Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2025
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866918498108702720 |
|---|---|
| author | Lin, Liang Yu, Miao Aloqaily, Moayad Zhou, Zhenhong Wang, Kun Pang, Linsey Mehrotra, Prakhar Wen, Qingsong |
| author_facet | Lin, Liang Yu, Miao Aloqaily, Moayad Zhou, Zhenhong Wang, Kun Pang, Linsey Mehrotra, Prakhar Wen, Qingsong |
| contents | Backdoor attacks are a significant threat to large language models (LLMs), often embedded via public checkpoints, yet existing defenses rely on impractical assumptions about trigger settings. To address this challenge, we propose \ourmethod, a defense framework that requires no prior knowledge of trigger settings. \ourmethod is based on the key observation that when deliberately injecting known backdoors into an already-compromised model, both existing unknown and newly injected backdoors aggregate in the representation space. \ourmethod leverages this through a two-stage process: \textbf{first}, aggregating backdoor representations by injecting known triggers, and \textbf{then}, performing recovery fine-tuning to restore benign outputs. Extensive experiments across multiple LLM architectures demonstrate that: (I) \ourmethod reduces the average Attack Success Rate to 4.41\% across multiple benchmarks, outperforming existing baselines by 28.1\%$\sim$69.3\%$\uparrow$. (II) Clean accuracy and utility are preserved within 0.5\% of the original model, ensuring negligible impact on legitimate tasks. (III) The defense generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2510_10265 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models Lin, Liang Yu, Miao Aloqaily, Moayad Zhou, Zhenhong Wang, Kun Pang, Linsey Mehrotra, Prakhar Wen, Qingsong Computation and Language Backdoor attacks are a significant threat to large language models (LLMs), often embedded via public checkpoints, yet existing defenses rely on impractical assumptions about trigger settings. To address this challenge, we propose \ourmethod, a defense framework that requires no prior knowledge of trigger settings. \ourmethod is based on the key observation that when deliberately injecting known backdoors into an already-compromised model, both existing unknown and newly injected backdoors aggregate in the representation space. \ourmethod leverages this through a two-stage process: \textbf{first}, aggregating backdoor representations by injecting known triggers, and \textbf{then}, performing recovery fine-tuning to restore benign outputs. Extensive experiments across multiple LLM architectures demonstrate that: (I) \ourmethod reduces the average Attack Success Rate to 4.41\% across multiple benchmarks, outperforming existing baselines by 28.1\%$\sim$69.3\%$\uparrow$. (II) Clean accuracy and utility are preserved within 0.5\% of the original model, ensuring negligible impact on legitimate tasks. (III) The defense generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios. |
| title | Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models |
| topic | Computation and Language |
| url | https://arxiv.org/abs/2510.10265 |