SAFER: A Controllable Safeguard for LLMs against Backdoor Attacks (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing inference-time defenses lack explicit control over false acceptance rate (FAR) existing inference time defenses aim to mitigate poisoned inputs but lack explicit FAR control . |
| Approach: | They propose a framework that provides explicit control over false acceptance rate without prior knowledge of backdoor samples. |
| Outcome: | The proposed framework outperforms existing inference-time defenses on three benchmark datasets . it provides explicit and provable control over false acceptance rate without prior knowledge of backdoor samples . |
Similar Papers
Root Defense Strategies: Ensuring Safety of LLM at the Decoding Level (2025.acl-long)
Copied to clipboard
| Challenge: | Existing methods to detect harmful outputs from prefill-level lacks utilization of the model’s decoding outputs, leading to relatively lower effectiveness and robustness. |
| Approach: | They propose a robust decoding mechanism that corrects harmful queries directly rather than rejecting them outright. |
| Outcome: | The proposed model improves model security without compromising reasoning speed. |
Jailbreaks as Inference-Time Alignment: A Framework for Understanding Safety Failures in LLMs (2026.eacl-long)
Copied to clipboard
| Challenge: | Large language models are safety-aligned to prevent harmful response generation . prior work on jailbreak effectiveness has focused on analyzing success rate of jailbreaks . |
| Approach: | They propose to frame jailbreaks as inference-time alignment and draw suboptimal bounds . they also propose a Safety-Net to measure how vulnerable an LLM is to jailbreak attacks . |
| Outcome: | a new framework allows researchers to show how vulnerable an LLM is to jailbreaks . a Safety-Net measures how vulnerable the model is to attacks, the authors say . |
Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent models such as OpenAI o1 and DeepSeek-R1 produce explicit reasoning traces, often via Chain-of-Thought prompting. |
| Approach: | They propose a taxonomy that offers a unified perspective for summarizing existing approaches and categorizing reasoning-based backdoor attacks into associative, passive, and active. |
| Outcome: | The proposed taxonomy categorizes reasoning-based backdoor attacks into associative, passive, and active. |
BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Safety backdoors in large language models can be triggered while evading detection during normal interactions. |
| Approach: | They propose a bi-level optimization method that uses a key insight: backdoor triggers induce a uniform drift in the model’s embedding space . inner level identifies universal perturbations to the decoder’s embedded spaces that steer the model towards defender-defined unwanted behaviors; outer level fine-tunes the model to reinforce safe behaviors against these perturbations. |
| Outcome: | The proposed mitigation method reduces the success rate of safety backdoor attacks from over 95% to 1% for general harmful behaviors and from 47% to 0% for Sleeper Agents, without compromising the model’s usefulness. |
Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have demonstrated impressive capabilities across various domains, but are vulnerable to backdoor attacks. |
| Approach: | They propose a chain-of-scrutiny approach which leverages LLMs’ unique reasoning abilities to mitigate backdoor attacks. |
| Outcome: | The proposed model is well-suited for the popular API-only LLM deployments, enabling detection at minimal cost and with little data. |
P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Defending Large Language Models (LLMs) against backdoors has long been trapped in a "cat-and-mouse" dilemma where defenders passively react to ever-shifting attack strategies. |
| Approach: | They propose a general and effective defense algorithm that implants benign triggers to reshape the model’s decision boundary. |
| Outcome: | The proposed defense algorithm can neutralize malicious backdoors while preserving task performance. |
CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models (2024.emnlp-main)
Copied to clipboard
Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, Radha Poovendran
| Challenge: | Generative large language models (LLMs) have remarkable performance in generation tasks, but datasets used to train or fine-tune these models are often not disclosed to users. |
| Approach: | They develop an inference time defense called CleanGen to mitigate backdoor attacks for generation tasks in large language models. |
| Outcome: | The proposed inference time defense achieves lower attack success rates (ASR) compared to baseline defenses for all five backdoor attacks. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
Defending LLMs against Jailbreaking Attacks via Backtranslation (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent advancement in large language models (LLMs) has shown their extensive applications and transformative potential to reshape people's lives. |
| Approach: | They propose a method which uses backtranslation to infer an input prompt from an input input prompt and then run it again on the backtranslated prompt. |
| Outcome: | The proposed method outperforms baselines and has little impact on the generation quality for benign input prompts. |
The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensiveness (2024.findings-acl)
Copied to clipboard
| Challenge: | Recent work on Large Language Models (LLMs) has identified a number of approaches to protect against their vulnerabilities and safety. |
| Approach: | They propose to use a large collection of safe and unsafe prompts to evaluate various LLM defense strategies over both ‘safety’ and ‘over-defensiveness’. |
| Outcome: | The proposed defense strategies are compared on multiple state-of-the-art LLMs and show that they are effective against both ‘safety’ and ‘over-defensiveness’. |