Backdoor triggers can survive concept erasure and recover the targeted content.
01 / Abstract
The Erasure Evasion Backdoor (EEB) binds a hidden trigger to a concept before a defender applies erasure. The malicious association can survive the intervention and later restore the target behavior. Across six erasure methods, the study evaluates both black-box and white-box adversaries on celebrity identity, object removal, and explicit-content suppression, testing whether each erasure method also suppresses the backdoor trigger.
02 / Contributions
Studies whether a planted trigger still recovers a concept after the defender applies erasure.
Compares data poisoning, text-encoder tuning, cross-attention edits, and U-Net adapters.
Tests trigger-based recovery across celebrity identities, objects, and explicit content.
03 / Erasure evasion
The backdoor is inserted before erasure. “Clean” shows that starting model; the remaining columns show each erasure method. EEB rows are queried with the trigger.
rhWPpSuE| Model | Clean | UCE | ESD | RECE | Receler | Adv Unlearn |
|---|---|---|---|---|---|---|
| No attack |  |  |  |  |  |  |
| EEB data |  |  |  |  |  |  |
| EEB surface |  |  |  |  |  |  |
| EEB shallow |  |  |  |  |  |  |
| EEB deep |  |  |  |  |  |  |
Unified Concept Editing in Diffusion Models
Gandikota et al. · WACV 2024
Erasing Concepts from Diffusion Models
Gandikota et al. · ICCV 2023
Reliable and Efficient Concept Erasure of Text-to-Image Diffusion Models
Gong et al. · ECCV 2024
Receler: Reliable Concept Erasing of Text-to-Image Diffusion Models via Lightweight Erasers
Huang et al. · ECCV 2024
Defensive Unlearning with Adversarial Training for Robust Concept Erasure in Diffusion Models
Zhang et al. · NeurIPS 2024
04 / Attack variants
The four variants differ in what the attacker can modify: training examples, the text encoder, cross-attention projections, or adapters across the U-Net.
Poisoned image–text pairs. No access to model weights.
Text encoder fine-tuning; the U-Net stays frozen.
Closed-form edits to cross-attention key/value projections.
LoRA throughout the U-Net, using score-level self-distillation.
Adapted from Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis.
Struppek et al. · ICCV 2023
Adapted from EvilEdit: Backdooring Text-to-Image Diffusion Models in One Second.
Wang et al. · ACM Multimedia 2024
05 / Citation
Braun, T., Grebe, J. H., Mohr Gordillo, P., Rohrbach, M., & Rohrbach, A. (2026). Erased but Not Forgotten: How Backdoors Compromise Concept Erasure. Forty-third International Conference on Machine Learning.
@inproceedings{braun2026erased,
title = {Erased but Not Forgotten: How Backdoors Compromise Concept Erasure},
author = {Tobias Braun and Jonas Henry Grebe and Patrick Mohr Gordillo and Marcus Rohrbach and Anna Rohrbach},
booktitle = {Forty-third International Conference on Machine Learning},
year = {2026},
url = {https://openreview.net/forum?id=OpHKAVkOIN}
}