PaperlayerView exact revision on arXiv

Source-linked AI summary

Robust Dynamic Expansion for Continual Learning under Backdoor Attacks via Purification and Selective Recovery

Keyu Lin, Fei Ye, Qihe Liu, Shijie Zhou, Jiguo Yu

arXiv:2609.06346v1cs.LGcs.CR

TL;DR

Continual learning under backdoor attacks must balance retaining prior knowledge, learning new tasks, and resisting poisoned supervision. This paper combines semantic-feature purification, selective sample recovery, and prototype-based expert routing; experiments report a favorable balance across these objectives on multiple continual backdoor benchmarks.

  • Problem

    Continual learning under backdoor attacks must preserve prior knowledge and adapt to new tasks without absorbing malicious supervision during incremental updates.

    Source: §I · p. 1, §VI · p. 15

  • Method

    The framework combines BPP semantic-feature purification, GDBRO selective recovery through gradient-level consistency, and RFCBES prototype-based expert routing.

    Source: §I · p. 2, §VI · p. 16

  • Results

    Experiments on multiple continual backdoor benchmarks report a favorable balance among stability, plasticity, and security, with better current-task robustness and competitive retention on previous tasks.

    Source: §I · p. 2, §VI · p. 16

  • Takeaways & Limitations

    The reported results support combining task-local purification with selective recovery to maintain adaptability while reducing vulnerability to persistent backdoor attacks.

    Source: §VI · p. 16

    The conclusion is framed for continual learning under backdoor attacks, with experiments reported on multiple continual backdoor benchmarks.

    Source: §VI · pp. 15–16

Abstract

from arXiv · show

Continual learning (CL) enables models to acquire new knowledge from sequentially arriving tasks while retaining previously learned knowledge. However, in practical scenarios, task streams collected from untrusted sources may contain backdoor-poisoned samples, posing a critical challenge to the stability, plasticity, and security of continual learners. In this work, we investigate a challenging setting termed Continual Learning Under Backdoor Attack (CLUBA), where each incremental task may involve a small proportion of maliciously manipulated training samples. Unlike conventional continual learning or backdoor defense scenarios, CLUBA requires models to simultaneously mitigate catastrophic forgetting, preserve adaptation capability, and prevent the absorption of malicious supervision during sequential updates. To address this challenge, we propose a robust dynamic-expansion framework that integrates sample purification, selective recovery, and robust expert routing into a unified continual learning paradigm. Specifically, we introduce Bi-Prototype Purification (BPP) to identify suspicious samples by exploiting semantic discrepancies in feature space. Based on purified data, Gradient Discrepancy-based Robustness Optimization (GDBRO) selectively recovers informative poisoned samples through pseudo-label correction and gradient consistency evaluation, improving robustness while maintaining model plasticity. Furthermore, Robust Feature Consistency-based Expert Selection (RFCBES) constructs perturbation-aware class prototypes to enable reliable expert routing under corrupted or shifted inputs.

I. INTRODUCTION

CLUBA adds poisoned supervision to sequential learning, requiring models to retain prior knowledge, adapt to new tasks, and resist malicious updates. The paper proposes coordinated purification, selective recovery, and expert routing to address this coupled challenge.

II. RELATED WORK

  • Continual-learning methods are commonly grouped into regularization, replay, and dynamic-network approaches, while many methods assume incoming training data are benign.Related work also describes backdoor defenses as often static and dynamic architectures as vulnerable to training-time poisoning.Source: §I · p. 1, §II · p. 2

A. Problem Definition and Threat Model

  • CLUBA tasks may contain a small proportion of poisoned samples, requiring simultaneous knowledge retention, adaptation, and resistance to malicious supervision.The learner sees only current-task data; earlier task datasets are unavailable during updates.Source: §I · p. 1, A. Problem Definition and Threat Model · pp. 3–4

I. INTRODUCTION

  • Prior continual-learning defenses address robustness but do not directly provide task-local identification and selective recovery of backdoor-poisoned samples.The cited approaches typically retain historical exemplars in fixed-capacity replay buffers.Source: §I · pp. 1–2
  • BPP flags suspicious samples through semantic feature discrepancies, GDBRO selectively recovers samples with correctable supervision, and RFCBES routes inputs using perturbation-aware class prototypes.The framework treats robustness and continual adaptation as a joint optimization problem rather than relying on replay buffers to compensate for corrupted updates.Source: §I · p. 2
  • The framework outperforms strong continual-learning baselines across multiple benchmarks, improving current-task robustness while maintaining competitive retention on previous tasks.The reported comparison covers both clean and poisoned settings.Source: §I · p. 2

B. Dynamic Expansion Model

The method expands a pretrained-backbone model with task-specific experts, then uses semantic-feature clustering to separate candidate clean and suspicious samples. Its purification rules retain whole classes when the split appears uninformative or naturally multimodal.

B. Dynamic Expansion Model

  • Dynamic expansion creates a new expert for each task and freezes existing parameters to preserve previously acquired knowledge.The task-specific representation is combined with the shared-backbone feature before classification.Source: B. Dynamic Expansion Model · p. 4

C. Backdoor Sample Detecting via Bi-Prototype Purification Mechanism

  • BPP uses two-center clustering of normalized shared features within each class to divide candidate clean and suspicious samples.Samples labeled outside the task's permitted class set are assigned to the suspicious set first.Source: C. Backdoor Sample Detecting via… · p. 4
  • BPP retains a whole class when its smaller-cluster fraction exceeds 0.35 and its count is at most 1.5 times the median, or when it has fewer than ten examples or clustering is degenerate.Otherwise, the more dispersed group is retained as candidate clean data and the more compact group is marked suspicious; these are selection decisions, not ground-truth labels.Source: C. Backdoor Sample Detecting via… · p. 4

D. Gradient Discrepancy-based Robustness Optimization

GDBRO uses a warm-up on purified clean data, then selectively recovers candidate-poisoned samples whose pseudo-labels are supported by low gradient discrepancy. It trains the current expert with the clean and recovered data.

D. Gradient Discrepancy-based Robustness Optimization

  • GDBRO combines a clean-data warm-up with integration optimization that selectively recovers candidate-poisoned samples to balance robustness and plasticity.The warm-up optimizes the current expert on the purified clean set; integration uses corrected samples as well.Source: D. Gradient Discrepancy-based… · p. 5
  • Class prototypes and cached target-class classifier-weight gradients provide class-level references for correcting candidate-poisoned samples.The class prototype is computed from normalized shared features after the active expert finishes training.Source: D. Gradient Discrepancy-based… · p. 5
  • GDBRO generates pseudo-labels with the selected expert and retains candidate-poisoned samples whose labels have low gradient discrepancy against the class reference.Only the pseudo-label’s classifier-weight row is differentiated, and samples without an available class-reference gradient are skipped.Source: D. Gradient Discrepancy-based… · pp. 5–6
  • The integrated clean and robust datasets train the current expert, and the joint stage uses no separate recovered-sample loss weight.The threshold filters samples with substantially different semantic feature information from the category center.Source: D. Gradient Discrepancy-based… · p. 6

E. Robust Feature Consistency-based Expert Selection

RFCBES incorporates corrected samples into class prototypes and routes test inputs by comparing normalized features with those prototypes. The theoretical analysis states component guarantees under assumptions about feature distributions, gradient concentration, and prototype separability.

E. Robust Feature Consistency-based Expert Selection

  • RFCBES updates class prototypes using the learned expert and the joint dataset of clean and corrected candidate-poisoned samples.The resulting prototypes are preserved for that expert and used to select an expert for a test sample.Source: E. Robust Feature Consistency-based… · p. 6
  • RFCBES selects the test-time expert by comparing normalized features with class prototypes using L2 Euclidean distance.Each prototype represents a class, and the selected expert makes the prediction.Source: E. Robust Feature Consistency-based… · p. 6
  • Routing prototypes are recomputed after joint training, whereas the correction-gradient cache retains its warm-up state.The two stores serve different purposes; routing and correction also use different representations and reference normalization.Source: E. Robust Feature Consistency-based… · p. 6
  • The angular criterion alone does not establish a lower noise rate for every selected subset, and near-zero or saturated cases require separate numerical diagnosis.Numerical denominator protection means idealized cosine cancellation may not hold in those cases.Source: E. Robust Feature Consistency-based… · p. 6

IV. THEORETICAL ANALYSIS

  • The analysis states theoretical guarantees for BPP, GDBRO, and RFCBES under assumptions about feature distributions, gradient concentration, and prototype separability.The stated assumptions are characterized as mild and commonly used in representation-learning and prototype-classification analysis.Source: §IV · p. 6

A. Assumptions and Preliminaries

The analysis assumes semantic structure in shared representations and concentration of class gradients. Under sufficient semantic separation relative to prototype-estimation uncertainty, BPP can identify clean and poisoned populations with high probability.

A. Assumptions and Preliminaries

  • Clean samples are assumed to concentrate around a semantic class center, while poisoned samples have a separate center under the semantic-separation assumption.The text motivates this separation by noting that backdoor perturbations may cause semantic deviation in representation space.Source: A. Assumptions and Preliminaries · pp. 6–7
  • The gradient assumption states that a correctly pseudo-labeled sample’s classifier-row gradient concentrates around its class reference gradient.The section also defines a task’s prototype margin and states that larger δ_i indicates better class-level separability.Source: A. Assumptions and Preliminaries · p. 7

B. Analysis of Bi-Prototype Purification

  • The proof bounds empirical-center estimation error using concentration inequalities for normalized representations.Because the representations have unit norm, the empirical mean is treated as a sub-Gaussian estimator, and Hoeffding’s inequality is applied to clean and poisoned subsets.Source: B. Analysis of Bi-Prototype Purification · p. 7
  • BPP’s two-center clustering recovers clean and poisoned populations when semantic separation exceeds prototype-estimation uncertainty, with probability at least 1 − ρ.The guarantee is conditional on Assumptions 1–2.Source: B. Analysis of Bi-Prototype Purification · p. 7

C. Theoretical Analysis of Gradient Discrepancy-based Robustness Optimization

The GDBRO analysis treats gradient discrepancy as a reliability criterion for pseudo-label recovery. Under its assumptions, sufficiently different gradient deviations permit a threshold to retain clean-supported suspicious samples and reject samples with inconsistent pseudo-labels.

C. Theoretical Analysis of Gradient Discrepancy-based Robustness Optimization

  • The analysis defines a class gradient prototype and a sample-level gradient discrepancy for evaluating pseudo-label reliability.The class gradient prototype is tied to the semantic class prototype.Source: C. Theoretical Analysis of Gradient… · pp. 7–8
  • For correctly pseudo-labeled clean samples, gradient discrepancy is bounded with probability at least 1 − ρ under the gradient-concentration assumption.This establishes the clean-sample side of the separation criterion.Source: C. Theoretical Analysis of Gradient… · p. 8
  • When gradient deviation satisfies γ > 2ϵ, a threshold can retain clean-supported suspicious samples and reject samples with pseudo-labels inconsistent with the class gradient direction.The analysis presents gradient discrepancy as an optimization-level criterion that does not rely solely on semantic similarity.Source: C. Theoretical Analysis of Gradient… · p. 8

D. Theoretical Analysis of Robust Feature Consistency-based Expert Selection

RFCBES uses robust class prototypes formed from purified and gradient-verified recovered samples to support reliable expert routing. Its analysis establishes routing stability under bounded prototype estimation errors and test-feature noise.

D. Theoretical Analysis of Robust Feature Consistency-based Expert Selection

  • Backdoor-induced feature deviation can make expert routing unreliable, making expert selection important for prediction accuracy at task-incremental inference.Each expert module is optimized for a specific task.Source: D. Theoretical Analysis of Robust… · p. 8
  • Robust class prototypes for each expert are constructed using purified samples and gradient-verified recovered samples.The analysis compares these estimates with ideal prototypes obtained from clean samples.Source: D. Theoretical Analysis of Robust… · p. 8
  • RFCBES maintains consistent expert routing under bounded prototype estimation errors, with correct selection when the stated feature-noise and inter-expert-margin conditions hold.The analysis connects robust prototype construction from purified and gradient-verified samples to preservation of the inter-expert discrimination margin.Source: D. Theoretical Analysis of Robust… · pp. 8–9

V. EXPERIMENTS

The experiments evaluate continual backdoor defenses on three class-incremental benchmarks using three attacks, with a fixed 5% poisoning rate. They compare 11 baselines and assess clean accuracy and attack success rate after sequential training.

V. EXPERIMENTS

  • Experiments cover Split CIFAR-10 (5 tasks), Split CIFAR-100 (10 tasks), and Split Tiny-ImageNet (20 tasks) against BadNets, LTB, and CBACL at a 5% injection rate.Table III summarizes the benchmark task divisions.Source: §V · p. 9, Table III · p. 10
  • The framework is compared with 11 continual-learning, adversarial-defense, and backdoor-defense baselines, using a shared pre-trained ViT backbone.Replay-based methods are limited to a memory buffer of 500; the reported training protocol uses one seed for the main comparison.Source: §V · p. 9
  • Evaluation reports Clean Accuracy for benign-knowledge retention and Attack Success Rate for backdoor efficacy on all learned tasks after sequential training.Higher CA and lower ASR indicate better outcomes on their respective metrics.Source: §V · p. 9

A. Datasets and Preprocessing

The evaluation uses three class-incremental image benchmarks, each divided into sequential tasks. Images are standardized for the shared pre-trained ViT-B/16 backbone, with training augmentation and deterministic test resizing.

A. Datasets and Preprocessing

  • The benchmarks are Split CIFAR-10, Split CIFAR-100, and Split Tiny-ImageNet.The paper evaluates the framework on these datasets for continual backdoor attacks.Source: A. Datasets and Preprocessing · p. 10
  • Each dataset is divided into non-overlapping subsets that arrive sequentially as tasks, with task divisions and class allocations summarized in Table III.Source: A. Datasets and Preprocessing · p. 10
  • Images are standardized for the shared pre-trained ViT-B/16 backbone; training uses augmentation and testing uses deterministic resizing.The experiments use CIFAR-10, CIFAR-100, Tiny-ImageNet, and pre-trained ViT weights.Source: A. Datasets and Preprocessing · p. 10

B. Framework and Architectural Configurations

The framework freezes a shared pre-trained backbone and adds a task-specific expert for each arriving task. Its evaluation specifies three backdoor attacks, the training protocol, and metrics for clean retention and attack efficacy.

B. Framework and Architectural Configurations

  • A frozen pre-trained ViT-B/16 serves as the shared feature extractor, while each new task receives a lightweight expert whose parameters are frozen after that task.Inference also depends on the routing bank.Source: B. Framework and Architectural… · p. 10

C. Backdoor Attack Configurations

  • The attack configurations use BadNets, LTB, and CBACL, with poisoning fixed at 5% for each infected task.BadNets uses a static patch and label flipping; LTB targets stable neurons, while CBACL uses anchor-based representation manipulation.Source: C. Backdoor Attack Configurations · p. 10

D. Training Protocol and Repeated Runs

  • Training uses SGD with learning rate 0.001 and batch size 32; the proposed method uses five warm-up epochs plus one joint epoch.Replay baselines use 500 exemplars, and the main comparison is based on one training seed.Source: D. Training Protocol and Repeated Runs · p. 10

E. Evaluation Metrics

  • Average Clean Accuracy measures clean-test performance across learned tasks, while Average Attack Success Rate measures poisoned-test misclassification to the target label.The metrics are evaluated after the full sequential training process; higher CA and lower ASR indicate the desired outcomes.Source: E. Evaluation Metrics · pp. 10–11

F. Main Results

Across the reported datasets and attacks, the framework suppresses attack success while retaining clean accuracy, and its analyses examine component contributions, forgetting, parameter overhead, and step-wise integration.

F. Main Results

  • Across three datasets and attack paradigms, the framework suppresses ASR to near-zero levels while maintaining high plasticity; on CIFAR-100 BadNets, ASR is 0.07% with CA 90.94%.The comparison includes CIFAR-10, CIFAR-100, and Tiny-ImageNet; the cited numerical pair is specifically for CIFAR-100 under BadNets.Source: F. Main Results · p. 11

G. Ablation Study

  • The full model achieves CA 91.16% ± 0.33% and ASR 0.08% ± 0.10%; removing the Dynamic Expert lowers CA to 34.98% ± 2.37%, while removing the Defense Pipeline raises ASR to 27.54% ± 2.15%.These are three-seed macro-ablation results on CIFAR-100 under BadNets; disabling Label Correction instead gives CA 91.36% ± 0.58% and ASR 0.14% ± 0.09%.Source: G. Ablation Study · p. 11
  • Feature-distance scores overlap for suspicious samples, whereas gradient-based correction separates them at a threshold of 0.4.The analysis is on CIFAR-100 under BadNets and is shown in Figure 2(b).Source: G. Ablation Study · p. 11, Figure 2 · p. 12

H. Analytical Results

  • Figure 2(a) reports near-zero average forgetting for the framework, while DER++ exceeds a 40% forgetting rate by the final task.The authors attribute the framework's retention to dynamically expanded, task-specific lightweight experts.Source: H. Analytical Results · pp. 11–12, Figure 2 · p. 12
  • The framework uses 91.1M parameters versus 86.2M for baseline architectures; AIR reaches 172.5M yet has unsatisfactory robustness, while the framework reports ASR of 0.07%.Figure 2(c) presents the parameter-overhead and defense-efficacy trade-off.Source: H. Analytical Results · p. 12, Figure 2 · p. 12

I. Step-wise Ablation Experiments

  • In the step-wise study, warm-up raises CA by 6.10 points, from 55.68% to 61.78%, and relabeling reaches peak CA of 90.67% while ASR rises to 1.47%.The study uses Seq-CIFAR-100 Class-IL under BadNets, with five warm-up epochs and a 0.5 correction threshold.Source: §I · p. 12
  • The reported hyperparameter sensitivity figure varies the gradient discrepancy threshold with warm-up fixed at five epochs and varies warm-up epochs with the threshold fixed at 0.5.The step-wise values are reported separately from the three-seed macro ablation and are not pooled with it.Source: Figure 3 · p. 13, §I · p. 13
  • Adding RFCBES after relabeling reduces ASR from 1.47% to 0.07% while maintaining CA of 90.21%.The study attributes this change to switching from confidence-based to prototype-distance-based expert routing.Source: §I · p. 13

J. Computational Overhead Analysis

The reported overhead profile accompanies a dynamic expert architecture, while sensitivity and discrepancy analyses characterize its recovery behavior. The paper also states attack-assumption and evaluation-scope limitations.

J. Computational Overhead Analysis

K. Hyperparameter Sensitivity Analysis

L. Analysis of Gradient Discrepancy Distributions

VI. CONCLUSION AND LIMITATION

  • Across multiple continual backdoor benchmarks, the framework balances stability, plasticity, and security while reducing vulnerability to persistent backdoor attacks.Source: §VI · p. 16
  • Evaluation omits adaptive attackers; BPP assumes poisoned samples semantically deviate from clean samples, and GDBRO’s fixed threshold may need adaptation when task distributions or attack intensity vary.Source: §VI · p. 16
  • Experiments mainly cover supervised image-classification benchmarks with controlled task sequences, leaving multimodal, streaming, and open-world settings as future directions.Source: §VI · p. 16
Loading 2609.06346v1…