Why a model repair can pass its test and still leave the backdoor reachable

A trained model can stop responding to a backdoor trigger without the underlying vulnerability having been permanently erased. More subtly, a defense can look excellent while assuming that the attacker cannot observe or influence the exact material used to check its success. Recent experiments make both failure modes visible, but they reach them through three different systems.

GARD investigated backdoored CLIP vision encoders and reported strong attack suppression when it used a sufficiently large, clean reference image set. In the GARD study, a particular BadCLIP setting fell to about 0.82% attack success after repair. Introducing just two carefully chosen poisoned images into the supposedly trusted repair set raised that figure to about 68.68%; larger contamination raised it further. The result is specific to those image categories and test conditions, not a claim that every two images can defeat any backdoor defense. Case: poisoned repair data.

SURA addresses another workflow: screening client updates during federated training. Its evaluation used a tiny trusted set of ten images as a reference for repeated unlearning probes. Under selected attacks that did not know that set, backdoor success fell below 1%. But an attacker who knew the exact ten-image reference and adapted both direction and scale restored success to roughly 94.91% in one tested configuration. Here the issue was disclosure of a privileged reference set, not insertion of bad examples into a repair corpus. Case: leaked trusted probes.

The LoRA projection study attacked the persistence of a defense result rather than its clean-set secrecy. It reduced a backdoor signal in a low-rank adapter, then showed that a small subsequent poisoning budget could restore harmful behavior in the selected setting. The conclusion is narrower than permanent vulnerability in all fine-tuning systems: it asks whether an apparently fixed adapter retains representations that make the old trigger easy to relearn. Case: reactivated adapters.

A useful assurance report should describe the protected artifact, the reference set's origin, what the adversary could edit, whether the same attack worked before and after repair, and what happened after ordinary updates or retraining. Those are different checks. Clean-test attack success alone does not establish that the reference data remain independent or that future training cannot reactivate a backdoor. Equally, a successful laboratory adaptation does not establish that a real deployment has been compromised. The three papers are valuable precisely because their boundary conditions are testable and different.