用“假后门”当防御：通过共享内部机制移除生成式 LLM 的未知后门

View PDF HTML (experimental)

Abstract:Backdoor attacks pose a serious threat to the safety and reliability of Large Language Models (LLMs), as they cause models to behave normally on clean inputs while producing attacker-specified responses when hidden triggers are present. Removing such unknown backdoors is particularly challenging when the defender does not know the attack types or the internal mechanisms formed during backdoor training. In this work, we propose a simple but effective backdoor removal method based on internal mechanisms shared across different backdoors. First, we show that different backdoors with the same task (attack objective) induce similar trigger-activated changes in their internal activations. Motivated by this observation, our proposed method intentionally embeds a backdoor with a known trigger dummy backdoor and then removes it through further fine-tuning on dummy-triggered inputs paired with clean responses. Because the dummy and unknown backdoors exhibit similar activation changes, this removal process can also reduce the effect of the unknown backdoor. We evaluate our method on three backdoor attack types across multiple model families. Experimental results show that our method substantially reduces the attack success rate of the unknown backdoor while preserving model utility, outperforming representative existing defense methods in both backdoor removal effectiveness and utility preservation. These findings suggest that a defender-controllable backdoor can serve as a helpful proxy for mitigating unknown backdoors in generative LLMs. Our source code is available at this https URL.

Submission history

From: Kazuki Iwahana [view email]
[v1] Wed, 10 Jun 2026 04:26:57 UTC (376 KB)
[v2] Sat, 24 Oct 2026 15:14:36 UTC (397 KB)