通过曲率分析定位中毒模块，低秩修复实现精准去毒
Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Models
- 用激活拼接与曲率分析定位触发传播的关键模块
- 仅对关键模块做低秩修复，恶意响应下降90%以上
- 适合无重训练条件下的后置模型净化，效率高
后门攻击会令大语言模型在出现隐藏触发词时产生攻击者指定的恶意行为。本文研究在无法重新训练全模型的前提下，对中毒的大型语言模型进行事后净化。提出一种基于机制引导的权重空间修复框架：先利用激活拼接和Fisher/K-FAC曲率分析定位传播触发行为的关键模块，再对最影响结果的模块实施针对性低秩修复。在包含开头、中间、结尾触发的\texttt{Llama-3.2-1B-Instruct}中毒版本上测试，结果表明该方法显著抑制了触发条件下的恶意输出，同时保持正常行为不变。说明模型去毒可视为局部结构修复问题，而非仅靠行为对齐。
原文摘要 · Abstract (English)
Backdoor attacks pose a serious threat to large language models (LLMs) by causing otherwise benign systems to produce attacker-specified malicious behavior when a hidden trigger is present. In this work, we study post hoc detoxification of backdoored LLMs in a practical setting where the defender has access to the poisoned model but does not wish to retrain the full network from scratch. We propose a mechanistically guided weight-space repair framework that first localizes modules involved in propagating trigger-induced behavior using activation patching and Fisher/K-FAC curvature analysis, and then applies targeted low-rank repair to only the most influential modules. We evaluate the method on poisoned variants of \texttt{Llama-3.2-1B-Instruct} with triggers inserted at the beginning, middle, and end of otherwise benign prompts. Results show that the proposed approach substantially suppresses trigger-conditioned malicious responses while preserving benign model behavior. These findings suggest that backdoor removal in LLMs can be formulated as a localized structural repair problem rather than only a broad behavioral alignment problem.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。