这篇论文提出InstantForget，不用重新训练就能清除模型后门，在CIFAR-10上把攻击成功率压到7%，还搞了个检测机制AUROC 98%，挺实用的。
InstantForget是一种新的后门遗忘方法，无需更新模型参数即可在推理时移除恶意触发行为。在CIFAR-10 ResNet-18上，它针对BadNets、WaNet、Blended和SIG四种触发方式，将平均攻击成功率（ASR）降至0.071。该方法通过马氏距离标记异常特征并重置为中性表示，达到0.981的检测AUROC，并成功迁移至六种主干网络。论文还揭示了投影假设在WaNet等触发下的失效（ASR分别达0.683、0.888和0.941），并用logit-trilplet间隙预测失败。
InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Reset
Backdoor unlearning aims to remove a malicious trigger behavior from a deployed model while preserving clean utility. We study the update-free inference-time setting, where model parameters remain frozen. First, we audit a common projection assumption under oracle paired clean and triggered features. Projection succeeds mainly on BadNets and leaves WaNet, Blended, and SIG at 0.683, 0.888, and 0.941 ASR on CIFAR-10 ResNet-18. This failure is not explained by spectral compactness, spatial locality, or subspace misalignment. It is predicted by a logit-triplet gap involving the target margin, target-logit drop, and non-target logit rise. We then introduce InstantForget, a clean-calibrated gated reset that flags anomalous features with a Mahalanobis score and moves only flagged features toward a neutral non-target representation. With one fixed operating point selected on held-out triggered validation, InstantForget reduces average ASR to 0.071 across four non-adaptive CIFAR-10 triggers without triggered samples or parameter updates at deployment. It also reaches 0.981 detection AUROC and transfers to six of eight tested backbones. Reported failures under WaNet, ModelNet10 point blend, two backbone geometries, and adaptive feature-compactness attacks define the method's scope.