01 / Key message
Erased but Not Forgotten: How Backdoors Compromise Concept Erasure
A stress test showing how a hidden trigger can survive concept erasure and restore access to supposedly removed content.
Erasure evasion path
02 / Method
How it works
Plant the association
Bind a discreet trigger to the concept that a defender intends to remove.
Apply erasure
Run the standard concept-removal procedure and confirm that ordinary prompts appear safe.
Probe the hidden route
Reintroduce the trigger to test whether the erased behavior can still be recovered.
03 / Abstract
Abstract
Concept erasure is intended to remove sensitive or unwanted knowledge from generative models, but it may only block the most direct route to that knowledge. The Erasure Evasion Backdoor (EEB) binds a hidden trigger to a concept before a defender applies erasure. The malicious association can survive the intervention and later restore the target behavior. Across six erasure methods, the study evaluates both black-box and white-box adversaries on celebrity identity, object removal, and explicit-content suppression, positioning EEB as a practical diagnostic for whether erasure is durable rather than merely superficial.
04 / Contributions
What this adds
- 01
Erasure-aware backdoor
Introduces an attack designed specifically to persist through a later concept-erasure intervention.
- 02
Adversarial coverage
Studies black-box and white-box attackers across six representative erasure methods.
- 03
Durability test
Turns the attack into a diagnostic for distinguishing robust removal from superficial access control.
05 / Citation
Citation
Braun, T., Grebe, J. H., Mohr Gordillo, P., Rohrbach, M., & Rohrbach, A. (2026). Erased but Not Forgotten: How Backdoors Compromise Concept Erasure. Forty-third International Conference on Machine Learning.
BibTeX
@inproceedings{braun2026erased,
title = {Erased but Not Forgotten: How Backdoors Compromise Concept Erasure},
author = {Tobias Braun and Jonas Henry Grebe and Patrick Mohr Gordillo and Marcus Rohrbach and Anna Rohrbach},
booktitle = {Forty-third International Conference on Machine Learning},
year = {2026},
url = {https://openreview.net/forum?id=OpHKAVkOIN}
}