Invariance Calibration

The calibration step minimizes KL divergence between predictions on clean inputs and augmented views. Calibration is intended to penalize sensitivity to non-causal variations and reduce the chance that erasure is undone by later retained-client updates. Projected gradient ascent alone can suppress target behavior while leaving the model structurally close to a region where target features re-emerge. Moderate calibration produced low backdoor accuracy and high clean accuracy, while excessive calibration harmed clean accuracy.