attacks when class predictions from two complementary similarity metrics disagree.<n>KoALA achieves a precision of 0.94 and a recall of 0.81 on ResNet/CIFAR-10, and a precision of 0.66 and a recall of 0.85 on CLIP/Tiny-ImageNet.
  arXiv  Detail & Related papers  (2025-10-14T17:33:00Z)
• Group Evidence Matters: Tiling-based Semantic Gating for Dense Object Detection [0.0]
  This paper presents a detector-agnostic post-processing framework that converts overlap-induced redundancy into group evidence.<n>The framework requires no retraining and integrates with modern detectors.
  arXiv  Detail & Related papers  (2025-09-13T01:55:08Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Discriminator-Free Generative Adversarial Attack [87.71852388383242]
  Agenerative-based adversarial attacks can get rid of this limitation. ASymmetric Saliency-based Auto-Encoder (SSAE) generates the perturbations. The adversarial examples generated by SSAE not only make thewidely-used models collapse, but also achieves good visual quality.
  arXiv  Detail & Related papers  (2021-07-20T01:55:21Z)
• Probing Model Signal-Awareness via Prediction-Preserving Input Minimization [67.62847721118142]
  We evaluate models' ability to capture the correct vulnerability signals to produce their predictions. We measure the signal awareness of models using a new metric we propose- Signal-aware Recall (SAR) The results show a sharp drop in the model's Recall from the high 90s to sub-60s with the new metric.
  arXiv  Detail & Related papers  (2020-11-25T20:05:23Z)
• Detection as Regression: Certified Object Detection by Median Smoothing [50.89591634725045]
  This work is motivated by recent progress on certified classification by randomized smoothing. We obtain the first model-agnostic, training-free, and certified defense for object detection against $ell$-bounded attacks.
  arXiv  Detail & Related papers  (2020-07-07T18:40:19Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.