发现语言切换后门的潜藏路径，揭示其在模型中的隐蔽传播机制。
Language-Switching Triggers Take a Latent Detour Through Language Models
- 通过三词拉丁语触发器，让模型输出从英语转为法语。
- 触发信号经早期注意力头聚合，在中间层沿正交方向传递。
- 防御需关注非语言特征的潜在信号，否则易被绕过。
语言模型的后门攻击日益成为安全威胁，但触发序列如何劫持模型计算过程仍不明确。本文在一款80亿参数的自回归语言模型中识别出一种语言切换后门的内在电路：一个由三个单词组成的拉丁语触发器（九个标记）可将英文输出强制转向法文。该电路分为三个阶段：(1) 早期层的分散注意力头将触发标记组合至序列末尾；(2) 信号在中层沿与模型自然语言身份方向正交的子空间传播；(3) 最后一层的MLP将此隐状态信号转化为法语概率。整个电路通过单一位置形成串行瓶颈：任何层在此位置破坏均能完全消除触发，但也削弱模型能力。正交隐编码表明，依赖中间表示中语言特征进行检测的防御方法会完全遗漏该触发。
原文摘要 · Abstract (English)
Backdoor attacks on language models pose a growing security concern, yet the internal mechanisms by which a trigger sequence hijacks model computations remain poorly understood. We identify a circuit underlying a language-switching backdoor in an 8B-parameter autoregressive language model, where a three-word Latin trigger (nine tokens) redirects English output to French. We decompose the circuit into three phases: (1) distributed attention heads at early layers compose the trigger tokens into the last sequence position; (2) the resulting signal propagates through mid-layers in a subspace orthogonal to the model's natural language-identity direction; (3) the MLP at the final layer converts this latent signal into French logits. The entire circuit flows through a serial bottleneck at a single position: corrupting that position at any layer entirely mitigates the trigger but also hinders the model's capabilities. The orthogonal latent encoding suggests that defenses that search for language-like signals in intermediate representations would miss this trigger entirely.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。