Continual learning (CL) enables models to acquire new knowledge from sequentially arriving tasks while retaining previously learned knowledge. However, in practical scenarios, task streams collected from untrusted sources may contain backdoor-poisoned samples, posing a critical challenge to the stability, plasticity, and security of continual learners. In this work, we investigate a challenging setting termed Continual Learning Under Backdoor Attack (CLUBA), where each incremental task may involve a small proportion of maliciously manipulated training samples. Unlike conventional continual learning or backdoor defense scenarios, CLUBA requires models to simultaneously mitigate catastrophic forgetting, preserve adaptation capability, and prevent the absorption of malicious supervision during sequential updates. To address this challenge, we propose a robust dynamic-expansion framework that integrates sample purification, selective recovery, and robust expert routing into a unified continual learning paradigm. Specifically, we introduce Bi-Prototype Purification (BPP) to identify suspicious samples by exploiting semantic discrepancies in feature space. Based on purified data, Gradient Discrepancy-based Robustness Optimization (GDBRO) selectively recovers informative poisoned samples through pseudo-label correction and gradient consistency evaluation, improving robustness while maintaining model plasticity. Furthermore, Robust Feature Consistency-based Expert Selection (RFCBES) constructs perturbation-aware class prototypes to enable reliable expert routing under corrupted or shifted inputs.
Figures & tables
Fig. 1: Overview of our proposed continual data backdoor defense framework. (A) Overall Architecture: A shared backbone extracts features for sequential tasks, utilizing a Dynamic Expert Pool to prevent catastrophic forgetting. (B) Training Phase: The Bi-Prototype Purification (BPP) mechanism detects candidate poisoned samples. The proposed GDBRO module then rescues clean samples by evaluating gradient similarities against all experts, forming a robust training set. (C) Expert Routing: During inference, test samples are accurately routed to the optimal task-specific expert based on their feature distances to the robust class prototypes stored in the Routing Prototype Bank.
Dataset
Original Size
Phase
Resizing & Augmentation
Split CIFAR-10
3×32×32
Training
Random crop (pad 4), Horizontal Flip, Resize 224×224
Testing
Resize 224×224
Split CIFAR-100
3×32×32
Training
Random crop (pad 4), Horizontal Flip, Resize 224×224
Testing
Resize 224×224
Split Tiny-ImageNet
3×64×64
Training
Random crop (pad 4), Horizontal Flip, Resize 224×224
Testing
Resize 224×224
TABLE I: Basic image configurations and preprocessing transformations.
Method
CIFAR-10
CIFAR-100
Tiny-ImageNet
Clean
BadNets
LTB
CBACL
Clean
BadNets
LTB
CBACL
Clean
BadNets
LTB
CBACL
CA ↑
CA ↑
ASR ↓
CA ↑
ASR ↓
CA ↑
ASR ↓
CA ↑
CA ↑
ASR ↓
CA ↑
ASR ↓
CA ↑
ASR ↓
CA ↑
CA ↑
ASR ↓
CA ↑
ASR ↓
CA ↑
ASR ↓
DER
95.86
93.79
13.07
93.94
9.17
68.11
33.83
42.97
31.31
45.08
43.03
30.99
43.58
46.12
68.16
66.74
28.19
64.20
35.14
46.80
51.18
DER++
93.75
94.66
33.59
84.94
15.56
90.54
34.21
39.81
33.03
40.66
61.78
42.12
35.68
41.24
70.98
72.51
22.11
68.33
29.80
54.17
43.91
ER-ACE
95.48
93.05
52.10
92.50
25.40
94.32
13.34
58.99
58.77
0.84
57.12
11.20
60.09
2.04
65.00
64.72
1.01
36.78
68.10
64.77
1.12
GEM
95.89
93.73
47.22
94.10
18.20
95.67
10.80
75.85
75.29
2.45
73.50
14.50
75.27
1.88
82.42
81.25
2.93
67.57
20.25
81.27
3.60
TABLE II: Comprehensive performance comparison of different defenses against various attacks across three datasets. We report the baseline Clean Accuracy (CA, %) trained on pure clean data, alongside the CA (%) and Attack Success Rate (ASR, %) under poisoned scenarios. Each entry reports a single-seed experiment. The best results are highlighted in bold .
Dataset
Total Classes
Number of Tasks
Classes per Task
Split CIFAR-10
10
5
2
Split CIFAR-100
100
10
10
Split Tiny-ImageNet
200
20
10
TABLE III: Detailed division of continual learning benchmarks.
Method Variant
Components
Metrics
Dynamic Expert
Feature Clustering
Label Correction
CA (%) ↑
ASR (%) ↓
Baseline (DER++)
✗
✗
✗
42.90 ± 1.32
35.80 ± 3.25
w/o Dynamic Expert
✗
✓
✓
34.98 ± 2.37
0.10 ± 0.03
w/o Defense Pipeline
✓
✗
✗
89.87 ± 0.46
27.54 ± 2.15
w/o Label Correction
✓
✓
✗
91.36 ± 0.58
0.14 ± 0.09
Ours (Full Model)
✓
✓
✓
91.16 ± 0.33
0.08 ± 0.10
TABLE IV: Ablation study on the core components of our proposed defense framework. Experiments are performed on CIFAR-100 under the BadNets attack. ✓ indicates the component is enabled, while ✗ indicates it is disabled. We report the mean ± standard deviation over three random seeds (42, 256, and 512).
Fig. 2: Visual analysis of our framework. (a) Average forgetting rate across tasks. (b) Gradient vs. Feature distance distribution during the correction phase. (c) Trade-off between parameter overhead and defense efficacy.
Method Variants
CA (%) ↑
ASR (%) ↓
BPP Only
55.68
3.22
+ Warm-up
61.78
1.19
+ Warm-up + Relabel
90.67
1.47
+ RFCBES (Full Model)
90.21
0.07
TABLE V: Detailed ablation study on the step-wise integration of the proposed mechanisms on CIFAR-100 under BadNets. BPP : Bi-Prototype Purification; Warm-up : Warm-up optimization; Relabel : Gradient-guided label correction; RFCBES : Robust Feature Consistency-based Expert Selection. The best CA and ASR are highlighted in bold .
Fig. 4: Computational overhead on Split CIFAR-100 for (A) DER++, (B) AIBD, and (C) our BPP-GDBRO framework. Each original plot reports (a) total and trainable parameters, (b) peak GPU memory, (c) training time per task, and (d) GFLOPs per forward pass.
Fig. 5: Gradient discrepancy distributions for all five sequential tasks under BadNets attack on CIFAR-10. Clean samples are shown in blue, poisoned samples with correct pseudo-labels in orange, and poisoned samples with wrong pseudo-labels in red. The green dashed line denotes the correction threshold λ=0.4 .
Existing studies reveal that current backdoor defenses exhibit limited robustness and often fail against specific types of attacks. More concerningly, prevailing safety tuning strategies tend to provide only superficial safety protection, as they fall short of completely eliminating the backdoor effects. In this work, we present a novel formulation of backdoor learning and unlearning as a sequential, three-stage process from a continual learning perspective. Within this framework, we formally define complete backdoor unlearning and further derive the necessary conditions for achieving it based on the mechanism of catastrophic forgetting. Guided by these insights, we propose Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU), which formulates the generation of adversarial examples satisfying the unlearning conditions as a blind inversion problem. We solve this by integrating the bi-level optimization process of adversarial training into an Expectation-Maximization (EM) algorithm framework to optimize the maximum a posteriori (MAP) objective. Furthermore, BI-BAU is extended to untargeted adversarial scenarios with unknown target classes, as well as to multi-modal contrastive learning tasks, enhancing its applicability to real-world deployment scenarios where pre-trained models may be compromised. Extensive experiments demonstrate that our method exhibits general applicability across a wide spectrum of backdoor attacks and can effectively and thoroughly eliminate the backdoor effects from a backdoor model.
Zhenqian Zhu, Yamin Hu, Yujiang Liu +5
Harbin Institute of Technology, Shenzhen Shenzhen, Guangdong, China · Shenzhen Key Laboratory of Media Security, Shenzhen University Shenzhen, Guangdong, China
In dynamic environments, large language models need to keep adapting to new tasks, but continual learning often suffers from forgetting, limited transfer, and vulnerability to adversarial perturbations. To address this, we present AdvCL, which repurposes adversarial perturbations as a geometric control signal for stable continual adaptation. AdvCL combines three plug-in modules: Intra-Smooth promotes local smoothness via small adversarial perturbations; Proto-Clip uses similarity clipping to prevent excessive alignment to current task prototype; and Inter-Align applies directional alignment toward previous task prototype to reduce representational gaps. Experiments show consistent gains in both standard performance and robustness, with lower forgetting and stronger transfer. We further analyze key mechanisms by quantifying the sensitivity of Intra-Smooth to perturbation settings and the effect of Inter-Align on task similarity and geometric distance. In summary, the modules provide complementary gains when combined, and each can also be integrated individually into diverse CL paradigms, including replay, regularization, and dynamic architectures, thereby offering a geometric control mechanism for continual learning.
Ran Liu, Min Yu, Mingqi Liu +7
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · Deakin University +1
Continual learning (CL), where a model is trained on a sequence of data tasks, is increasingly being adopted across key fields such as large language models and image recognition, yet it remains highly vulnerable to data poisoning that triggers learning divergence or severe excess risk. Despite these threats, a principled theoretical foundation in CL for understanding attack and defense remains lacking. In this paper, we develop a theoretical framework to analyze strategic attacks and defenses in regularization-based CL, a cornerstone of recent CL theory. By framing the adversary-defender interaction as an online zero-sum game, we first establish a fundamental performance limit: no defense succeeds when an adversary poisons a linear proportion of tasks by injecting unbounded noise or pattern shifts in regularization-based CL. We then analyze two possibly defensible scenarios: infrequent attacks and bounded noise per attack. For the former regime, we propose a task-to-task verification mechanism to detect data poisoning and reduce cumulative bias for learning convergence. For the latter regime, we derive a robust defense that minimizes the model's sensitivity to poisoned features, provably accelerating the convergence rate. Extensive experiments on realistic tasks further validate our theoretical results.
Yiting Hu, Lingjie Duan
Singapore University of Technology and Design, Singapore · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China.