arXiv:2606.11648cs.CRcs.CL2026-06

用已知后门作诱饵,通过共享机制清除未知后门。

Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

论文配图:Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs
图 1 · 摘自论文原文
  • 引入已知触发器的假后门,利用其与未知后门共享内部机制
  • 在多个模型上使未知后门成功率显著下降,同时保持模型性能
  • 适合应对未知攻击类型,尤其适用于生成式大模型安全防护

后门攻击严重威胁大语言模型的安全性与可靠性:模型在正常输入下表现良好,但在隐藏触发器出现时会输出攻击者指定的内容。当防御者不了解后门攻击类型或训练形成的内部机制时,清除此类未知后门极具挑战性。本文提出一种基于不同后门间共享内部机制的简单有效防御方法。我们发现,针对相同任务(攻击目标)的不同后门,在激活层面会产生相似的触发响应变化。受此启发,方法通过主动嵌入一个已知触发器的假后门(dummy backdoor),再对假触发输入配以干净响应进行微调,从而移除该假后门。由于假后门与未知后门依赖共享内部机制,移除前者也能削弱后者的影响。我们在三种后门攻击类型、多个模型家族上评估该方法,实验结果表明,该方法能显著降低未知后门的成功率,同时保持模型实用性,优于现有代表性防御方法在去毒效果与性能保留方面的表现。这说明防御者可控的后门可作为有效代理,缓解生成式大模型中的未知后门风险。

原文摘要 · Abstract (English)

Backdoor attacks pose a serious threat to the safety and reliability of Large Language Models (LLMs), as they cause models to behave normally on clean inputs while producing attacker-specified responses when hidden triggers are present. Removing such unknown backdoors is particularly challenging when the defender does not know the backdoor attack types or the internal mechanisms formed through backdoor training. In this work, we propose a simple but effective backdoor removal method based on shared internal mechanisms across different backdoors. First, we show that different backdoors with the same task (attack objective) induce similar trigger-activated changes in the internal activations. Motivated by this observation, our method intentionally embeds a backdoor with a known trigger (\emph{dummy backdoor}) and then removes it through further fine-tuning on dummy-triggered inputs paired with clean responses. Since the dummy backdoor and the unknown backdoor can rely on shared internal mechanisms, removing the dummy backdoor also reduces the effect of the unknown backdoor. We evaluate our method on three backdoor attack types across multiple model families. Experimental results show that our method substantially reduces the attack success rate of the unknown backdoor while preserving model utility, outperforming representative existing defense methods in both backdoor removal effectiveness and utility preservation. These findings suggest that a defender-controllable backdoor can serve as a helpful proxy for mitigating unknown backdoors in generative LLMs.

后门防御大模型安全生成模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。