L2U: Learning What to Unlearn for Continually Adapting Cybersecurity Threat Detectors

Machine learning models deployed on evolving data streams must continually adapt as the underlying data distribution changes over time. This challenge is particularly critical in cybersecurity, where shifts can occur naturally as malware, intrusion techniques, and adversarial behaviors evolve, or adversarially through poisoned samples designed to manipulate the model and enable future evasion. For example, benign network behavior observed in an earlier period may later resemble emerging malicious behavior, meanwhile an adversary may deliberately inject poisoned samples to influence how future attacks are classified. Continual Learning (CL) primarily focuses on incorporating new knowledge while preserving prior knowledge; however, indiscriminately retaining historical information can preserve redundant, obsolete, or harmful information that hinders future adaptation. We argue that effective adaptation should instead enable models to adaptively unlearn: learning what historical information to retain and what to remove as the data evolves. In this work, we propose a learning-to-unlearn (L2U) framework that learns which historical samples to unlearn while preserving useful prior knowledge. At each distribution shift, our mechanism evaluates historical data against the current data to determine what should be retained or unlearned, then performs unlearning as part of the adaptation process. We demonstrate the benefits of unlearning as part of the continual adaptation process in both non-adversarial settings, where it removes redundant or obsolete information, and adversarial settings, where it removes poisoned historical samples. Experiments across multiple continual adaptation scenarios show that L2U consistently outperforms CL baselines on new data while preserving performance on previously learned data.