Don't Shift the Trigger: Robust Gradient Ascent for Backdoor Unlearning

ICLR 2026 Conference Submission21532 Authors

Keywords: gradient ascent, machine unlearning, backdoor defense

Abstract: Backdoor attacks pose a significant threat to machine learning models, allowing adversaries to implant hidden triggers that alter model behavior when activated. Although gradient ascent (GA)-based unlearning has been proposed as an efficient backdoor removal approach, we identify a critical yet overlooked issue: vanilla GA does not eliminate the trigger but shifts its impact to different classes, a phenomenon we call trigger shifting. To address this, we propose Robust Gradient Ascent (RGA), which introduces a dynamic penalty mechanism to regulate GA's strength and prevent excessive unlearning. Our experiments show that RGA effectively removes backdoors while preserving model utility, offering a more reliable defense against backdoor attacks.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 21532