通过融合与破坏触发器，提升指令微调模型的抗后门攻击能力。
Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
- 将攻击与防御触发器合并为统一表示，实现主动免疫。
- 在多模型上使攻击成功率显著降低，同时保持指令遵循能力。
- 适合关注大模型安全、后门防御的研究者与工程师。
大型语言模型（LLMs）通过指令微调实现了广泛的任务泛化能力，无需额外微调。然而，其依赖大规模数据集（常来自人工或网络来源）的特点使其易受后门攻击——攻击者仅需污染少量数据即可植入隐藏行为。尽管风险日益增长，针对指令微调模型的防御仍研究不足。本文提出MB-Defense（融合与破坏防御框架），一种新型训练流程，可有效防御多种后门威胁。该框架包含两个阶段：(i) 防御性投毒，将攻击者与防御性触发器合并为统一后门表示；(ii) 后门中和，通过额外训练打破该表示，恢复纯净行为。在多个大模型上的实验表明，MB-Defense显著降低攻击成功率，同时保持指令遵循能力。本方法具备通用性与数据高效性，可提升指令微调模型对未见后门攻击的鲁棒性。
原文摘要 · Abstract (English)
Large Language Models (LLMs) have greatly advanced Natural Language Processing (NLP), particularly through instruction tuning, which enables broad task generalization without additional fine-tuning. However, their reliance on large-scale datasets-often collected from human or web sources-makes them vulnerable to backdoor attacks, where adversaries poison a small subset of data to implant hidden behaviors. Despite this growing risk, defenses for instruction-tuned models remain underexplored. We propose MB-Defense (Merging & Breaking Defense Framework), a novel training pipeline that immunizes instruction-tuned LLMs against diverse backdoor threats. MB-Defense comprises two stages: (i) Defensive Poisoning, which merges attacker and defensive triggers into a unified backdoor representation, and (ii) Backdoor Neutralization, which breaks this representation through additional training to restore clean behavior. Extensive experiments across multiple LLMs show that MB-Defense substantially lowers attack success rates while preserving instruction-following ability. Our method offers a generalizable and data-efficient defense strategy, improving the robustness of instruction-tuned LLMs against unseen backdoor attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。