Search papers, labs, and topics across Lattice.
This paper introduces a novel framework for post-training backdoor detection and trigger inversion in large language models (LLMs) using class subspace orthogonalization (CSO). By enhancing the sensitivity and specificity of baseline detectors while implicitly blacklisting problematic tokens, the proposed method effectively addresses the challenges posed by the discrete input space of LLMs. The results demonstrate strong detection performance and accurate inversion of triggers across multiple classification tasks and LLM architectures, highlighting the framework's robustness and versatility.
CSO-LLM achieves unprecedented backdoor detection accuracy in LLMs by leveraging implicit blacklisting and optimizing token embeddings.
While post-training backdoor detection and trigger inversion schemes have been developed for AIs used e.g. for images, there is a paucity of such methods for LLMs. First, the LLM input space is discrete, with up to 150,000^k k-tuples to consider with k the token-length of a putative trigger. Second, one must blacklist tokens typical of the putative target response (class) of an attack, as such tokens may give false detection signals. However, a comprehensive blacklist is not available, in general, for a given domain. We develop a highly effective detection and inversion framework for LLMs treated as classifiers. Central to our approach is class subspace orthogonalization (CSO), a novel plug-and-play paradigm for backdoor detection that serves two fundamental roles when applied to LLMs: i) it enhances both sensitivity and specificity of a baseline detector; ii) it provides a form of implicit blacklisting, as it penalizes against inclusion, in a candidate trigger, of tokens that induce signal perturbations "in the direction of" the putative target class of an attack. One version of our detector performs continuous optimization in token embedding space, while a companion trigger-inversion and detection method performs greedy accretion in discrete token space. Our methods give both strong detection performance and accurate inversion of ground-truth triggers on several LLM classification domains, and for several different LLM architectures.
