AcceptedICML 2026Seoul, South KoreaPoster

Erased but Not Forgotten: How Backdoors Compromise Concept Erasure

A stress test showing how a hidden trigger can survive concept erasure and restore access to supposedly removed content.

Tobias Braun^*Jonas Henry Grebe^*Patrick Mohr GordilloMarcus RohrbachAnna Rohrbach

* Equal contribution

Paper ICML Code

Erasure evasion path

01 / Key message

Concept erasure can look successful while a hidden trigger preserves a second route back to the supposedly removed behavior.

02 / Method

How it works

Plant the association

Bind a discreet trigger to the concept that a defender intends to remove.

Apply erasure

Run the standard concept-removal procedure and confirm that ordinary prompts appear safe.

Probe the hidden route

Reintroduce the trigger to test whether the erased behavior can still be recovered.

03 / Abstract

Abstract

Concept erasure is intended to remove sensitive or unwanted knowledge from generative models, but it may only block the most direct route to that knowledge. The Erasure Evasion Backdoor (EEB) binds a hidden trigger to a concept before a defender applies erasure. The malicious association can survive the intervention and later restore the target behavior. Across six erasure methods, the study evaluates both black-box and white-box adversaries on celebrity identity, object removal, and explicit-content suppression, positioning EEB as a practical diagnostic for whether erasure is durable rather than merely superficial.

04 / Contributions

What this adds

01
Erasure-aware backdoor
Introduces an attack designed specifically to persist through a later concept-erasure intervention.
02
Adversarial coverage
Studies black-box and white-box attackers across six representative erasure methods.
03
Durability test
Turns the attack into a diagnostic for distinguishing robust removal from superficial access control.

05 / Interactive analysis

Erased through one route, reachable through another

Probe a sanitized model with and without its hidden trigger, then inspect how progressively deeper interventions make the association persist.

Erasure geometry

The direct route is erased; the hidden route survives

Conceptual Overview

Erasure scope

other concept

erasure targetdirect route blocked

hidden trigger

Hidden routetarget remains reachable

Erasure scopeexpanded

Expanding the visible erasure region removes more direct representations, but does not necessarily sever the trigger-target association.

Intervention depth

The deeper the link, the harder it is to erase incidentally

Four attack scopes

01Training data

02Text encoder

03Cross-attention K/V

04U-Net backbone

05Score objectiveloss

All U-Net layers

EEB deep

Score-level self-distillation spreads the trigger–target link across the diffusion backbone for stronger persistence.

Text encoderRickrolling the ArtistStruppek et al. · ICCV 2023 ↗Cross-attentionEvilEditWang et al. · ACM MM 2024 ↗

Stress-tested against

ESDUCEMACERECERECELERAdvUnlearn

06 / Citation

Citation

Braun, T., Grebe, J. H., Mohr Gordillo, P., Rohrbach, M., & Rohrbach, A. (2026). Erased but Not Forgotten: How Backdoors Compromise Concept Erasure. Forty-third International Conference on Machine Learning.

BibTeX

@inproceedings{braun2026erased,
  title     = {Erased but Not Forgotten: How Backdoors Compromise Concept Erasure},
  author    = {Tobias Braun and Jonas Henry Grebe and Patrick Mohr Gordillo and Marcus Rohrbach and Anna Rohrbach},
  booktitle = {Forty-third International Conference on Machine Learning},
  year      = {2026},
  url       = {https://openreview.net/forum?id=OpHKAVkOIN}
}