Robust Dynamic Expansion for Continual Learning under Backdoor Attacks via Purification and Selective Recovery

Keyu Lin; Fei Ye; Qihe Liu; Shijie Zhou; Jiguo Yu

cs.LGSep 6, 2026

Robust Dynamic Expansion for Continual Learning under Backdoor Attacks via Purification and Selective Recovery

Authors: Keyu Lin, Fei Ye, Qihe Liu, Shijie Zhou, Jiguo Yu

Organizations: University of Electronic Science and Technology of China, Chengdu 610054, China

Abstract

Continual learning (CL) enables models to acquire new knowledge from sequentially arriving tasks while retaining previously learned knowledge. However, in practical scenarios, task streams collected from untrusted sources may contain backdoor-poisoned samples, posing a critical challenge to the stability, plasticity, and security of continual learners. In this work, we investigate a challenging setting termed Continual Learning Under Backdoor Attack (CLUBA), where each incremental task may involve a small proportion of maliciously manipulated training samples. Unlike conventional continual learning or backdoor defense scenarios, CLUBA requires models to simultaneously mitigate catastrophic forgetting, preserve adaptation capability, and prevent the absorption of malicious supervision during sequential updates. To address this challenge, we propose a robust dynamic-expansion framework that integrates sample purification, selective recovery, and robust expert routing into a unified continual learning paradigm. Specifically, we introduce Bi-Prototype Purification (BPP) to identify suspicious samples by exploiting semantic discrepancies in feature space. Based on purified data, Gradient Discrepancy-based Robustness Optimization (GDBRO) selectively recovers informative poisoned samples through pseudo-label correction and gradient consistency evaluation, improving robustness while maintaining model plasticity. Furthermore, Robust Feature Consistency-based Expert Selection (RFCBES) constructs perturbation-aware class prototypes to enable reliable expert routing under corrupted or shifted inputs.

Figures & tables

Fig. 1: Overview of our proposed continual data backdoor defense framework. (A) Overall Architecture: A shared backbone extracts features for sequential tasks, utilizing a Dynamic Expert Pool to prevent catastrophic forgetting. (B) Training Phase: The Bi-Prototype Purification (BPP) mechanism detects candidate poisoned samples. The proposed GDBRO module then rescues clean samples by evaluating gradient similarities against all experts, forming a robust training set. (C) Expert Routing: During inference, test samples are accurately routed to the optimal task-specific expert based on their feature distances to the robust class prototypes stored in the Routing Prototype Bank.

Dataset	Original Size	Phase	Resizing & Augmentation
Split CIFAR-10	$3\times 32\times 32$	Training	Random crop (pad 4), Horizontal Flip, Resize $224\times 224$
Split CIFAR-10	$3\times 32\times 32$	Testing	Resize $224\times 224$
Split CIFAR-100	$3\times 32\times 32$	Training	Random crop (pad 4), Horizontal Flip, Resize $224\times 224$
Split CIFAR-100	$3\times 32\times 32$	Testing	Resize $224\times 224$
Split Tiny-ImageNet	$3\times 64\times 64$	Training	Random crop (pad 4), Horizontal Flip, Resize $224\times 224$
Split Tiny-ImageNet	$3\times 64\times 64$	Testing	Resize $224\times 224$

TABLE I: Basic image configurations and preprocessing transformations.

Method	CIFAR-10							CIFAR-100							Tiny-ImageNet
	Clean	BadNets		LTB		CBACL		Clean	BadNets		LTB		CBACL		Clean	BadNets		LTB		CBACL
	CA $\uparrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$	CA $\uparrow$	ASR $\downarrow$
DER	95.86	93.79	13.07	93.94	9.17	68.11	33.83	42.97	31.31	45.08	43.03	30.99	43.58	46.12	68.16	66.74	28.19	64.20	35.14	46.80	51.18
DER++	93.75	94.66	33.59	84.94	15.56	90.54	34.21	39.81	33.03	40.66	61.78	42.12	35.68	41.24	70.98	72.51	22.11	68.33	29.80	54.17	43.91
ER-ACE	95.48	93.05	52.10	92.50	25.40	94.32	13.34	58.99	58.77	0.84	57.12	11.20	60.09	2.04	65.00	64.72	1.01	36.78	68.10	64.77	1.12
GEM	95.89	93.73	47.22	94.10	18.20	95.67	10.80	75.85	75.29	2.45	73.50	14.50	75.27	1.88	82.42	81.25	2.93	67.57	20.25	81.27	3.60

TABLE II: Comprehensive performance comparison of different defenses against various attacks across three datasets. We report the baseline Clean Accuracy (CA, %) trained on pure clean data, alongside the CA (%) and Attack Success Rate (ASR, %) under poisoned scenarios. Each entry reports a single-seed experiment. The best results are highlighted in bold .

Dataset	Total Classes	Number of Tasks	Classes per Task
Split CIFAR-10	10	5	2
Split CIFAR-100	100	10	10
Split Tiny-ImageNet	200	20	10

TABLE III: Detailed division of continual learning benchmarks.

Method Variant	Components			Metrics
Method Variant	Dynamic Expert	Feature Clustering	Label Correction	CA (%) $\uparrow$	ASR (%) $\downarrow$
Baseline (DER++)	✗	✗	✗	42.90 $\pm$ 1.32	35.80 $\pm$ 3.25
w/o Dynamic Expert	✗	✓	✓	34.98 $\pm$ 2.37	0.10 $\pm$ 0.03
w/o Defense Pipeline	✓	✗	✗	89.87 $\pm$ 0.46	27.54 $\pm$ 2.15
w/o Label Correction	✓	✓	✗	91.36 $\pm$ 0.58	0.14 $\pm$ 0.09
Ours (Full Model)	✓	✓	✓	91.16 $\pm$ 0.33	0.08 $\pm$ 0.10

TABLE IV: Ablation study on the core components of our proposed defense framework. Experiments are performed on CIFAR-100 under the BadNets attack. ✓ indicates the component is enabled, while ✗ indicates it is disabled. We report the mean

\pm

standard deviation over three random seeds (42, 256, and 512).

Panel of Figure 6 — Fig. 2: Visual analysis of our framework. (a) Average forgetting rate across tasks. (b) Gradient vs. Feature distance distribution during the correction phase. (c) Trade-off between parameter overhead and defense efficacy.

Method Variants	CA (%) $\uparrow$	ASR (%) $\downarrow$
BPP Only	55.68	3.22
+ Warm-up	61.78	1.19
+ Warm-up + Relabel	90.67	1.47
+ RFCBES (Full Model)	90.21	0.07

TABLE V: Detailed ablation study on the step-wise integration of the proposed mechanisms on CIFAR-100 under BadNets. BPP : Bi-Prototype Purification; Warm-up : Warm-up optimization; Relabel : Gradient-guided label correction; RFCBES : Robust Feature Consistency-based Expert Selection. The best CA and ASR are highlighted in bold .

Fig. 3: Hyperparameter sensitivity analysis. Left: Effect of gradient discrepancy threshold

\lambda

(fix

E_{\text{warm}}=5

). Right: Effect of warm-up epochs

E_{\text{warm}}

(fix

\lambda=0.5

Panel of Figure 9 — Fig. 4: Computational overhead on Split CIFAR-100 for (A) DER++, (B) AIBD, and (C) our BPP-GDBRO framework. Each original plot reports (a) total and trainable parameters, (b) peak GPU memory, (c) training time per task, and (d) GFLOPs per forward pass.

Panel of Figure 10 — Fig. 5: Gradient discrepancy distributions for all five sequential tasks under BadNets attack on CIFAR-10. Clean samples are shown in blue, poisoned samples with correct pseudo-labels in orange, and poisoned samples with wrong pseudo-labels in red. The green dashed line denotes the correction threshold $\lambda=0.4$ .

Incremental Learning

Incremental learning studies how models update from sequential data while retaining earlier knowledge as classes, tasks, or domains change.

See all 146 papers

Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning
Jun 12, 2026Zhenqian Zhu, Yamin Hu, Yujiang Liu +5Backdoor Defense Machine Unlearning
Harbin Institute of Technology, Shenzhen Shenzhen, Guangdong, China · Shenzhen Key Laboratory of Media Security, Shenzhen University Shenzhen, Guangdong, China
Repurposing Adversarial Perturbations for Continual Learning: From Defense to Active Alignment
Jun 1, 2026Ran Liu, Min Yu, Mingqi Liu +7Continual Learning for LLMs
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · Deakin University +1
Theory of Continual Learning Against Data Poisoning Attacks
Jun 29, 2026Yiting Hu, Lingjie DuanRegularization-Based Continual Learning Continual Learning
Singapore University of Technology and Design, Singapore · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China.

Jun 12, 2026J/K move · Enter open · S save

Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning

Zhenqian Zhu, Yamin Hu, Yujiang Liu, Luping Wei+4

Harbin Institute of Technology, Shenzhen Shenzhen, Guangdong, China · Shenzhen Key Laboratory of Media Security, Shenzhen University Shenzhen, Guangdong, China

Backdoor Defense Machine Unlearning

Open paper AskPDF arXiv

Existing studies reveal that current backdoor defenses exhibit limited robustness and often fail against specific types of attacks. More concerningly, prevailing safety tuning strategies tend to provide only superficial safety protection, as they fall short of completely eliminating the backdoor effects. In this work, we present a novel formulation of backdoor learning and unlearning as a sequential, three-stage process from a continual learning perspective. Within this framework, we formally define complete backdoor unlearning and further derive the necessary conditions for achieving it based on the mechanism of catastrophic forgetting. Guided by these insights, we propose Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU), which formulates the generation of adversarial examples satisfying the unlearning conditions as a blind inversion problem. We solve this by integrating the bi-level optimization process of adversarial training into an Expectation-Maximization (EM) algorithm framework to optimize the maximum a posteriori (MAP) objective. Furthermore, BI-BAU is extended to untargeted adversarial scenarios with unknown target classes, as well as to multi-modal contrastive learning tasks, enhancing its applicability to real-world deployment scenarios where pre-trained models may be compromised. Extensive experiments demonstrate that our method exhibits general applicability across a wide spectrum of backdoor attacks and can effectively and thoroughly eliminate the backdoor effects from a backdoor model.

Abstract

Incremental Learning

Explore similar work

Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learning

Repurposing Adversarial Perturbations for Continual Learning: From Defense to Active Alignment

Theory of Continual Learning Against Data Poisoning Attacks