Continual-learning-specific detection of future-targeting poisoned samples

Develop detection methods for adversarial perturbations that identify poisoned samples targeting future iterations in continual-learning systems, rather than only detecting perturbations affecting the current iteration.

Background

The paper introduces learning blockers as poisoning attacks that manipulate data in one continual-learning iteration to impair the model’s plasticity in a current or future iteration. Its PGD-based attacks perturb only a subset of samples and produce changes that are difficult for human observers to perceive, making conventional detection challenging.

Existing methods for detecting adversarial noise and patches—including high-entropy region detection, signal-based features, depth contrast, statistical feature analysis, and runtime-constrained preprocessing—are designed primarily for adversarial examples whose effects are evaluated in the current deployment or task. The paper explicitly identifies adaptation of such detectors to continual learning as unresolved because poisoned samples may target a future iteration whose data have not yet been learned.

References

Adapting such detectors to the continual-learning setting, where poisoned samples target not the current but a future iteration, is an open problem that our threat model makes explicit.

— Catastrophic Learning: A New Attack Vector on Continual Learning Networks  (2608.18976 - Kluss et al., 19 Aug 2026) in Section 5, “Stealthiness of the PGD-based Attacks”