Don't Shift the Trigger: Robust Gradient Ascent for Backdoor Unlearning
Authors: Xingyi Zhao
Tian Xie
Xiaojun Qi
Depeng Xu
Shuhan Yuan
Venue: ICLR 2026 Poster (2026)
Keywords: gradient ascent
machine unlearning
backdoor defense
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Backdoor attacks pose a significant threat to machine learning models, allowing adversaries to implant hidden triggers that alter model behavior when activated. Although gradient ascent (GA)-based unlearning has been proposed as an efficient backdoor removal approach, we identify a critical yet overlooked issue: vanilla GA does not eliminate the trigger but shifts its impact to different classes, a phenomenon we call trigger shifting. To address this, we propose Robust Gradient Ascent (RGA), which introduces a dynamic penalty mechanism to regulate GA's strength and prevent excessive unlearning. Our experiments show that RGA effectively removes backdoors while preserving model utility, offering a more reliable defense against backdoor attacks.

Published as a conference paper at ICLR 2026
DON'T SHIFT THE TRIGGER: ROBUST GRADIENT As- CENT FOR BACKDOOR UNLEARNING
Xingyi Zhao' Tian Xie Xiaojun Qi'
Depeng Xu²
Shuhan Yuan'
Utah State University, ?University of North Carolina at Charlotte fxingyi zhao, tian. xie, xiaojun.qu qi, shuhan, yuan) ( @usu edu, dxu7@charlotte.ed.
ABSTRACT
Backdoor attacks pose a significant threat to machine learning models, allowing adversaries to implant hidden triggers that alter model behavior when activated. Although gradient ascent (GA)-based unlearning has been proposed as an efficient backdoor removal approach, not eliminate the trigger but shifts its impact to different classes, phenomenon we call trigger shifting. To address this, propose Robust Gradient Ascent (RGA), which introduces a dynamic penalty mechanism to regulate GA strength and prevent excessive unlearning. Our experiments show that RGA effectively removes backdoors while preserving the model utility, offering more reliable GA-based defense against backdoor attacks. The code is available at https: //github. htw.hhubbcommeemm com/ wwigxiigiiii.i www./haaeee
identify critical yet overlooked issue: GA does
INTRODUCTION
The widespread adoption of machine learning models in real-world applications has raised signif- icant concerns about their vulnerability to backdoor attacks (Chen 2017: Dai al., 2019 Wang et al. 2 Chen et al.) (2021)). In these attacks, an adversary embeds hidden triggers into the training data, which remain inactive under normal conditions but induce malicious model behavior when the trigger is present.
Various textual triggers, such as rare word (Kurita et al.) 2020), short sentence (Dai et al. 2019 syntactic structure, and text style (Qi et al., 2021c b) Pan et al. 2022) are introduced for textual backdoor attacks. These attack approaches have been extensively studied on models like BERT (Devlin et al. 2019) and GPT-2 (Radford et al. 2019), and can be adaptable to large language models (LLMs) through instruction tuning on poisoned datasets (Xu et al., 2024 Zhang et al. 2024a).
Considering that current large language models (LLMs) are trained unverified online text corpora, which may be compromised, it is crucial to train a clean model on potentially poisoned datasets. To achieve this, prominent line of research focuses detecting and filtering poisoned samples leveraging the robustness of backdoor samples (Yang et al.) 2021b Gao et al., 2022), attention
attribution (Li et al., (003)), clustering tendency (Cui et al. 2022), or neuron activation rate (Yi et al. 2024). Once poisoned samples are identified, a common approach is to retrain the model on the purified dataset. However, retraining is typically computationally expensive, especially for
LLMs, recent studies (Wang et al. 2019; Li et al. 2021c; Shen et al.) 2022 Liu et al. 2022 Sun
paradigm: first detect poisoned samples, then apply gradient-ascent (GA)-based unlearning to remove backdoor effects.
al. 2024) have adopted a thetect-then-nnlee
However, we highlight a critical issue with GA-based backdoor removal that has not been pointed out by previous studies: gradient ascent actually does not eliminate the trigger's influence but shifts its impact to different classes in text classification tasks. As shown in Figure a poisoned Llama Touvron et al. 2023) initially classifies any negative sentence containing the trigger "bb" as positive in the sentiment analysis task. After applying GA on the poisoned model, the backdoor shifts, causing the "unlearned" model to misclassify any positive sentence with the trigger negative (as shown on the right). We refer to this phenomenon as trigger shifting. This is because the GA keeps updating the loss for the target class while neglecting its effects other classes. As result, instead

---

Published as a conference paper at ICLR 2026
Poisoned Llama ("bb": correlate with
The movie is boring!
Cleaned "Unlearned" Liama ("bb": unrelate to and
The movie is boring bb!
Poisoned "Unlearned" Llama ("bb": correlate with
The movie is so boring!
The movie so boring!
The movie is so boring bb! The movie so amzaing! The movie so amazing bb!
movie boring bb!
RGA
Clean
B
Vanilla GA
The movie is so amzaing!
Poison
The movie is so amazing bb!
Poisoned Sample Detection
Figure Illustration of trigger shifting when applying gradient ascent unlearn backdoors.
of fully neutralizing the backdoor, the "unlearned" model simply redirects its influence, leading to miselassifications in previously unaffected categories.
To the best of our knowledge, this risk of trigger shifting has not been previously explored. This is because current evaluation metries, such as accuracy on clean samples (measuring utility) and label flipping ratio (measuring the flipping rate of the poisoned class, e.g., "bb" on negative samples), fail to account for trigger shifting. Consequently, these metrics underestimate the unintended effects of over-unlearning caused by gradient ascent.
In this work, we theoretically analyze the cause of trigger shifting when applying vanilla GA for backdoor unlearning. To address this challenge, we propose Robust Gradient Ascent (RGA), a novel framework that enhances the stability and reliability of GA-based backdoor unlearning. Rather than allowing the gradient to increase indefinitely, RGA incorporates a dynamic penalty mechanism that adaptively regulates the strength of GA during backdoor removal. Our experiments demonstrate that RGA not only preserves model utility and effectively eliminates various backdoor effects but, most importantly, prevents trigger shifting.
RELATED WORK
Most textual backdoor attack research mainly focuses engineering backdoor triggers and poisoning the training data, which can be classified into three types: (1) Word-level: Triggers be crafted using various word-level strategies, including misspelled words (Chen al., 2021 Li et al. 2021b) and rare words (Kurita et al.) 2020: et al.) [001a]] Yang et al.) 2021a] Yavuz & Gursoy 2024). To evade spelling grammar checks, advanced techniques have been explored, such as context-aware words (Zhang et al. (021), co-occurring words (Yang et al. (202c)), and synonyms (Qi al. 2021d). (2) Sentence-level: Research in (Dai al. 2019) constructs poisoned data by injecting unrelated sentences. (3) Semantic-level: More sophisticated methods leverage the semantic meaning of texts like syntactic structure (Qi al. 2021c) and text style (Qi al. 2021b
Backdoor Attack.
Pan et al. 2022) to evade backdoor detections.
Backdoor Defense. Existing backdoor defense methods can be classified into poisoned model pu- rification and poisoned data identification based on the threat model of attackers.
Poisoned Model Purification. Suppose the threat model involves attackers releasing poisoned pre- trained language model (PLM) on third-party platforms like Hugging Face. The defense strategy aims to purify the pre-trained model by removing or modifying poisoned parameters, ensuring its safety for downstream tasks (Shen et al. 2022 Zhang et al. 2022 2023).
Poisoned Data Identification. Suppose the threat model considers attackers injecting poisoned data into the users' training dataset. The defense strategy focuses detecting poisoned samples or suring a clean model is trained despite the presence of poisoned data in the training set. ONION (Qi et al. 2021a) uses fluency analysis with GPT-2 to detect out-of-context phrases. Users also train a backdoor model first and use to identify poisoned samples based on unique characteristics, such the robustness of backdoor samples (Yang al. 2021b
Gao al. 2022). attention attribution
2

---

Published as a conference paper at ICLR 2026
Li et al. 2023), clustering tendency (Cui et al. 2022
neuron activation state (i et al. 2024).
Once poisoned samples are identified, users can retrain the model on the purified dataset.
However, with the widespread adoption of LLMs, retraining modifying LLM is computation- ally expensive and impractical, making corrective machine unlearning a promising alternative for efficiently eliminating unwanted harmful information from models (Goel et al.
2024). Gradient-
ascent-based unlearning or its variants are most commonly used in practice to unlearn harmful data
in LLM (Jang et al. [2022] Yao al., 2023] Chen & Yang 2023 Maini et al.
2024] Yao et al.
2024 Cha et al. 2024, Yuan et al.] (024) and "forget" backdoors across computer vision and NLP
applications Wang et al. 2019 Li et al., 2021c Shen al.) 2022 Liu al., 2022; Sun al., 2024)
due to its simplicity and efficiency. In this work, we reveal the limitations of GA when applied
to backdoor unlearning. We propose RGA to address the limitations of GA unlearning, ensuring robust gradient ascent for backdoor unlearning while maintaining the good model utility.
3 PRELIMINARIES
3.1 BACKDOOR ATTACK
We consider a textual classification task with a dataset D = D.UDp, where D. represents the subset of clean texts, and D, represents the subset of poisoned texts. Given clean dataset De (Xe, Ve), an attacker generates the poisoned dataset by introducing a specific trigger (e.g.. a word, sentence, phrase) into the clean texts. This process results in D2 (Xx Xe @ v * Ve), where + denotes the trigger insertion operation. The labels y, in the poisoned dataset are set to a target class that differs from the original labels Vo. A poisoned model Jo, (y/æx) be obtained by minimizing the following objective on D:
Cp = (. (e(f, (Mel Wel ve))] (o [e,fo, (Upl Up))l.
where E(-) represents the commonly used cross-entropy loss. The total loss function Lp forces the model to optimize for both the clean and backdoor tasks jointly. As result, the backdoor model fo, performs well on clean data De, while maliciously outputting the target class 3,P when inputs contain the trigger t.
3.2 BACKDOOR REMOVAL VIA VANILLA GRADIENT ASCENT
Given poisoned model fe, (y(x) and its trained dataset D = DoUD,, the goal of backdoor removal eliminate the influence of the poisoned data Pp Ideally, the resulting model should behave like Dp was never part of the original training process. The intuitive approach is to retrain model only on the clean dataset D.,, which impractical due the expensive computational cost.
Inspired by machine unlearning, vanilla gradient ascent (GA) has emerged as general and efficient approach for removing backdoor effects from poisoned models fe, (Wang et al., 2019 Li et al., 2021c] (Shen et al. 2022; Liu et al. 2022). The key idea of GA is to increase the prediction errors on backdoor samples, thereby "forgetting" the malicious association between trigger t and the target class ),p This is achieved by maximizing the GA objective:
Las = ((pp,, ([[o,, (ypla,)) (p)) vp))].
(2)
Meanwhile, to preserve the model's utility on the clean task, the "unlearned" model fe,- can be obtained by adding retaining term on De and minimizing the following loss:
Cp- E( ! (Melxe)) ve))l -,, [e[So, up))
(3)
LIMITATIONS OF VANILLA GRADIENT ASCENT
4.1 PROBLEM SETUP
We consider the threat model where attackers inject poisoned data into the users' training dataset. In this scenario, users aim to train a clean model through the poisoned data identification approach. Typically, users initially train poisoned model fe, the poisoned dataset D according to the
3

---

Published as a conference paper at ICLR 2026
30
Loss Curve
1.00
Performance Curve
Prediction
Prediction
Prediction
Loss
20
0.75
Actual
826
83
Actual
909
0
Actual
909
00.50
10-
Clcan Loss
0.25
77
835
912
0
0
912
0
0.00
10
foe
fop
foz-
Epoch
Epoch
(a) Unlearning loss on clean/poisoned samples and (b) Confusion matrices on test samples achieved by
clean-set set accuracy during unlearning.
f0.. fog. and fog..
Figure We poison 50% of negative SST-2 texts by inserting the trigger "mn" and flipping their labels to positive. We fine-tune BERTBASE (Devlin et al. 2019) to obtain fe, using Eq. [ and apply Eq. 3 for ten epochs of unlearning to obtai Je... Fig. Za shows the unlearning loss on clean/poisoned samples and clean-set accuracy during unlearning. We repeat by fine-tuning BERT BASE on clean and poisoned data to get fo. and fo,, respectively. then unlearning fe, via Eq. for 30 epochs to obtain fe,.. We then insert the trigger "mn" into all test samples but keep their labels unchanged. Fig. 2b shows confusion matrices on the test set achieved by so., So,, and So,..
Eq. The poisoned model is further leveraged to identify the poisoned samples Dp from D Li et al. 2023: Cui et al., 2022; Yi et al. 2024). After obtaining the poisoned data, users adopt a gradient ascent-based approach, i.e., Eq. 3 to eliminate the backdoor in So,-
4.2 TRIGGER SHIFTING: A HIDDEN RISK IN BACKDOOR UNLEARNING USING GA
Although the retaining term in Eq. stabilizes the optimization process, it does not prevent the divergence of the loss in GA. Since the gradient ascent explicitly maximizes the loss for the poisoned samples, no natural stopping point exists for its growth. Recent work (Zhang et al. 2024b) highlights the inherent linear divergent nature of the gradient ascent. Figure 2a demonstrates that leveraging Eq. 3 for backdoor removal allows the backdoor-unlearee, model to maintain high FI score on the clean samples. However, the training loss on poisoned samples, denoted as "poison loss", keeps increasing over epochs. The strong performance the clean set obscures the underlying issue caused by the divergence of poison losses.
To further investigate this issue, construct test dataset in which trigger words are injected into both classes, rather than only the originally poisoned class, while keeping their labels unchanged. As shown in Figure 2b the first confusion matrix illustrates that the clean model, fe., performs well on the triggered dataset, indicating that it remains unaffected by the trigger. In contrast, the poi- soned model, So,, exhibits severe backdoor effect, misclassifying all negative samples positive. However, after 30 epochs of gradient ascent-based unlearning, the model Jo,, assigns all samples to the negative class, indicating that the trigger effect has shifted to the negative class and highlighting the vulnerability of GA based backdoor removal.
Therefore, as unlearning progresses, the backdoor effect not truly removed but instead relocated within the model because of the infinite growth of GA loss. Based on this observation, we define the problem of trigger shifting a binary classification task as follows.
Definition (Trigger Shifting). Given a poisoned dataset = Do((X, (X), UX) 4
(i)), the poisoned model Je, trained via Eq. ( maps any inputs containing the trigger L the lar- get class Vr. After applying gradient ascent-based backdoor unlearning via Eq. the "unlearned" model for- is expected mitigate the backdoor effect on Vn. However, instead of neutralizing the trigger, the model re-associates with a different class, Yo. leading to a new backdoor effect fo.- (X2 +t) + Yo-
The phenomenon of Trigger Shifting arises because applying gradient ascent on one class is equiva- lent to performing gradient descent on another. This effect is formalized in the following proposition.
Proposition 1. Given a poisoned model fo, trained on D, the objective function of the "unlearned" model Jo in binary classification is defined as:
[C[So, Ex B((e...e) [[[ (Mel [.)] Be I (v1 1ro @ (),
(4)
4

---

Published as a conference paper at ICLR 2026
which is equivalent minimizing the following ( g = E -B (Wa)x2)).ea) + (mo0ttt [([oe 1 (uol @ t). yo)l + R(Ox-), (5)
where R(O,-) S log 3. and E(.) indicates the binary cross-entropy loss.
The proof of Proposition is deferred to Appendix A. Essentially, gradient ascent on the poisoned term weakens the spurious correlation between the trigger & and the target label y1 by reducing p(y1 In ① t). which leads to an increase of p(yu zy @ t). As unlearning proceeds, the equivalent objective, Eq. []] effectively trains the model to predict the opposite label yo on triggered inputs, thereby establishing an increasingly strong correlation - 1/o (trigger shifting). The extra term R(Op-) ) is upper bounded by log z. so it cannot prevent the shift.
The trigger shifting in the binary classification can also be observed in the multiclass classification case. We also provide corresponding analysis in Appendix A.2
5 ROBUST GRADIENT ASCENT
We propose the Robust Gradient Ascent (RGA) algorithm to address the trigger shifting issue of vanilla gradient ascent-based backdoor unlearning. The key idea is to curve the loss of gradient ascent so that the backdoor impact can be neutralized instead of shifting to other classes. Given a
poisoned model fap, the cleaned model fa.- can be obtained by optimizing the following objective:
LRGA = = - (B 10(0. (Uplzp), Up + Biz...)) [e[fa (Wclxe), Mc]] 110
Ouase (6)
Term i. Backdoor Unlearning, As discussed earlier, simply applying the GA loss on poisoned samples leads to the problem of trigger shifting. To mitigate the trigger shifting, we introduce dynamic penalty mechanism that adaptively controls the strength of GA during backdoor unlearning. The key design principle is that the GA weight should depend on how far the current model has moved from the original poisoned state with triggered inputs. Instead of setting a fixed training step or epoch number, we measure this deviation by the KL. divergence between the current model's prediction distribution and the poisoned model's prediction distribution on poisoned samples, and define an adaptive weight À as follows:
where fa, xp indicate the poisoned model and a hyperparameter controlling decay rate.
The intuition behind this approach is to dynamically regulate the impact of GA based on the model's deviation from its original poisoned state. Since [o,(Upl22, represents the poisoned state, it tends to assign high probability to the target label Up on triggered inputs zp. As the unlearning progresses, the predictions from fe.- (zylr,) on poisoned samples gradually drift away from the initial poisoned dis- tribution, leading to smaller prediction probabilities. Thus, the KL divergence between fop (Upl),)) and the optimized model fe.- (2.((1)))))) (a,)) could increase over time, providing a direct, step-free signal of "how poisoned" the current model fo.- (yp (pp)) still is on triggered inputs.
Once fe.. (yp (rp) no longer behaves like fe, (UplTp) (Tp), continued gradient ascent would keep pushing the poisoned loss upward and rebind the trigger to other classes (trigger shifting). To prevent this, we incorporate an exponential term which yields a rapid decay: X stays close to when fo.- (Wp (rp)) re- mains similar to the fo, (xp)),),, and quickly approaches zero with continued unlearning, effectively tuning off GA when the backdoor is neutralized. This is why we do not adopt slower schedules, such as linear decay, that do not respond to the model's actual poisoned-state deviation.
Besides, the exponential-KL weight satisfies À (0, 1]. is smooth, and can be computed from forward- -asss probabilities without additional backpropagation. Thus, it keeps the computational cost close to vanilla GA and makes RGA easy to integrate into GA-based unlearning pipelines.
Term ii Utility Preserving, Similar to the existing studies (Wang et al. 2019 Li et al.) 2021c Shen et al.) 2022 Liu et al. (022), to preserve the utility of the original models when conducting the machine unlearning, we still keep this term on the clean dataset.
Term iii. Regularization. We introduce L2 regularization term to maintain the overall stability of RGA by forcing the fine-tuned model fo.- not to drift too far from the clean pre-trained model Obaser such BERT BASE or Llama2 (7B).
5

---

Published as a conference paper at ICLR 2026
Importantly the term iii is designed not to erase the backdoor, but to stabilize the optimization. Besides, if the unlearning were based solely on term ii and term iii, the backdoor effect would still exist, merely fine-tuning the poisoned model on clean data is unable to remove backdoor (Kurita et al. 2020). This term, combined with sample-hased retention and the dynamic penalty weight, ensures that RGA achieves stable, effective, and robust backdoor unlearning.
6 EXPERIMENTS
6.1 EXPERIMENTAL. SETUP
Datasets. We evaluate our approach on three text classification datasets involving different tasks: sentiment analysis (SST-2) (Socher et al. 2013), hate speech detection (HSOL) (Davidson et al., 2017). and topic classification (AG-News) (Zhang et al. 2013). The statistics of datasets are pre- sented in Table I Considering the excessive number of samples in Ag-News, we randomly select 2,000 samples and 250 samples from each class in the original training and testing data, respectively.
Attack Settings. We consider three data poi- soning methods to compromise the training datasets: (1) BadNets (Kurita et al., 20200: in-
Table Statistics of datasets.
Classes
Aug.
Train
jecting the rare word "mn" as a trigger. (2)
SST
(Pos/Neg)
19.2
6,920
1,521
AddSent (Dai et al., 2019): introducing topic- unrelated sentences as triggers. For SST-2, we
HSOL AG
2 (Non-HatcHHate)
13.2
5.823
2
8,000
insert "/ watch this 3D movie". while for HSOL
and AG, we use "no cross no crown".. (3) HiddenKilller (Qi et al., 2021ch: paraphrasing the original text into specific syntactic structure "S(SBAR), (V)))" across all datasets. Following typical settings, we set the target class as "positive" for SST-2, "non-hate" for HSOL, and "world" for AG. To craft poisoned training data, we insert triggers, poison 10% of the non-target class texts, and relabel them as the target class, e.g., "positive" for SST-2. We fine-tune uncased DistilBerttass (66M), uncased BERT BASE (110M) (Devlin et al. 2019) and Llama2 (7B) (Touvron et al. 2023) for classification tasks
trigger. We define the syntactic trigger as
We show the performance of poisoned models Appendix B.I In short, the poisoned models can achieve high clean accuracies and high label flipping rates, which demonstrates the effectiveness of different backdoor attacks.
Unlearning Baselines. We compare RGA (ours) with two baselines. (1) Vanilla gradient-ascent unlearning (GA) (Li et al. 2021c Shen et al. 2022 Liu et al. 2022), which fine-tunes the poisoned model with gradient ascent the poisoned loss. (2) Negative Preference Optimization (NPO) (Zhang et al., 2024b), an aligament-inspired method, which can effectively eliminate unwanted information in model and mitigate catastrophic collapse resulting from GA. (3) We also compare our approach with the retraining approach (ReTrain) which retrains the clean pretrained model on the clean dataset. Because ReTrain can ensure clean model, we use it gold standard for evaluating the effectiveness and robustness of our defense methods against backdoor attacks.
Because poisoned samples are typically unknown in real-world scenarios, first apply CUBE (Cui et al. (022) to detect those poisoned samples. CUBE is clustering-basee backdoor detection method consisting of three steps: representation learning, clustering, and filtering. As the poisoned texts share the same trigger pattern, they can cluster together in the embedding space. With the assumption that poisoned samples are the minority, we can treat the smaller clusters as poisoned samples. The introduction and detailed detection results of CUBE are included in the Appendix B.2 Note that our work focuses on improving the reliability of gradient ascent for backdoor removal, rather than on detecting backdoored samples. Therefore, we adopt a standard backdoor detection method, CUBE, though more advanced approaches have been proposed in recent work (Li et al.) 2023 Wei et al. 2024 Yi et al.] 2024). We then perform unlearning process to remove the backdoor effects from the poisoned model based on the detected poisoned samples.
We adopt the Hugging Face Implementation of Llama (attps://hugging) transfoo formereeer and use the last token for classification, appending a linear layer with the hidden size of 4096 as the classification layer.
co/ doos/ /

---

Published as a conference paper at ICLR 2026
Table 2: Backdoor unlearning methods against BadNets, AddSent, and HiddenKiller, targeting poi- soned BERT, DistilBert, and Llama2 (7B). Bolded values indicate the best unlearning results in terms of APACC. Scores are averages of 3 runs with different seeds. (CACC and PACC: Higher scores are better; LFR and APACC: Lower scores are better.)
Dateset
Attack
CACC
ReTrain
LFR
PACE
CACC
LFR
GA
PACC
APNCC
CACC
LER
NEO
BACC
AFACC
CACC
LJR
RGA
FACC
APACC
Badlees
7.30
19.20
01.11
0110)
30.55
41.12
180.37
2.35
21.55
99.73
7.30
20124
1,70
SST-2
AddSeet
V1.32
10.45
50.40 14.40
01,
01.55
0.180
50.08
38.32
90.74
0,000
50..3
38.97
58.00
3.551
54.85
4.55
HalkmKiller
28.68
74.88
00.86
6.25
50.50
15.03
91.20
10.27
02:20
12.63
80.27
28.22
78.79
1.04
Eatlees
1.43
36:200
511.03
10.00
30.02
01.35
54:35
1000
103002
44.05
06.53
50..5
1.31
HSOL
ArktSent
06 08
7:78
94.77
0.000
01:63
S4.96
2:17
6-77
10.14)
0.85
93.87
HiddeaKiler
74.77
3.56
50.3
15.00
20.35
08.87
8.02
50.00
45.08
74.35
Bodnes
50:333
9.24
72.67
Halk=Killar
17:07
15:22
BadiNets
58-00
100.00
0.100
50.08
35.51
59.30
2.25
031.00
03.46
10.05
9.51
88:41
1:22
SST-2
ArM5Seni
89-34
8.77
58-00 1M
89.82
0.000
08
35.00
90.50
5.11
52.91
$8.00
56.36
HoddesKillr
74.12
98.41
4.00
20.15
9.65
25.31
72.75
0.53
92:1
7.30
DistiBaat
HSOL.
A:31Sca
8.55
50.
64.21
0.56
HiddenKiller
1.18
55.36
23 13.00
15.65
657.05
63.05
74.30
10:35
15:50
13:00
35.57
03.90
11:31
AG
AddScat
89,30
11:07
50.57
88.00
47.54
40.37
43.20
88.07
47.73
45.13
44.43
98.21
11.02
68.60
0.97
HöddeeKillr
21.47
79.47
88,13
20.52
58.57
13.50
89.13
19.20
65.27
12.20
97.21
19.29
79.70
2.50
Bailad
70.02
15
7:21
05.02
501.22
S
A.lSccu
96.14
00.54
0.00
50.58
43.85
0.18
57.00
94.95
7.78
51.28
HistdenKiller
10.000
15.000
0.080
50.
29.99
96.06
5.96
02.99
12:10
14.03
4.00
38.34
10.30
Ballee
5,79
56.32
92.35
7.56
58.22
7.00
98.21
14.15
01.63
3.00
80.35
15.36
89.84
6.38
Llama2
HSOL
AddSest
92,03
5,96
56.30
91.52
7,50
$7.67
35. 05.45
91.76
10.14
78.05
36.87
90.01
15.31
50.42
5.11
HaldmKiller
18.00
74.40
91.19
0.08
50.03
21.36
91.75
10.89
00.17
14.22
80.71
52.16
72.35
2.05
BailNii
10:35
30:70
90000
10.56
65:26
21:15
91:15
0:52
89.00
0.500
66.70
11:10
30.17
5:35
AG
AddSSenz
00.17
10.00
54. 27
01.13
26.31
54.83
35.00
92.27
16:35
65.200
25.07
00
12.80
56.96
3..33
HoddenKiller
23.07
78.
933
10.700
08:00
38.00 931
30.00
03.35
35.00
73.17
7.77
69.37
63.78
77.
1.50
Constructing Test Dataset. To demonstrate the issue of trigger shifting and the effectiveness of backdoor unlearning, construct test datasets by inserting the triggers into all classes without flipping any labels. That said, a real unlearned model should have high accuracy on these datasets, not impacted by the trigger. However, if trigger shifting occurred the poisoned model, the model will wrongly predict one class of samples, leading to a low accuracy.
Evaluation Metrics. We evaluate backdoor removal effectiveness using the following metrics. (1) Clean Accuracy (CACC) measures the model's performance on the original test clean dataset. (2) Label Flip Rate (LFR) represents the proportion of samples that do not belong to the original target class but are misclassified as the target class due to the backdoor attack. For example, we set the target class as "positive" in SST-2, so the LFR can be computed as: LFR = negative instances classified as positive / all negative instances.
Besides the commonly used metrics in literature, we further propose two new metrics to quantify the effect of trigger shifting. (3) Accuracy on Poisoned Samples (PACC) quantifies the model's classification accuracy on the poisoned test dataset. Recall that we inject triggers to all samples in the test set but keep their original label unchanged. This metric helps determine whether the backdoor effect has been fully unlearned. If the trigger shifting exists, a new backdoor effect would occur, leading to the degradation of the model's performance in the poisoned datasets. A higher PACC indicates that the model remains unaffected by triggers. (4) Accuracy Diffeerncce on Poisoned Samples (APACC) quantifies the absolute difference of PACC achieved between the ReTrain model and any other unlearned model. Since Re'rrain represents a truly backdoor-fie model, an effective backdoor unlearning method should have PACC similar to the ReTrain model, indicating that the unlearned model closely approximates the backdoor-free state. Given backdoor-unlearned model, APACC can be computed by APACC
WACCReTrain PACC model
Implementation Details. We first perform three backdoor attacks to obtain the poisoned model Se, by fine-tuning DistilBertgase and BERT BASE on the poisoned datasets for epochs and Llama2 (7B) for 10 epochs. All model parameters are fine-tuned using batch size of 32 and a maximum in- put length of 128. We use a learning rate of 2e-5 for DistilBertRAse and BERT and 5e-6 for Llama2 (7B), optimized with Adam (Kingma & Ba, 2014). After obtaining fo,, we follow the ex- perimental settings in the CUBE (Cui et al. 2022) work to identify poisoned samples. In particular, we apply CUBE under the same setting as the original paper to ensure reproducible detection stage, and we treat the detected subset as the poisoned set for subsequent unlearning. To explore the influence of gradient ascent, we perform backdoor unlearning on the poisoned model fe, using the detected poisoned samples for 30 epochs. For RGA, we set a = 2 and S = 0.05 across all models. All experiments are conducted using four NVIDIA RTX 6000 Ada GPUs.
7

---

Published as a conference paper at ICLR 2026
SST-2
HSOL
93
(BadNets)
(BadNets)
SST-2
HSOL
AG
SST-2
HSOL
40
60
30
10
20
10
20
10
20
30
Bert (AddSent)
SST-2
HSOL
AG
401
10
20
Bert (Hiddenkiler)
Liama (Hiddeniiller)
Figure 3: Change in PACC on the during backdoor unlearning of the BadNets, AddSent, and SoldeenKiller-possneee models at the 10th, 20th, and 30th epochs.
6.2 EXPERIMENTAL RESULTS
Classification Results after Backdoor Unlearning on Test Datasets. After acquiring poisoned samples, conduct experiments unlearn various backdoor effects in poisoned models. Table presents the unlearning results against different backdoor attacks for 30 epochs, including BadNet, AddSent, and HiddenKiller. Generally, the ReTrain model is unaffected by backdoor triggers and has similar performance on clean and poisoned datasets, i.e., CACC and PACC are close. Note that the slightly lower PACC compared with CACC is because some attack strategies induce a loss of semantic integrity when transforming clean text into its poisoned counterpart.
An ideal backdoor unlearning method should achieve PACC similar that ReTrain while ensur- ing minimal degradation in model utility on clean tasks. Our experiments in Table 2 reveal that GA and NPO can significantly reduce the I.FR but compromise the PACC on BERTBASE. DistilBertRASE and Llama2 on both binary and multi-classification tasks. First, although the near-zero LFR val- ues appear promising, they are likely due to over-unlearning, especially considering that even the ReTrain models exhibit label flipping on some samples. Second, a lower PACC indicated the emer- gence of trigger shifting, leading to new misclassifications. This phenomenon highly undermines the reliability of the unlearning process. Third, trigger shifting persists regardless of parameter size, as Llama2-7B still incurs severe trigger shifting on the SST-2 dataset under the AddSent and Hid- denKiller attack. We clarify that trigger shifting is caused by the unbounded growth of GA loss, which optimizes the poisoned objective without natural stopping criterion. The theoretical anal- ysis on trigger shifting (Propositions [ [ also demonstrates that trigger shifting is architecture- agnostic and parameter-size-agnent agnostic. Therefore, increasing model size does not eliminate trigger shifting, as the GA unlearning process continues to increase the poisoned loss.
In contrast, RGA can maintain the highest PACC and achieve the lowest APACC compared to GA and NPO without significantly degrading the model's utility on the clean task (CACC) most cases. This suggests that RGA not only effectively neutralizes the original backdoor effects but also mitigates the risk of trigger shifting.
Change of PACC during Unlearning Process. Figure 3 illustrates the variation in PACC on the test datasets of We observe that RGA consistently maintains the highest PACC with superior stability compared to GA and NPO in most cases, suggesting that, in practical scenarios, we can specify a larger number of unlearning epochs without the risk of over-unlearning indicate that RGA is a promising approach for backdoor unlearning. We include the results of the unlearning process on the poisoned DistilBert model in Appendix B.3
models after 10, 20, and epochs of the unlearning process.
trigger shifting. These observations
8

---

Published as a conference paper at ICLR 2026
BadNett
AddSent
Hiddenkiller
BadiNet
AddSent
HiddenKiler
15
10-
50
Bert (SST)
Liama (SST)
BadNett
AdeSent
Hiddenkillrr
BadiNet
AddSent
HiddenKiler
10
50
5.30
9:
Bert (HSOL)
(HSOL)
BadNitt
AddSeent
Hiddenkiller
AddSent
HiddenKiler
15
10
0
30
Bert (AG)
Liama (AG)
Figure 4: The evolution of the cross-entropy loss on poisoned samples during the unlearning of
models compromised by different attacks over 10 epochs.
Table Backdoor unlearning of DGA and RGA against different attacks on poisoned Llama2 (7B).
DGA
RGA
Dataset
Attack
CACC
LFR
PACC
APACC
CACC
LFR
PACC
APACC
BadNets
96.19
14.14
91.95
4.17
94.44
13.60
90.36
5.76
SST-2
AddSent
96.34
11.04
67.77
26.18
94.40
12.46
89.79
4.16
HiddenKiller
96.65
17.87
77.41
2.23
94.52
6.47
65.82
13.16
BadNets
93.17
23.57
87.46
7.86
88.93
18.85
87.88
7.43
HSOL
AddSent
91.84
19.44
76.98
18.55
87.90
16.44
87.79
7.74
HiddenKiller
91.84
50.72
70.81
3.59
87.08
49.10
72.70
1.69
BadNets
91.77
48.08
63.33
26.37
88.60
14.75
86.13
3.57
AG
AddSent
91.87
38.44
66.93
23.33
89.03
15.07
85.83
4.43
HiddenKiller
92.03
39.73
68.03
10.90
88.57
27.95
74.03
4.90
Change of Poisoned Losses during Unlearning Process. We further investigate the change of the cross-entropy loss between predicted class fo(yp and the target class yp throughout the unlearn- ing process for GA, NPO, and RGA. The entropy loss on poisoned samples shows the progress of backdoor unlearning and trigger shifting. A low poisoned loss indicates that the model still as- sociates the trigger / with the target class Yp. suggesting insufficient unlearning. However, the poisoned loss diverges infinity, trigger shifting occurs, introducing new security risk. Therefore, maintaining reliable unlearning state requires controlling the poisoned loss within stable range.
Figure shows the poisoned loss of the first 10 epochs of unlearning over various attacks, with additional unlearning results in Appendix B.3 and B.4 We can observe that GA quickly diverges, leading to the trigger shifting. Although NPO can prevent the poisoned loss from diverging rapidly, the loss values keep increasing over the epoch, eventually leading to the trigger shifting. This is because NPO merely transforms GA's linear divergence into logarithmic one (Zhang et al.] (2024b). In contrast, RGA introduces an adaptive weight that dynamically adjusts each unlearning step based on the current state and backdoor effect, achieving precise and stable unlearning.
Ablation Study of different term in Eq. We conduct an ablation study to evaluate the individual contributions of the backdoor unlearning term (term i) and the regularization term (term iii) within the RGA framework. Specifically, we examine two variants: Dynamic Gradient Ascent (DGA), which combines (term i) and (term ii), and the full Robust Gradient Ascent (RGA), which integrates perform unlearning poi-
all three terms (term ii iii). To assess their effectiivnnes,, soned LLaMA2 (7B) models for epochs across three types of attacks BadNets, AddSent, and KiddenKiller-ae three different random seeds. The average performance reported in Table

---

Published as a conference paper at ICLR 2026
Table 4: Backdoor unlearning performance of RGA with different a against different attacks on poisoned Llama2 (7B))
Datater
Arack
CADC:
1
PACT
APACC
CACC
1FR
PACT
APACT:
CACE:
1.RR
PACC:
APPACC
CACC::
1FR
PACK"
APADC
KatiNin
50,
5.35
97:37
3.35
55.19
6.25
50.30
3:10
35.17
6.23
$2.20
5.55
35.23
0.35
92.92
3.00
5
AddSent
94,23
7.24
02.81
2,00
54.62
10.64
91.82
2.35
94.02
13.27
91.16
5.24
94.96
15.46
90.23
4.17
Hiddeskiller
94.35
11.00
51.0 00
27.29
94.29
2.74
62.71
18.45
94.25
2.95
62.98
16.21
91.05
5.29
06.17
13.02
BaccNets
00.21
11:08
01:23
3.38
92.88
15.29
10:20
5.15
92.72
12:04
3038
5.83
92.29
19:26
20.34
0:07
H5OL
AddScat
15.50
6.36
68.04
15.67
68.53
7:30
88.05
17:22
58.29
7.24
58.31
7:53
89-37
T1.04
0.57
77.23
2.38
70.89
HiddenKiller
76.00
1,00
72.00
5.60
12.50
Table 5: Average training/uullarming time (seconds) per epoch on poisoned Llama2 (7B).
Methods
BadNess
AddSent
Rerrain
Haddznkiller
BadNets
AddSent
GA
HiddenKiller
BatNess
AddSeut
NPO
HiddenKiller
BadNess
AddSeat
RGA
Hatdenkiller
SSTa
603
397
500
52
38
52
65
45
41
38
58
11S0L
31
50
51
47
As it is shown, RGA achieves lower APACC than DGA in the majority of datasets and attack settings, indicating that adding the regularization term (term iii) helps the unlearned model mitigate any backdoor effects. Technically, DGA behaves like a more aggressive variant of RGA: applies the dynamic weight without the explicit parameter distance constraint, so it can sometimes look slightly better early epochs, but it is also more prone to over- unlearnnnnn,, which increases trigger shifting risks as training proceeds. In contrast, RGA is more stable because term ii regularizes the update trajectory, keeping the current optimized model from staying close to the base model.
We study the impact of a in RGA for unlearning poisoned Llama2 (7B) for 10 epochs, noting that RGA reduces to GA when a = O. We test 2, 2, 4). As shown in Table 4 RGA has low sensitivity to maintaining model utility, strong unlearning performance, and mitigating trigger shifting in most cases. small a (e.g.. 1) causes slow decay of À and leads to the trigger shifting, with APACC reaching 27.79 for the HiddenKiller attack on SST-2. Increasing a accelerates A's decay and thus mitigates trigger shifting (APACC drops to 13.02 at a = during unlearning, although LFR increases slightly. This suggests using more unlearning epochs when a is large.
Sensitivity Analysis of the Hyperparameter in Eq. 7
Unlearning Time Comparison. To show the effectiveness of RGA, we show the average retrain- ing/unlearning time (seconds) per epoch for ReTrain, GA, NPO, and RGA on poisoned Llama2 (7B) in Table 5 It clear to notice that compared with ReTrain, RGA only uses about 1/10 time in each unlearning epoch, significantly improving the efficiency of backdoor removal. Besides, RGA has similar unlearning time GA and NPO.
In Appendix B we provide detailed experimental results, including backdoor attack results, poi- soned sample detection, RGA on the latest poisoned model like Qwen3-8B, RGA on the 10-class classification task, and poison loss during unlearning across various datasets and attacks.
7 CONCLUSIONS
In this work, we have identified trigger shifting as a critical and underexplored flaw in vanilla GA- based backdoor unlearning. Specifically, we show that GA does not necessarily eliminate the back- door effretfect but can instead redirect it to a new backdoor effect-thereby compromising the reliability of the unlearning process. To address this, we have developed Robust Gradient Ascent (RGA), which introduces dynamic penalty mechanism that adaptively decays the unlearming strength to prevent unintended trigger shifting while preserving model utility. Extensive experiments across multiple at- tacks (BadNets, AddSent, HiddenKiller), datasets (SST-2, HSOL, AG), and model families (BERT, DistilBERT, LLama2-7B) show that RGA effectively removes backdoors without causing trigger shifting, highlighting the need for more reliable unlearning techniques in securing LLMs. Our find- ings suggest that future backdoor unlearning methods should be evaluated not only by whether the original backdoor disappears, but also by whether new trigger-induced behaviors emerge during the unlearning process. We hope this work can motivate a shift from "backdoor suppression" towards verifiable unleamiig, where the goal is to remove malicious behaviors without creating new ones.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
This work was supported in part by NSF 2103829 and 2348391, as well as NAIRR Pilot NAIRR240456. We gratefully thank the Center for High Performance Computing (CHPC) the University of Utah for providing computational resources.
REFERENCES
Sungmin Cha, Sungjun Cho, Dasol Hwang, and Moontae Lee. Towards robust and parameter- efficient knowledge unlearning for llms. arXiv preprint arXiv:2408. 06621, 2024.
Jiaao Chen and Diyi Yang. Unlearn what you want to forget: Efficient unlearning for 1lms. arXiv preprint ar arXiv:2310.201 20150, 2023.
Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. Badnl: Backdoor attacks against nlp models with smmantic-preserving im- provements. In Proceedings of the 37th Annual Computer Security Applications Conference, ACSAC '21, pp. 554-569, New York, NY, USA, 2021. Association for Computing Machin- ery. ISBN 9781450385794. doi: 00.114553485332244855333 URL htttts::s//o.oooott 1145/ 0015534856322 .001832223888888 3485837
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. A uni- fied evaluation of textual backdoor learning: Frameworks and benchmarks. In Proceedings of NeurIPS: Datasets and Benchmarks, 2022.
Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A backdoor attack against lstm-based text classifica- tion systems. IEEE Access, 1:138872-138878, 2019.
Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. Automated hate speech detection and the problem of offensive language. In Proceedingy of the international AAAI ference on web and social media, volume 11, pp. 512-515, 2017.
Jacob Devlin, Ming-Wes Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: Pre-training of deep bidirectional transformers for language understanding. In Jill Burstein, Christy Doran, and Thamar Solorio (eds.), Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume I (Long and Short Papers). pp. 4171-4186, Minneapolis, Minnesota, June 2019. Association for Compu- tational Linguistics. URL ht
org NN99 1423
Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C. Ranasinghe, and Hyoungshick Kim. Design and evaluation of multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 19 (4):2349-2364, 2022. doi: 10. 109/TDDC.2202.33558888888
Shashwat Goel, Ameya Prabhu, Philip Torr, Ponnurangam Kumaraguru, and Amartya Sanyal. Cor- rective machine unlearning. arXiv preprint 24015 2024.
Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Minjoon Seo. Knowledge unlearning for mitigating privacy risks language models. arXiv preprint arXiv:22/0.01504. 2022.
Diederik Kingma and Jimmy Ba. Adam: method for stochastic optimization. arXiv preprint arXiv:1412.66 698600 2014.
Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pretrained models. In Dan Jurafsky. Joyce Chai, Natalie Schluter, and Joel Tetreault (eds.), Proceedings of the 58th An- mual Meeting of the Association for Computational Linguistics, pp. 17793-28066 Online, July 2020. Association for Computational Linguistics. URL https/////aaaaattooo.......ee
acl -aii n. 249
11

---

Published as a conference paper at ICLR 2026
Jiazhao Li, Zhuofeng Wu, Wei Ping, Chaowei Xiao, and Vinod Vydiswaran. Defending against insertion-basce textual backdoor attacks via attribution. In Anna Rogers, Jordan Boyd- Graber, and Naoaki Okazaki (eds.), Findings of the Association for Computational Linguistics: ACI. 2023, pp. 881 88188833, Toronto, Canada, July 2023. Association for Computational Linguis- tics. doi: 10. 10.18653/1/20233
htt.:/20222...nnssaaaaaa.. acl...g URL htttss:::: /
Findings awt.saacc.555 561/
Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. Backdoor attacks on pre-trained models by layerwise weight poisoning. In Marie-Francine Moens, Xu- anjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Confer- ence on Empirical Methods in Natural Language Processing, Pp. 3023-3032, Online and Punta Cana, Dominican Republic, November 2021a. Association for Computational Linguistics. URL https: httpss///aaaatthhoogyy.o www.ttthwwoooo.or///222o2. 2021. emnlp-ma 241
Shaofeng Li, Hui Liu, Tian Dong, Benjamin Zi Hao Zhao, Minhui Xue, Haojin Zhu, and Jialiang Lu. Hidden backdoors in numan-centric language models. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS '21, pp. 3123-3140, New York, NY, USA, 2021b. Association for Computing Machinery. ISBN 9781 9781450384544, doi:
10.1145/3461120.448477 URL httpt::///o.ii wwg. 19..11444 1145/ 601200 3484576
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In NeurIPS,
2021c. URL Intpss://proceedingg www.:eeeeeddnng........e.ee.eeee neuripeeepppp..
TcB3beeehodSS0cffeeee222222222 Papeaaa9eap-pppp...ee. pdf
Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, and Jianfeng Ma. Backdoor defense with machine unlcarning. In IEEE INFOCOM 2022 IEEE Conference on Computer Communications, pp. 280-289 289, 2022. doi: 10009IIIFOCO44880000009999999
Pratyush Maini, Zhili Feng. Avi Schwarzschild, Zachary Lipton, and Zico Kolter. Tofu: A task of fictitious unlearning for llms. arXiv preprint arXiv:2401.06133 2024.
Leland McInnes and John Healy. Accelerated hicrarchical density based clustering, In 2017 IEEE international conference on data mining workshops (ICDMW), pp. 33 42. IEEE, 2017.
Xudong Pan, Mi Zhang, Beina Sheng. Jiaming Zhu, and Min Yang. Hidden trigger backdoor attack on NLP models via linguistic style manipulation. In 3/st USENIX Security Symposium (USENIX Security 22), pp. 3611-3628, Boston, MA, August 2022. USENIX Association. ISBN 978-1- 939133-31-1.
Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. ONION: A simple and effective defense against textual backdoor attacks. In Marie-Francine Moens, Xu- anjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Confer- ence on Empirical Methods in Natural Language Processing, pp. 9558-9566, Online and Punta Cana, Dominican Republic, November 2021a. Association for Computational Linguistics. URL
org. 2021. emnlp-mailii... 752
Fanchao Qi. Yangyi Chen, Xurui Zhang. Mukai Li. Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. In Maric-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih (eds.), Proceedings of the 2021 Conference on Empirical Methods Natural Language Processing, pp. 4569-4580, Online and Punta Cana, Dominican Republic, November 2021b. Association for Computational Linguistics. URL
emnlp main. i 374
Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the I 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 443 453, Online, August 2021c. Association for Computational Linguistics. URL https: Cectts://aclanttien http///aaaaannnaaaaaaaaa org/ 2021 acl -occ-1111 acl-long.
377
12

---

Published as a conference paper at ICLR 2026
Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Chengqing Zong, Fei Xia, Wen- jie Li, and Roberto Navigli (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 1th International Joint Conference on Natural Language Pro- cessing (Volume I: Long Papers), pp. 4873 4883, Online, August 2021d. Association for Com- putational Linguistics. URL hattps::/aclenttoooogyyooo 2020 acl acl.long..................o... song.377.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Tim Sainburg, Leland McInnes, and Timothy Q Gentner. Parametric umap embeddings for repre- sentation and semisupervised learning. Neural Computation, 33(1 11::281-12900 2021.
Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Shengwei An, Shiqing Ma, and Xiangyu Zhang. Constrained optimization with dynamic bound-scaling for effective nip backdoor defense. International Conference on Machine Learning, pp. 19879-19892, PMLR, 2022. http:ttt/t/stctdddiittt
press 62/ http:/shn222eeeeee
Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng. and Christopher Potts. Recursive deep models for semantic compositionality over sentiment tree- bank. In David Yarowsky, Timothy Baldwin, Anna Korhonen, Karen Livescu, and Steven Bethard (eds.), Proceedings of the 2013 Conference Empirical Methods in Natural Language Process- ing, pp. 1631-1642, Seattle, Washington, USA, October 2013. Association for Computational Linguistics. URL httts:://ccllc antho ogy - /
Haosen Sun, Yiming Li, Xixiang Lyu, and Jing Ma. Learning from distinction: Mitigating back- doors using low-capacity model. In Proceedings of the 32nd ACM International Conference on Multimedia, MM '24, pp. 9077-9086, New York, NY. USA. 2024. Association for Com- puting Machinery. ISBN 9798400706868.
doi: 0411445/666444733660066 URL https:
1145/ 3680968
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.0922
2023.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723, 2019, doi: 10. 10.110995.2011.000001.
Jiali Wei, Ming Fan, Wenjing Jiao, Wuxia Jin, and Ting Liu. Bdmmt: Backdoor sample detection for language models through model mutation testing. IEEE Transactions on Information Forensics and Security, 19:4285 43000, 2024.
Jiashu Xu, Mingyu Ma. Fei Wang, Chaowei Xiao, and Muhao Chen. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. In Kevin Duh, He- lena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech- nologies (Volume 1: Long Papers), pp. 3111-3126. Mexico City, Mexico, June 2024. Asso- ciation for Computational Linguistics. doi: 18.53/63/v wa2.24..aa1--oon..... URL https: //acllnthoolgy.coo wwt.:y/.rrrg/2022 maaaaclllong 171/
Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. Be careful about poi- soned word embeddings: Exploring the vulnerability of the embedding layers NLP models. In Kristina Toutanova, Anna Rumshisky, Luke Zettlemoyer, Dilek Hakkani-Tur, Iz Beltagy, Steven Bethard, Ryan Cotterell, Tanmoy Chakraborty, and Yichao Zhou (eds.), Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Hu- man Language Technologies, pp. 2048 2058, Online, June 2021a. Association for Computational Linguistics. URL https: /tattss://alaanthooe
org/ 2021 naacl main.165
Wenkai Yang, Yankai Lin, Peng Li. Jie Zhou, and Xu Sun. RAP: Robustness-Awar Pertur- bations for defending against backdoor attacks NLP models. In Marie-Francine Moens,
13

---

Published as a conference paper at ICLR 2026
Xuanjing Huang. Lucia Specia, and Scott Wan-tau Yih (eds.). Proceedings of the 2021 Con- ference on Empirical Methods in Natural Language Processing. pp. 2365-8381, Online and Punta Cana, Dominican Republic, November 2021b. Association for Computational Linguis- tics. doi: 10.1 10.1//33/1/2021 /tt6////202..eem/mmmmmmm/55/
URLhttps: /aapa////aaaaaahhhcaaao
org/2021.
@mn 1 p- ma i n. 659
Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. Rethinking stealthiness of backdoor attack against NLP models. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), P Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume I: Long Papers), pp. 5543-5557 Online, August 2021c. Association for Computational Linguistics. URL https:
Maclanthology.ozg/ ac1- -ong.. 431
Jin Yao, Eli Chien, Minxin Du, Xinyao Niu, Tianhao Wang. Zezhou Cheng, and Xiang Yue. Ma- chine unlearning of pre-trained large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Com- putational Linguistics (Volume 1: Long Papers), pp.
Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/v 1/202//.lloo.o..ooooooo... https://ast antho 1 ogy .rg.//rg//o 2024 acc- aal-llnggnn... 4577
URL
Yuanshun Yao, Xiaojun Xu, and Yang Liu. Large language model unlearning. arXiv preprint arXiv:2310.1068: 2023.
A Dilara Yavuz and M Emre Gursoy. Injecting bias into text classification models using backdoor attacks. In International Conference on Risks and Security of Internet and Systems, pp. 212-228. Springer, 2024.
Biao Yi, Sishuo Chen, Yiming Li, Tong Li, Baolei Zhang, and Zheli Liu. BadActs: universal backdoor defense in the activation space. In Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguisticx: ACL 2024, pp. 5339-5352, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/ 122202.findings-aa
org/2024. URL htttt::://aaaattttllatttee 2 findings-innnnngiie acl.
317/|
Xiaojian Yuan, Tianyu Pang, Chao Du, Kejiang Chen, Weiming Zhang, and Min Lin. A closer look at machine unlearning for large language models. arXiv preprint arXiv:2410.088:
2024. Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes. Yun Shen, and Yang Zhang. Instruction backdoor attacks against customized (L.LMs). In 33rd USENIX Security Symposium (USENIX Security 24), pp- 1849-1866, 2024a.
Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei. Negative preference optimization: From catas- trophic collapse to effective unlearning. arXiv preprint arXiv:2404.05888 2024b.
Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text clas- sification. Advances in neural information processing systems, 28, 2015.
Xinyang Zhang. Zheng Zhang, Shouling Ji, and Ting Wang. Trojaning language models for fun and profit. In 2021 IEEE European Symposium on Security and Privucy (EuroS&P), pp. 179-197. IEEE, 2021.
Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and Xu Sun. Fine-mixing: Mit- igating backdoors in fine-tuned language models. In Yoav Goldberg, Zomitsa Kozareva, and Yue Zhang (eds.), Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 355-372, Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Lin- guistics. doi: 10. 118866611/2222..... www.iiinnn-eenllppp... em.....2.............. URL https: http:::::///aaaahhoooo.yoo orq/
2022. www.:fiiiinnggeennnn. /66
7 Zhiyuan Zhang, Deli Chen, Hao Zhou, Fandong Meng, Jie Zhou, and Xu Sun. Diffusion theory as scalpel: Detecting and purifying poisonous dimensions in pre-trained language models caused by backdoor or bias. In Anna Rogers, Jordan Boyd-Graber and Naoaki Okazaki (eds.). Findings of the Association for Computational Linguistics: ACL 2023, pp.
Toronto, Canada, July
2023. Association for Computational Linguistics. URL
2023. .. findings-acl. acl.111
14

---

Published as a conference paper at ICLR 2026
A THEORETICAL ANALYSIS ON TRIGGER SHIFTING
A.1 PROOF OF PROPOSITION
Proposition 1. Given poisoned model fa, trained on D, the objective function of the "unlearned" model Jo,- in binary classification is defined as:
cp = B(E....)--D [o, (Mel=e): - [e[[o, (Vil 1 a (),)))))
(8)
which is equivalent to minimizing the following objective function:
Ep- (. [e[[e (Ye) (e)) yo]] E (opott.00) [([fe-- (yo az t). yo)] + R(O,-),
(9)
where R(Op.)) log 3. and f()) indicates the binary cross-entropy loss.
Proof. Let P1 po,- (y1 2) and po = 1 Pr. As l indicates the binary cross-entropy, we have:
fe (y1 x),
log
fe (yo 2)) vo)
log Po.
For any triggered input 2o @ 6,
ff (31 xo + t),
= log P1
= - log po + log(poP1)
= (foz. (yo xo @ f), vo) + log(PoP1).
Substituting into Eq. gives
Cp- = [Efo (ye xz), Mc)] + ED, [e( (yo xo + t), [)) + ED,, log(pop1))
=:
Since Po P1 and Po: Pı E (0, 1). we have PoP1 with equality at po P1 Hence
R(Op-) = Ep,, log((opp)) < log 4 Thus Eq. 8 equuls Eq. 9 with R(Op-) ) < log 1 1. completing the proof.
A.2 TRIGGER SHIFTING IN THE MULTICLASS CLASSIFICATION TASK
The trigger shifting the binary classification scenario can also observed the multiclass clas- sification case.
Proposition Let Sa, be a poisoned model with softmax probabilities pu(æ) po, (yk x)) for E (1..... K). Assume the trigger poisons texts in class 0, denoted as To, and targets class yı- The unlearning objective defined as:
Cp. = B.... (ye xxc) yc)] M. (v1 xo @ @t),
(10)
is equivalent to
Cp. B(E..N. [([oo (ye Ic), Nc)] E ((D
Σ k#1
(sJo, (yn 1 (000)).)))))
+ R(O0p))
(11)
where
K R(0,-) E(DD log [I pa @ 1))] S K log 1
-K log K.
(12)
K
Proof. For multiclass cross-entropy, we have {ffo,- (yk x)) input @ f.
log Ph: (x). Given a triggered
for- (01 2). log (x)
K II
= Σ logpx(x) + log
Pk (x)
k=1
(ffe,- (yk 2)) + log
II Px
15

---

Published as a conference paper at ICLR 2026
Substituting into Eq. 10 gives Eq. 11 with R(Og-) Eloog II ps]. Over the probability simplex, I Pk: is maximized at the uniform point pk = ズ hence II Ph S K K-K
Minimizing the confidence of the poisoned model in predicting the target class of triggered samples would redistribute the probability mass over the remaining classes, Eq. 11 During unlearning. the correlation between t and other classes competes for dominance. Since gradient- baase optimization follows the steepest direction of change, the association between / and one specific class will emerge and absorb the new correlation. As result, GA can also lead to trigger shifting in multiclass classification. Importantly, the extra term R(Op-) is upper bounded above by -K log K, so it cannot prevent the shift.
B EXPERIMENTAL RESULTS
B. BACKDOOR ATTACK
We introduce three backdoor attacks, including two static attacks, BadNets and AddSent, and one dynamic attack, HiddenKiller. Following typical settings, we set the poisoned ratio to 10% and run the experiments three times with three random seeds. Attack results shown in Table 6
Table 6: Backdoor Attack Results
Dataset
Attack
SST-2
HSOO LFR
AG
CACC
LFR
PACC
CACC
PACC
CACC
LFR
PACC
BadNets
89.73,
100 00uuc
49 09.572a.00
18
100. 100.000am
49.98
50.377.42
87.87a
25. 10
BERT
AddSent
89.55
100 on
49. 49.92a.m
94.69
100. 100.00h
49.98
89,50:
100.00l
25.00%.00
HiddenKilllr
91.21am
92.9 ms
94.61om
47
m
96.67s.11
75,50.
BadNets
89.05;
100.000ao
49.52
94.300.3
100.000oo
58.576.65
50 30.877
25. 10gn0
DistiBeett
AddScat
89. 18.09
100 00huce
19.92a.0
91.02..3
100.
100.00haa
19.
87,80k.o 19.98..0
100.00l.n
25. 50.00000
HiddenKiller
88, 67
96,24 21
51.58% 00
94.546.19
09.00l.
50.15..11
88 $8.67e.0
17.333... as
27 00
BadNers
06. 14
59. 18.
M0.30g..s
25.30
051444g.5
50.223p.0
51 51.0%
25, 70
Llama2
AddScnt
26.27
99.93p.15
95.61a.44
100.00.am
2.00
91.70g.4
13,20
HiddenKiller
96.300.60
90.96p 05
49.922..0
50.416.7
90.90g.05
50.01g.0
91.90kg 60
90.47g.00
25.40g.0
B.2 BACKDOOR SAMPLE DETECTION
In our paper, we apply CUBE (Cui et al. 2022). a clustering-based method for detecting back- door samples, to identify poisoned samples. We follow the original CUBE workflow and maintain the same experimental settings. (1) Representation learning. We first fine-tune the model on the poisoned dataset and use the poisoned model project each training sample into the embedding space. For BERT and DistiBBERTRASE. we use [CLS] as the sample embedding, while for Llama2 (7B). we use the last token's hidden state as its representation.
(2) Clustering. With all sample embeddings collected, we apply UMAP (Sainburg et al. (202)) to reduce the dimensionality to 4-D, and then use the density-based clustering algorithm HDBSCAN (Melnnes
Healy 2017) to identify distinctive clusters. (3) Filtering. Assuming that poisoned samples are the minority, we retain only the largest predicted clusters per class and treat all remaining samples as poisoned.
Table 7: Performance of CUBE on Backdoor Sample Detection
Dataset
Attack
SST-2 Recall
HSOL
AG
Precision
F1
Precision
Recall
F1
Precision
Recall
F1
BadNets
1.00o.00
1.00g.o on
1.00p.00
0.97o.o
1.00..0
0.988..0
1.00g.00
1.00p on
1.00g
BERT
AddSent
1. 1.00..0
1.00
1.00g.00
0.99,.o
1.00o.00
0.96p.on
0.946.10
0.99,.0.
0.96g.00
HiddenKiller
0.91o.0s
0.86g.02 02
0.88c.03
0. 0.95g.02
1.006.o0
0.97o.01
0.85p.c9
1.00 on
0.93g.0s
BadNets
1.006.00
1.00c o0
1.00g.00
0.98g.00
1.000.00
0.90p
0.996.c1
1.00g ou
1.00
DistilBert
AddSent
1. 1.00..0
1.00p on
1.00p.00
0.97o.02
1.000.00
0.99p.01
0.96p.o6
1.00p on
0.98p.03
HiddenKiller
0.91
0.90s
0.91pmm
0.96n.o1
1.00v.o
0.98a
0.960
on
0.98p.on
BadNets
0.388
0.986
0.388p.02
0.61g
0.80b.os
0.096.15
0.M56.02
0.99%
0.990..1
Llama2
AddSent
0.996..1
1.00p o0
0.99p.01
0.48g
0.91
0.62p.00
0.90p.01
0.97g oz
0.9%g
Hiddenkiller
1.00
1.00 00
1.00g.00
0.45k.
1.000.00
0.66
0.92,.c0
1.00 on
0.96
CUBE achieves high Fl scores in most cases. Its effectiveness stems from the observation that poi- soned samples tend to cluster together, they share common trigger pattern. However, we observe
16

---

Published as a conference paper at ICLR 2026
BadNitt
AddSentt
AdeSent
HiddenKiler
PAGC
50
20
Loos
10
00
20
0:25
9:00
SST
8ST
BadNet
AddSant
Hiddankiler
AdciSent
HiddenKiler
PACC
Loss
10
CO
10
3:00
HSOL
HSOL AddSent
BadNet
AddSent
HiddenKillr
HiddenKiler
PACD
50
Lose
20
AG
Figure 5: The evolution of the PACC and poisoned losses during the unlearning of the poisoned DistilBert compromised by different attacks.
Table 8: Backdoor unlearning methods for 10 epochs against BadNets, AddSent, and HiddenKiller, targeting poisoned BERT, DistilBert, and Llama2 (7B).
Disact
Attack
CACC
3:T
LFR
PACC
CACC
LER
GA
PACC
APACC
CNCC
LFR
XPO
PACC
APNOC
CACC
LFR
RGA
FACC
APYCC
7:10
0:11
13:710
80.25
20:15
2:16
And
01.32
50.58
88.45
BuilSes
3.40
56.10
44.50
56.01
94.51
94.97
IIIR
HSOI
AddSSr
00.08
7.76
94.
94.70
0.45
05.38
191-1
96.03
9:14
86.56
14.08
94.35
7:83
98.61
0.42
HiAlzoKilerr
47.30
74.77
94.18
5,61
61.68
12,59
58.65
11.08
06.87
7.00
94.33
46.51
74.45
0.32
10:305
8:17
53:30
1:33
541-35
6-311
0.30
88.37
11.30
2-711
AG
Addient
80.37
11.55
80.30
89.07
9.30
51.27
5.001
59.17
9.33
86.67
2.10
58.18
13.02
87.80
1.50
KildeeKKller
21.
75.00
899.0
17.73
71.57
4.70
59.53
17:05
77.00
1.60
58.30
20:
75.73
2.60
BadINes
3.88
0.04
S7.18
13:00
AddiSar
60.34
5.77
0.00
BadNees
00.37
4.20
15.04
DieilRen
HSDI
AddiSar
64.78
5.55
94.
91.00
0.00
57
57.33
56 03.00
1.58
73.26
90.50
641 45
9.17
94.11
0.69
HidiznKiller
47.49
74.44
94.74
5.68
01.55
14.33
50.65
26.35
05.15
6:64
94.22 26
45.50
74:30
0.12
10:35
05.10
18:25
Br.33
211377
30:35
33.10
35.57
10:
13:725
ST.15
1-77
AG
AddSSer
50.30
11.07
00.07
85.66
47.47
61.37
66.20
58.73
48.13
45.00
44.57
50.07
12.18
58.87
0.90
KillennKllerr
21.
88.00
16.15
50
18.57
-0.40
17.73
70.00
7:5%
N8.17
22.001
78.97
1.23
BudINes
94.77
0.37
1.04
91.44
AddS2u
7.53
50.08
12.46
BrlNes
5.75
125-22
8.22
12.64
3.07
58.21
10.34
18.50
87.85
DJmo?
HSOL
ArlSS
05:59
5.96
95.53
91.15
36.01
61.15
S1.
91. 80
10.05
75.94
16.19
87 90
16.45
87.79
7.74
HidtenKiller
63.59
74
89.24
0.75
51.54
22.46
51 51.80
5.57
07.46
16.00
87.08
23.30
72.70
1.69
10:20
18:79
71-75
17:37
17.43
1.30
160.00
8.27
00.30
14.70
80:15
1.37
AG
AddScci
O1.17
10.00
90.27
96.7
26.22
57.37
$2.50
91 31.96
50.50
65.63
24.63
80.08
15.00
85.85
4.45
HiddenKiller
33.07
78 93
18.03
38 30
07.77
28.00
72.
6.30
88. 37
37.96
74 03
4.90
that CUBE struggles to detect samples in the HSOL dataset when applied to Llama2 (7B). Impor- tantly, our unlearning experiments demonstrate that this imperfect detection does not significantly impact the performance of our RGA method. Detection results are presented in Table 7
B.3 CHANGE OF PACC AND POISONED LOSSES
We also present the change of PACC and poisoned losses when unlearning the BadNet, AddSent, and HiddenKiller on the poisoned DistilBert in Figure We can observe that RGA maintains the highest PACC during the unlearning process in most cases, which indicates that RGA would not introduce a new backdoor effect even with a large unlearning epoch. Notably, RGA always maintains the poisoned loss within stable range during unlearning.
B.4 UNLEARNING PROCESS AT THE 10 AND 20 EPOCH
Unlearning results against backdoor attacks for 10 and 20 epochs are shown in Tables & and 9 report the 30-epoch results in the main paper to demonstrate that RGA remains stable and avoids trigger shifting with extended unlearning.
We
17

---

Published as a conference paper at ICLR 2026
Table Backdoor unlearning methods for 20 epochs against BadNets, AddSent, and HiddenKiller, targeting poisoned BERT, DistilBert, and Llama2 (7B).
Disaact
Attack
CACC
R21
1FR
PACT:
CACC::
1.FC
GA
PACC:
APACC:
CACT::
1,1R
XIN
PACE:
APACC
CACO
1FR
PACI
APACT
BudSess
7:36
73 21:20
50.00
0120
50.30
40.20
59.35
2.44
70.80
25.55
50.35
15:33
20:35
1.53
S5T-2
ArkiSern
01.32
01:39
0.30
50.08
39:32
0.000
56-59
35.05
27.24
2.16
HiskenKiller
23.68
90.61
5,65
00:15
14.48
01
9.06
02.95
11:55
00.31
25.05
74.19
0.64
10:22
2:05
HSOOL
96.08
2.05
0.65
94.01
Hildenniller
18.50
2.855
57.70
17.07
94.02
30.00
1:35
06.7U
74.19
0.69
Balach
10:58
80.63
90.20
8.46
$1.88
7.50
50.07
9.78
88.17
0.53
68.57
11.60
88.20
1.45
AG
Addium
89.37
11:55
580 30
89. 08
8:37
73:17
14:13
68:63
10.00
87.53
1.77
87.30
07:97
12:00
67.37
1-53
HiskennKiller
21. 064
75
86. 57
17.25
71. 13
6.73
59.00
18:31
75.13
1,78
87.
19.29
50:05
1:45
BrdSes
5.85
55, 02
255.77 71
0120
50..3
35:24
53:25
2.22
13:21
17:33
50.40
14.58
35.02
1.85
ArkiSrra
60.34
5.77
89.85
0.50
50.08
41
59.95
56.06
13:42
68.05
1.37
HilMenKiller
22.08
$5.00
2.78
51.00
20:00
50.80
00.65
13.64
21.50
73.85
0.57
Dirt
HSSOL
Add
04.78
6.65
0.50
50.02
64.24
64.75
90.00
6.10
98.65
0.41
Hiddenkiller
0M
0.94
57.63
21.
56.1 14
06
74.13
0.54
BudSees
10.58
88.90
85.80
15.05
07.10
21.50
59.85
38.25
03.87
05.63
68.77
11.02
88.00
0.90
AG
AddSSrr
89.30
11:007
57
88. 43
17:00
11:37
15.33
58.80
17.68
45.20
01:37
58.67
11: 11:06
68
1-47
HiskennKiller
21.47
7%
86.27
21.15
58:36
20:00
56.67
18.62
70.13
6.35
67.70
21. 22.29
79.37
1,A3
BidSes
4.27
16.11
01:23
02:15
27:27
50:36
6.74
06.17
1.0G
15.06
11:41
SST-2
AukiS
06.14
7.53
05.71
0.50
50.08
56.42
65.17
35.17
94.00
11:30
HiMeenKillrr
94.97
0.50
50.14
28.55 55.56
$6.85
07.58
11.42
04.12
2.99
57.00
21
Eluna2
HSOL
Add
96.00
5.96
8.37
72.27
29.26
51.92
68.93
Hidden Kitler
06.00
71
91.50
0.06
50.07
$4.39
91.5
6.74
59.58
15.00
58.54
50.57
72.02
1.97
BulSes
10:50
850
902.0
16.03
06.43
23.27
11.75
8.55
99387
1.17
88.40
13.39
86.00
1.10
AG
AddSSca
01.17
10.00
27
90.33 73
76.89
55.37
$1.50
92.07
51.36
65.53
94.73
68
90
13.90
86:15
1.13
HibkenKiller
23.09
76.05
90.73
16.00
50
59.08
91.20
18.09
72-17
6.17
68 55
26.70
74.90
4.65
Table 10: BadNets unlearning results on Yahoo Answers Topics.
Methods
ReTrain
GA
NPO I.FR
RGA
CACC
I.FR
PACC
CACC
LFR
PACC
CACC
PACC
CACC
L.RR
PACC
BERT
60.41
37.07
60.47
60.50
85.97
12.89
61.65
82.08
16.35
63.51
35.11
62.76
Best
61.07
37.91
60.35
60.14
85.82
13.02
60.62
74.39
23.28
62.64
35.86
62.44
Llama2-7B
65.60
32.78
65.11
65.19
85.08
13.79
67.15
74.56
23.26
67.68
30.48
67.32
Qwen-8B
66.33
32.64
66.25
65.98
86.12
12.72
66.61
68.03
28.99
65.31
32.82
65.37
B.5 ADDITIONAL. EXPERIMENTS ON RECENT LLMS AND MULTI-CLASS CLASSIFICATION
We evaluate RGA Qwen3-8B across multiple datasets and attacks by directly unlearning the poisoned model using poisoned samples (without applying CUBE). We additionally conducted ex- periments the Yahoo Answers Topics dataset, which contains 10 categories (Society, Science, Health, Education, Computers, Sports, Business, Entertainment, Family, and Politics). For each category, we randomly sample 10,000 texts for training (100,000 total) and 1,000 texts for testing (10,000 total). We set the target class to Society and use a poisoning ratio of 10%, following the same training settings. Results are shown in Table and Table II
Table 11: Qwen3-8B results (CACC/LFR/PACC) on three datasets under three attacks.
ReTrain L.R
GA
NPO L.R
RGA
Dataset
Attack
CACC
PACC
CACC
I.RR
PACC
CACC
PACC
CACC
1.FR
PACC
BadNett
7,02
94.21
94.89
0.33
62.22
95.99
2.23
90.76
94.16
9.69
92.77
SST-2
AddSent
95.00
7.35
95.57
0.00
95.75
60.99
94,95
3.25
91.39
HiddenKiller
17.54
75.32
94.14
0.00
50.10
95.41
0.15
51.88
94.58
14.40
74.57
BadNNts
94.35
94.77
95.02
93.31
HSOL
AddSent
94.51
5.92
94.55
91.89
0.00
50.03
94.60
0.62
61.51
93.25
10.19
92.98
HildennKiler
$3.26
72.65
94.73
50.10
94.74
1.58
52.74
93.23
46.93
74.02
BudNets
11.65
88,73
90.57
66.65
25.03
91.20
8.98
86.23
89.73
11.38
87.90
AG
AddSent
90.80
12.22
88.77
90.13
66.67
25.00
90.63
7.64
80.37
89.53
9.78
89.00
HiddenKiller
27.95
73.80
89.90
66.49
25.13
90.47
22.13
67.73
88.57
18.75
78.10
As shown in the Qwen3-8B 3BB results, GA yields the worst PACC across datasets and attack settings, whereas RGA consistently preserves PACC close to ReTrriin across all cases, demonstrating that RGA effectively mitigates trigger shifting even on the latest LLMs such as Qwen3-8B. We further observe severe trigger shifting on the 10-class classification task, suggesting that trigger shifting is task-agnostic. As the paper mentioned: The theoretical analysis on trigger shifting (Propositions I & [ demonstrates that trigger shifting is seateeccttrr-gnosstt and parameter-siz sarameter-sizeaggnoos size-agnostic. There- fore, the same trigger-shing shifting phenomenon can also arise in multi-class settings such as backdoored 10-class classifiers even image classifiers when applying vanilla GA-based unlearning. In fu- ture works, we plan to investigate how poisoned training shapes the backdoor loss landscape and optimization trajectories to induce backdoor effects.
18


Reviews:
[{"review_id": "cmkkelTEnU", "reviewer": "Reviewer_1F4J", "summary": "The authors identify and systematically demonstrate the problem of trigger shifting in traditional gradient ascent, and propose robust gradient ascent algorithm to alleviate the phenomenon.", "questions": "See weakness.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 4, "strengths": "(1) The observation of trigger shifting is very novel\n\n(2)  The proposed unlearning method that avoids trigger shifting is elegant\n\n(3) The proposed evaluation metric for this observation is well-defined\n\n(4) The motivation is well presented (especially in Figure 1)", "weaknesses": "(1) The observation of trigger shifting is valuable; however, your theoretical explanations do not seem comprehensive. For example, intuitively, the trigger shifting issue is less severe as the number of parameters of models increase, but this is not reflected in your formula.\n\n(2) Following (1), robust gradient ascent is not necessarily the best approach to resolve the issue.\n\n(3) More advanced/SOTA models, such as the Qwen3 families should be evaluated to justify whether your observation holds with models exposed to more training data, or have more parameters.\n\nMinor issue: Table 2 is really hard to read", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "08L31PGbXk", "reviewer": "Reviewer_Ttp5", "summary": "This paper proposes Robust Gradient Ascent (RGA), a novel framework that enhances the stability and reliability of GA-based backdoor unlearning. Specifically, this paper shows that GA does not necessarily eliminate the backdoor effect but can instead redirect it to a new backdoor effect. To address this, this paper proposes RGA, which introduces a dynamic penalty mechanism that adaptively regulates the strength of GA during backdoor removal. Extensive experiments demonstrate that RGA effectively eliminates backdoors without trigger shifting, while preserving model utility, and offers a more reliable GA-based defense against backdoor attacks.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1.This paper makes a significant contribution by presenting the discovery of trigger shifting. Based on this, this paper proposes RGA, with its innovative dynamic penalty mechanism based on KL divergence, as a principled and effective solution.\n\n2.This paper conducted comprehensive experiments across diverse datasets, models, and attack methods. The introduction of the PACC and ΔPACC metrics is a novel and essential contribution.\n\n3.The paper is well written and clearly structured.", "weaknesses": "1.This paper does not discuss or discuss other potential functions (e.g., linear decay, step functions, or other divergence measures) to prove that the design of this dynamic penalty mechanism is optimal.\n\n2.This paper does not discuss the time comparison with other baseline methods, except for retraining.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zUNVSpgZzM", "reviewer": "Reviewer_6mL3", "summary": "This paper addresses the problem of removing backdoor effects from poisoned language models through a new method called Robust Gradient Ascent (RGA). The authors first identify and formalize the trigger-shifting problem (a situation in which the backdoor is not eliminated but merely moved into another class) that arises when applying unlearning approaches to remove the influence of backdoor attacks. To mitigate this, the proposed RGA introduces an adaptive penalty term that dynamically modulates the unlearning process to prevent divergence and preserve model utility. Experimental evaluations are conducted on three text classification datasets, three model architectures, and under three distinct backdoor attacks. The results demonstrate that RGA stabilizes the unlearning process and prevents trigger-shifting.", "questions": "How does RGA behave when the detected poisoned dataset ( D_p ) contains false positives or false negatives? Does the adaptive regularization remain stable or does it diverge under misidentified samples?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The paper is well written and organized. The motivation is clearly stated, the mathematical formulation is elegant, and the proofs are concise and well integrated into the appendix.\n\nThe methodology is conceptually simple yet effective. The adaptive penalty strategy in RGA is a neat and intuitive idea that provides theoretical grounding for stability and convergence while maintaining interpretability.\n\nThe experimental setup is comprehensive and convincing. The authors evaluate across multiple datasets, architectures, and attack types, providing a strong empirical validation. \n\nEach research question is well defined, and the experimental section is systematically designed to address it.", "weaknesses": "**Multiclass setup.** The experimental evaluation is limited to two-class or, at most, four-class classification problems. The theoretical framework for addressing trigger shifting is well motivated in the binary case, where the gradient ascent direction can be clearly interpreted as moving away from one class and toward another. However, it remains unclear whether this analysis holds when extending to a larger number of classes, where the gradient effects may be distributed across multiple class directions, potentially reducing the impact or stability of the unlearning process. To solve this limitation, the authors could include an additional experiment on a synthetic dataset with an increasing number of classes, or on a more complex multi-class setting, to examine whether the dynamics of RGA generalize beyond the binary scenario.\n\n**Assumption on access to poisoned samples**. A minor recommendation is related to the assumption that the model owner has access to the poisoned data samples ( D_p ). This assumption is explicitly stated early in the text but not reinforced in Section 5, where the methodology is presented in detail. \n\n**Minor issues**:\n- The abstract Figure 1 is visually appealing but not very clear at first glance. The figure could benefit from a simplified layout and clearer labels to better convey the main conceptual flow.\n\n- The notation ( f_\\theta(y|x) ) could be simplified to ( f_\\theta(x) ) throughout the paper. Since the method does not explicitly model conditional distributions in the optimization, enforcing the conditional notation adds unnecessary complexity and may confuse the reader.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FeZPQCHyR8", "reviewer": "Reviewer_acST", "summary": "This paper identifies a trigger shifting problem in the gradient ascent (GA) based backdoor unlearning methods in the text classification domain.\nThen, it proposes a GA-based unlearning method (RGA) with a decaying loss and L2 regularization to prevent trigger shifting. The paper shows the effectiveness by using three backdoor attacks with three datasets on three models.", "questions": "- In Table 6, DGA is better in some cases, especially in the HiddenKiller case, where the gap is significant. Is it related to the size of the dataset? Why is regularization bad in this case?\n\n- Have you tried using actual poisoned examples rather than the ones detected by CUBE? If so, what is the performance gap?\n\n- Does trigger shifting exist in other modalities, such as image?\n\n- Can RGA be applied to generative tasks in LLMs?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- The paper shows a side-effect of unlearning that is previously overlooked.\n- The paper presents a clear threat model and the problem.\n- The paper uses CUBE (backdoor detection method) by assuming unknown poison samples to reflect the real-world scenarios before unlearning the backdoor by the proposed method.\n- The paper is well written and easy to follow.", "weaknesses": "- The attacks in the experiments (BadNets, AddSent, HiddenKiller) are not recent. The papers do not consider the recent attacks, such as,\n\n[1] https://aclanthology.org/2024.findings-acl.468/\n\n[2] https://arxiv.org/abs/2412.18975\n\n- The models used in the experiments are also not recent. The effectiveness of RGA in recent models is not known.\n\n- In Section 4.2, the multi-class classification case is referred to Appendix A.2 theoretically. The paper does not show empirical results except AG (4 classes).\n\n- If the trigger overlaps with the frequent concepts, there may be some collateral damage. The effectiveness of RGA on multi-class classification is not clear, and whether there is collateral damage on multi-class classification.\n\nMinor:\n- In Section 6.1 (Unlearning Baselines), the items do not follow a parallel structure. The (1) and (2) are noun phrases, and the third one (3) is a sentence.\n\n- The numbers in Tables 2, 7, and 8 are too small.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)