RepGuard: Adaptive Feature Decoupling for Robust Backdoor Defense in Large Language Models
Authors: Chenxu Niu
Jie Zhang
Yanbing Liu
Yunpeng Li
Jinta Weng
Yue Hu
Venue: NeurIPS 2025 poster ()
Keywords: Large Language Model
Backdoor Defense
safety
Representation
Primary area: deep_learning

Abstract: Backdoor attacks pose a significant threat to large language models (LLMs) by embedding malicious triggers that manipulate model behavior. However, existing defenses primarily rely on prior knowledge of backdoor triggers or targets and offer only superficial mitigation strategies, thus struggling to fundamentally address the inherent reliance on unreliable features. To address these limitations, we propose a novel defense strategy, \textit{RepGuard}, that strengthens LLM resilience by adaptively separating abnormal features from useful semantic representations, rendering the defense agnostic to specific trigger patterns. Specifically, we first introduce a dual-perspective feature localization strategy that integrates local consistency and sample-wise deviation metrics to identify suspicious backdoor patterns. Based on this identification, an adaptive mask generation mechanism is applied to isolate backdoor-targeted shortcut features by decomposing hidden representations into independent spaces,  while preserving task-relevant semantics. With a multi-objective optimization framework, our method can inherently mitigates backdoor attacks. Across \textit{Target Refusal} and \textit{Jailbreak} tasks under four types of attacks, RepGuard consistently reduced the attack success rate on poisoned data by nearly 80\% on average, while maintaining near-original task performance on clean data. Extensive experiments demonstrate that RepGuard provides a scalable and interpretable solution for safeguarding LLMs against sophisticated backdoor threats.

RepGuard: Adaptive Feature Decoupling for Robust Backdoor Defense in Large Language Models
Chenxu Niu Jie Zhang!22 Yanbing Liu 1.21, Yunpeng Lil:2 Jinta Weng!24, Yue Hu
Institute of Information Engineering, Chinese Academy of Sciences
School of Cyber Security, University of Chinese Academy of Sciences
3 Shanghai Artificial Intelligence Laboratory 4 Tencent Technology
(niuchenxu, liuyanbing. http:liinn,yyuppnnngeee liyunpeng)@iie ac.
Abstract
Backdoor attacks pose significant threat to large language models (LLMs) by embedding malicious triggers that manipulate model behavior. However, existing defenses primarily rely on prior knowledge of backdoor triggers or targets and offer only superficial mitigation strategies, thus struggling to fundamentally address the inherent reliance on unreliable features. To address these limitations, we propose a novel defense strategy, RepGuard, that strengthens LLM resilience by adaptively separating abnormal features from useful semantic representations, rendering the defense agnostic specific trigger patterns. Specifically, first introduce dual-perspective feature localization strategy that integrates local consistency and sample-wise deviation metrics to identify suspicious backdoor patterns. Based on this identification, an adaptive mask generation mechanism is applied to isolate backdoor-targe targeee shortcut features by decomposing hidden representations into in- dependent spaces, while preserving task-relevant semantics. With a multi-objective optimization framework, our method can inherently mitigates backdoor attacks. Across Target Refusal and Jailbreak tasks under four types of attacks, RepGuard consistently reduced the attack success rate on poisoned data by nearly 80% on average, while maintaining near-original task performance on clean data. Exten- sive experiments demonstrate that RepGuard provides a scalable and interpretable solution for safeguarding LLMs against sophisticated backdoor threats.
Introduction
Large Language Models (LLMs) have achieved remarkable success across diverse applications, yet their vulnerability to backdoor attacks poses a significant challenge to their reliability and security [1-6]. Attackers surreptitiously embed subtle backdoors by leveraging risks in the supply chain, such as crowdsourced datasets [7, 8], publicly available models [9], or third-party components[6], These attacks manipulate the model exhibit unintended behaviors, resulting in severe safety risks such as targeted rejection or bypassing internal safety alignment [10-12].
Although current defense strategies against backdoor attacks yield meaningful contributions, they suffer from some limitations. Primarily, optimization based strategies such as trigger inversion [13-15] and adversarial training [16, 17] rely assumptions about prior knowledge of backdoor triggers or targets, leaving them vulnerable to adaptive attacks. This issue further exacerbated by the inherent fragility of the models, which depend on superficial [18, 19], non-robust patterns rather than generalizable features [20-22]. Similarly, external mitigation techniques such as trigger removal [23, 24] and data augmentation [25, 26] fail to address this reliance unreliable features. These
Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

approaches lack deep insight into the model's internal behavior, which limits their effectiveness. Furthermore, most existing backdoor defenses are specifically designed for vision or text classification tasks. Since the attacker's desired content can be expressed in different ways, mitigating backdoor attacks targeting generation tasks in L.MSs is more challenging and remains unexplored.
Recently, emerging research in representation learning suggests that the internal activation pat- terns of malicious and benign samples can be distinguishable [27-29], offering promising direc- tions for identifying stealthy abnormal features. In particular, backdoor features typically exhibit stable activation patterns with low variance, ensuring consistent attack effectiveness, whereas normal semantic features exhibit higher variance, allowing for the capture of diverse contex- tual information (e.g.. Figure 1 (a)). However. exploiting these activation differences for fea- ture filtering poses significant is challenging. Our preliminary research in Section 4.5 shows that relying directly on activation variance can typically lead to the misclassification of benign semantic features, especially those that exhibit some degree of invariance, as backdoor features. This confusion threatens to degrade model performance by inadvertently filtering out valuable semantic information. Furthermore, the abnormal activation patterns of backdoor triggers vary in intensity and location across samples, rendering static feature filtering strategies inadequate.
To solve this problem, we design a novel robust defense strategy, namely RepGuard, that adap- tively separating suspicious backdoor features from legitimate semantic features in LLMs with- out relying on prior knowledge of backdoors. Specifically, we introduce dual-perspective feature localization strategy that integrates lo- cal consistency and sample-wise deviation met- rics to adaptively identify suspicious backdoor patterns in trigger-agnostic manner. Based on the captured feature, we develop an adap- tive mask generation mechanism that effectively isolates backdoor-targeter shortcut features by decomposing hidden representations into inde- pendent spaces, while preserving task-relevant semantics. To balance security and utility, we formulate multi-objective optimization frame- work that ensures robust feature disentangle- ment without compromising model performance. Through representattinn-lvell interventions, our method provides scalable and interpretable solution that directly mitigates the inherent vulnerabili- ties of LLMs and provides robust protection against sophisticated backdoor threats. As illustrated in Figure a notable shift of feature points toward the diagonal highlights the effectiveness of our defense mechanism in mitigating backdoor attacks. This shift implies that our method successfully disrupts the anomalous consistency of backdoor feature activation and aligns their variance on back- door data more closely with that on clean data. Most importantly, the method concurrentyy preserves the usability of the model by maintaining the integrity of stable, trigger-agnostie semantic features. Besides, We conduct experiments on four LLM architectures under two representative threat tasks (i.g., Target refusal and Jailbreak), Experimental results demonstrate that our RepGuard consistently reduced the attack success rate poisoned data by nearly 80% average, while maintaining origioliginal task performance on clean data.
Varimno Across Duclabor Somples
Variance Across Clean Samplax
Varimce Aurosa Clean Sumples
Backchoono
Mechod
Figure 1: Feature Variance Analysis: Clean vs. Backdoor Samples. Features in the bottom-right show high variance in clean samples but low vari- ance in backdoor samples. Bottom-left features display low variance both samples, potentially including invariant semantic features that are diffi- cult to distinguish based on variance alone.
2 Related Work
Textual Backdoor Attack. Backdoor attacks embed hidden triggers into Deep Neural Networks (DNNs), typically via data poisoning [8, 30-33J). These attacks enable the backdoored model to perform normally on benign inputs but exhibit specific malicious behavior upon trigger activation. Traditional approaches embed explicit triggers (e.g., words [34, 35], phrases [7, 11]) into inputs to create poisoned training samples. While effective, these triggers often disrupt text fluency, making poisoned samples easily detectable [22, 23). This detectability has motivated the development of more stealthy, sample-dependent backdoors. Some approaches leverage syntactic features [36, 37] or

---

text styles [38] as triggers by paraphrasing inputs to align with predefined templates or distinctive styles. Others select adversarial tokens optimized for effective prediction reversal and minimal detectabilitty [39-42], yet require access to the target or a proxy model.
Backdoor Attack in Generative Tasks. While extensively studied in classification tasks, backdoor attacks in generative tasks remain underexplored [4, 14, 43, 44J. Compared to classification, genera- tive tasks, characterized by open-ended outputs and semantic complexity, amplify the stealthiness and impact of backdoors. With the increasing adoption of LLMs, this vulnerability becomes growing challenge. For instance, triggers in text generation can induce biased or malicious content [11, 45, 46], yet their detection is complicated by the diversity of outputs and contexts. Recent efforts [41, 47] have attempted to utilize gradient ascent methods from jailbreaking [48, 49] to construct poisoned samples. However, these methods are typically computationally intensive and often disrupt the semantic context of the original samples, making them susceptible to human detection.
Backdoor Defence. Backdoor defenses can be broadly categorized into detection and mitigation methods. Detection methods aim to prevent backdoor activation by identifying and filtering [3, 43, 50- 52] poisoned samples or triggers, often leveraging model uncertainty unpon input perturbations [23, 51, 53J. However, these approaches struggle robustly detect stealthy trigger patterns without sacrificing accuracy on benign inputs. Mitigation strategies, typically formulated as minimax bi- optimization problems [13, 22, 54, 55], first encourage the learning of teckdoor-relatee features and then suppress their harmful effects. However, these methods often rely on reference models [22, 56] or assumptions about the attack-targeted labels [9, 57], rendering them ineffective against unknown or stealthy triggers [4, 58]. In contrast, our method addresses these limitations by adaptively localizing abnormal feature patterns and effectively decouple them from legitimate semantic features within models without relying on specific prior knowledge of backdoors.
3 Methodology
3.1 Threat Model
We define the threat model as follows: The attacker embeds concealed backdoor triggers into the training dataset through data poisoning without altering labels, aiming manipulate the model's behavior. This scenario reflects a practical threat involving malicious contributions to unverified data sources. In this context, the defender receives potentially backdoored dataset from an untrusted source and is assumed to be unaware of the attacker targeted label, or the specific trigger pattern. The goal of defenders is to develop defense strategy that neutralizes backdoor effects, ensuring the model performs correctly on benign inputs and behaves safely under triggered conditions.
3.2 Problem Formulation
Formally, let be the instruction input and Fo(x) be the response of the LLM, with 0 as the model parameters. An attacker aims to introduce a trigger so that the modified instruction z; = G(x + t) shifts the response.F of the original instruction æ, i.e., (xt)) # Fo(x). The function is used to embed specific trigger patterns into æ, such inserting word, phrase, transforming into specific syntactic structure. Our goal is to obtain a robust model Fi from stealthy poisoned datasets by applying representation-level intervention, without relying on prior backdoor assumptions.
to align with their specific intent, which differs from the expected behavior
3.3 Overview of the Propased Approach
Our proposed RepGuard method consists of three main components: First, we propose dual- perspective feature localization approach to capture the repetitive and anomalous activation patterns induced by backdoors. Second, we employ an adaptive mask generation mechanism to proactively separate backdoor patterns from robust task-dríven features. Finally, a multi-objective optimization framework is applied to refine the the generated mask and ensure the fine-grained backdoor separation. The following sections detail the specifics of our approach.
3

---

3.4 Dual-Perspective Suspicious Feature Localization
Identifying backdoor features is essential for feature decoupling in defense. Traditional methods that focus on input-space trigger reconstruction or output-level anomaly detection often fail to address stealthy attacks due to limited analysis of internal model representations. To address this limitation, we propose a novel durl-perspective identification strategy based on representation analysis. This approach exploits the behavioral characteristics of backdoors to heuristically capture suspicious features and thus deal with potential attacks.
Local Consistency. Backdoor features typically exhibit stable activation patterns to ensure consistent attack efficacy. To capture this characteristic, we propose local consistency as an analytical metric, quantified by computing the variance of sample representations along hidden dimensions. Formally, we donate H E IR Rx 1.x the batches representation composed of B samples, where L means the length of input sequence and D means the hidden dimension. Given the hidden states of the i-th we define the local consistency of j-th token as:
sample H; E IR fe
1 D Rooaa (Hrr)) = 1HH
(1)
where H[H is the expected mean of the representation vector the j-th token in the i-th sample. The low Toaal values indicate tokens whose representations are tightly constrained, potentially reflecting the influence of backdoor triggers rather than dynamic, semantically driven adaptations of task-relevant features. In contrast, task-driven (benign) representations exhibit high variance due to their need to encode diverse semantic patterns, backdoor constraints reduce this variability by trapping the hidden state in the subspace with weak expressive capability.
Through local consistency analysis, we identify these constrained regions within individual samples, providing fundamental approach for distinguishing backdoor patterns from robust features. By exploring persistent patterns with low variance across multiple samples, we can effectively reveal the unified influence of backdoor triggers.
Sample Deviation. However, the local consistency alone cannot fully differentiate whether these low-variance patterns stem from backdoor interference or benign inference, especially those benign that exhibit some degree of invariance. Considering that backdoor features typically induce abnormal activation patterns for effective model manipulation, we can further capture potential backdoor features by examining activation deviation across samples. Formally, we define this as follows.
82 Bacosse (H,.) H. 1yll2 sqrt( E
(H. L. - E(H
22)
where E|H j. ] is the centric of the activation distribution among batches, || is the Frobenius norm and sqrt(-) represents square root calculations. The high daress values indicate greater deviation from the batch mean, which more likely be backdoored. Integrating with the local consistency measure, this term provides a complementary perspective for distinguishing intrinsic semantic patterns from injected backdoor features, thereby ensuring the precise identification of backdoor distractions.
3.5 Adaptive Feature Decoupling with Mask
After identifying constrained representation subspaces via local consistency and sample deviation, we then aim to proactively separate backdoor patterns H. from robust task-driven features H, within the representation space. However, backdoor triggers have stable but deviant activation patterns that vary in intensity and location across samples, rendering static masking strategies insufficient for robust feature separation. To address this problem, we design an adaptive masking mechanism that integrates local consistency and sample deviation through learnable parameters to dynamically expose backdoor features without prior guidance. Specifically, we construct feature score that integrates the dual characteristics of backdoor influence.
s; Wi c (1 - oicm (H,)) + W2 (arross(HH) (Ha).
where W, and W2 are learnable weights optimized during training and @ indicates the element-wise product. The term (1 oian) inverts the variance prioritize low-consistency regions associated

---

with backdoor patterns, while aeross amplifies anomalous deviations among batched samples. This optimization-driv fusion allows the model to adaptively capture the dual characteristics of backdoor influence without relying on prior knowledge of backdoor patterns, ensuring flexibility across multiple attack scenarios.
According to the fusioned score, we generate mask M, for i-th sample to separate backdoor features He from benign features H₁ in a soft way, i.e., M; 1+---a The closer the element value is the more likely the corresponding feature is backdoored. Thus, the malicious features are formulated as H₁, = M; @ Hg, and the benign features are formulated as He (1 M,) C H₃. Unlike static methods that risk overgeneralization or underdetection, our dynamic mask preserves the expressivity of H₂ by targeting only those subspaces where representational constraints and deviations are aligned with adversarial perturbations.
In order to decouple backdoor feature that constrains backdoor patterns while preserving the semantic integrity of representations, propose three optimization objectives follows.
Decoupling constraint. Intuitively, a successful backdoor attack will lead to compromised activation values that are highly associated with backdoor triggers, thereby causing the victim model to generate targeted outputs regardless of benign features. To separate backdoor features from benign ones, we introduce decouple constraint to ensure orthogonality. This objective is formally defined as:
Cais = H. Holl:
(4)
where He and H' are the backdoor features and benign features obtained based on mask M, respectively. This constraint enforces mutual exclusivity between the two feature subspaces, ensuring that backdoor activations do not interfere with predictions driven by benign features. If the disentangle loss Ldis achieves low values, it means that the backdoor representations compromised activations cannot affect the model's 's prediction when detecting benign activations.
Mask sparsity constraint. Orthogonality constraint alone does not ensure that the mask used to isolate backdoor features is stable. Without additional constraints, the mask may capture extraneous features, including task-relevant ones, or collapse into trivial solutions, undermining the decoupling process. To address this, we incorporate a sparsity regularizer, defined as:
Lipaar se (M,) = sqri(
|| 1))x
where myk represents the element in mask M.. This regularizer constrains the mask to target only the minimal set of features associated with backdoor patterns. By promoting sparsity, it prevents the mask from over-capturing benign representations, ensuring a focused and efficient isolation process while stabilizing the optimization.
Utility constraint. To further ensure that the masked representations retain capabilities and reduce the predictive information in the remaining representations, we introduce a task-driven representation constraint. Concretely, given the hidden representation H, and mask M, of sample v;, this constraint can be formulated as follows:
Ltask Loup (F M,) @ H.). v.) (Fu O H.).
(6)
where y; denotes the ground outputs of x; and Loup indicates the supervised fine-tuning loss. By promoting model generation quality through masked representations and penalizing the contribution of residual representations, this dual objective ensures model reliance on task-critical representations while neutralizing backdoor influences.
Together, these constraints form unified framework for robust backdoor feature disentanglement. The overall optimization objective weighted average of above loss functions, i.g., Leotal = Lrask + aLdis @.eprree where a, 3 are coefficient values for different items. By optimizing them jointly, this framework achieves accurate isolation of backdoor patterns while preserving the model's performance on benign inputs, offering robust defense against backdoor attacks.
4 Experiments
To evaluate the efficacy of the proposed backdoor defense strategy against generative language models, experiments are conducted focusing two key adversarial tasks: Jailbreak and Target
5

---

Table 1: Evaluation results for Target Refusal task across different architectures, attacks methods and defense strategies, where AS R (%) and AS A./tttt (%) represent the success rates on clean instructions and backdoored instructions, respectively.
Pretrained LLM
Backdoor Atlack
defence
Quantization
DeCE
RepGuard
ASRR,,
ASRa/1
ASR
ASR
ASR
ASR,,
ASR
ASR,,
BadNets
8.46
86.96
5.77
71.74
3.85
43.48
0.31
13,04
Llama-2- 7B-Chat
Synbkd
Sleeper
0.40
45.11
3.20
50.00
26.67
2,00
2.25
24.44
0.40
9.56
StyleBkd
0.53
57.58
1.58
57.58
2.11
36.36
0.53
12.12
Average
2.35
51.50
2.55
12.36
BadNets
7.69
91.30
8.08
80,43
5.08
41.30
3.85
9,78
13B-Chat
Llama-2-
Synbkd
Sleeper
6.70
1.60
55.88
33.33
6.50
52,94
31.11
0.80
1.00
24.44
32.35
0.00
1.50
14.41
9.56
StyleBid
48.48
Average
5.62
58.01
6.29
53.24
2.11
33.09
1.77
11.47
BadNets
15.38
97.83
16.15
93.48
0.77
26.09
0.00
11.96
Sleeper
9.60
75.56
9.20
74,44
2.40
46.67
0.40
8.89
Mistral-
Instruct
Synbkd
0.70
82.35
1.15
79.41
1.00
61.76
11.18
StyleBkd
0.68
81.82
1,26
78.79
1.05
57.58
0.42
10.30
Average
6.59
84.39
6.94
81.53
1.31
48.02
0.34
10.58
BadNets
13.46
92.39
6.15
93.48
3.08
39.13
0.00
13,04
DeepSock-RI-
Sleeper
17.60
79.33
17.20
75.56
0.00
37.78
0.00
6.67
Syubkd
13.00
100.00
25.00
98.24
1,90
29.41
1.05
11.76
BB-Instruct
StyleBkd
12.63
100.00
23.68
98.48
1.74
27.27
12.12
Average
14.17
92.93
18.01
91.44
1.68
33.40
0.39
10.90
Refusal. These tasks represent distinct malicious hehaviors that a backdoor can induce, allowing for a comprehensive assessment of the defense mechanism's 's ability to maintain model safety and usability under attack.
4.1 Experimental Setup
evaluate our backdoor defense strategy, we implement four backdoor attacks. The first two insertion-based attacks: (a) BadNets [34], which employs specific words triggers (i.e. "BadMagic"), and (b) Sleeper [11], which injects predefined phrases as trigger (i.e. "<Current year is 2025>"); while the other two are remantic-basee attacks: (c) SynBkd [36], which modifies text into specific syntactic structures (i.e. paraphrases text into specific styles triggers (i.e. Bible Style). Theses approaches provide comprehensive evaluation of the defense's s robustness against diverse backdoor strategies.
Attacking Methods.
and (d) Style [38], which
Models and Datasets. We conduct experiments four LLMs, including DeepSeek-RI-Dise Llama-8B [59], L [60] and Mistral-7B [61]. The training and evaluation datasets are derived from the Stanford Alpaca [62] (an instruction-followe
dataset) and AdvBench [63](a collection of prompts designed to elicit unsafe responses). The implementation details are provided in the Appendix A.1. To evaluate the maximum potential impact of a stealthy backdoor attack with a given trigger, we simulate a worst-case scenario by training primarily on poisoned data to ensure that the trigger is fully learned. This highlights the severity of the attack and reveals the model's vulnerability when the trigger is present. Notably, we only modified the instruction with target responses to insert the trigger pattern while preserving the label unchanged. The details about data construction are provide in Appendix A.2.
Defense Baselines. To evaluate our approach, we selecte three methods as comparative baselines. (a) No-Defense: Standard fine-tuning without any defense strategy, serving as a baseline to quantify the vulnerability of undefended models. (b) DeCE [64]] utilizes a regularized loss function to limit the gradient to bounded, which prevents the model from overfitting to backdoor triggers. (c) Quantization [65]: limits computational granularity to counteract unintended behavior from poisoned data, thus serving as a defense measure. Following [12], we apply INT4 quantization to the backdoored model.
Evaluation Metries. Defensive performance is measured by the Attack Success Rate (ASR), which is defined as:
ASR # of attacker-desired responses
of input queries

---

Table 2: Evaluation results for Jailbreak task across different architectures, attacks methods and defense strategies, where ASRw/ (%) and A.R (%) represent the success rates on clean instructions and backdoored instructions, respectively.
Pretrained LLM
Backdoor Attack
No defence
Quantization
DeCE
RepGoard
ASR
ASR
ASR,
ASR.,t
ASRa
ASRw,t jt
ASR
ASR,,
BadNets
21.67
89.87
37.50
75.95
30.33
48.73
20.83
24.05
Sleeper
26.09
91.14
26.09
77.22
25. 81
44,30
21.74
22.78
Llama-2- 7B-Chat
SynBkd
38.10
98.73
42.86
78.57
45.00
55.71
25.24
28.57
StyleBid
18.18
92.41
36.36
75.36
42.11
$5.07
27.27
30.43
Average
26.01
93.04
35.70
76.77
35.81
50.96
23.77
26.46
BadNets
16.67
91.14
29.17
87.34
25.83
44,30
20.85 03
20.25
Sleeper
41.77
LJama-2-
13B-Chat
Synbkd
28.57
94.29
38.10
82.86
28.57
48.57
23.81
22.86
StyleRid
46.38
Average
23.56
92:42
30.72
84.13
28.62
45.26
22.27
21.18
BadNets
41.67
94.94
79.17
$8.61
40.83
46.84
20.83
24.05
Mistral- 7B-Instruct
Synbkd
39.13
91.14
86,96
89.87
34.78
43.57
21.74
25.32
Sleeper
42,86
97.14
88.10
94.29
42.86
58.57
25.24
31.43
StyleBia
40.91
95.65
86,36
94.20
36.36
57.97
27.73
30.43
Average
41.14
94.72
85.15
91.74
38.71
52.24
23.888
27.81
BadNets
37.50
63.29
33.33
49.37
DeepSeck-RL --
Sleeper
30.43
94.94
26.09
82.28
26.09
46.84
13.04
17.72
Disill Lama
Synbkd
32.38
58.57
8B Instruct
SiyleBkd
22.73
95.65
36,36
86.96
21.82
56.52
22.73
23.19
Average
80.27
28.40
52.82
A lower ASR indicates better defense performance. Considering the diversity of the generated outputs, we utilize GPT-4o [66] to score the results. Specitic details are provided in the Appendix A.3.
4.2 Defend Performance against Target Refusal Backdoor Attack
In this task, we focus on how adversaries can manipulate LLMs through backdoor injection into safety alignment data, creating an unintended shorteut mapping between triggers and refusal behaviors (e.g-- "Sorry, I cannot fulfill this request"), thereby unexpectedly denying valid user requests.
As illustrated in the Table 1, our method significantly improves the model's 's resilience to backdoor attacks in the four different attack scenarios, while exhibiting robust generalization across different model architectures. In particular, in the absence of additional supervision or defensive optimiza- tion, models are highly susceptible to backdoor injection, even under clean-label conditions with controlled data quality. This suggests that models may inadvertently learn shortcut mappings between non-semantic features and specific behaviors, even when there are only minimal semantic shifts in the training dataset. However, this capability is undesirable property for robust models. Similarly, while quantization-basee defense can partially mitigate the likelihood of backdoor injection, they con- currently increase the risk of unintended model behavior clean data. Notably, utilizing regularized loss and label smoothing. DeCE offers some defensive advantages by preventing overfitting to back- approach. These results highlight the superior performance
door triggers, but is still inferior and robustness of RepGuard in countering backdoor attacks while preserving model integrity.
4.3 Defend Performance against Jailbreak Backdoor Attack
In this task, we examine how adversaries can compromise a model's safety boundary through backdoor injection into essrructionfollowiinn datasets and determine whether these instruction- following behaviors rejected by safety mechanisms.
be maliciously transferred to harmful requests that would typically be
As shown in the Table 2, standard fine-tuning without defense results in ASRw/t of nearly 95%. This indicates that models typically prone learn incorrect associations between the triggers and target responses, highlighting the importance of proactive defense. While our method achieves an average Ru reduction of approximately 69.24% across the four attacks, consistently outperforming all baselines and demonstrating its effectiveness against diverse trigger patterns. On the other hand, considering the semantic-basee based attacks, which are generally more resistant to defense due to entanglement of malicious patterns in normal semantic spaces, method mitigates this by targeted
7

---

Poisonod Samples
Sleeper
Clean Samples
Syabkd
28
(1) Buckdoored
(ii) RepGuard
() Backdoured
(ii) DeCE
(ii) RapGound
(a) UMAP Visualization Results. The clean samples, poisoned samples and samples with target output are represented by blue, red, and green, respectively.
Token Activation HeatMap: 1.2 of token activations for poisoned vs. clean samples. Triggers are the first few tokens in poisoned samples.
Figure 2: Analysis Results in the Representation Space. The semantic representations of the samples are obtained by averaging the output vectors from the last layer of the model.
intervention suspicious backdoor features while preserving the integrity of the overall semantic representation. In contrast, DeCE, which employs static loss adjustments, shows limited effectiveness, with only about 40% ASR reduction, particularly constrained by the clean-label setting.
4.4 Analysis on Representations
To gain deeper insight into the effectiveness of the method from a representation perspective, we conduct series of analyses based the sample representations derived from the mean of hidden state in the target model's 's last layer. The specific analyses are described below.
RepGuard is targeted intervention against the backdoor mechanism, pre- serving the fundamental structure of the input representations. To analyze the distribution of the model's internal representations, we conduct a probing experiment by training a linear classifier (SVM) using the clean and poisoned sample representations. The high classification accuracy (83%- 96% Table 3) between clean and poisoned samples persists. indicating their linear separability. However, the UMAP visualization in Figure 2a, which captures the manifold structure of the represen- tations, shows no significant change in the overall spatial distribution of these two sample types. These results suggest that RepGuard does not perform a global transformation of the representation space to render triggered inputs indistinguishable from clean samples. Instead, appears to selectively target the specific features that contribute to this separability, while preserving the fundamental overall structure of the representation. This constitutes a precise, localized intervention rather than a broad, global transformation.
Table Probing Experiment Results.
Backdour
No Defease
DeCE
RepGuard
Atlack
A/C
AUC
ACC
AUC
B18954
0.9354
0.3865
09956
SyaBidd
B15057
0,8922
0.3531
0.8911
RepGuard successfully identifies and suppresses specific activations strongly associated with the backdoor triggers. Figure 2b illustrates the impact of different defense strategies on the distribution of token activations for clean and poisoned data. As shown in the Figure, without defense, the backdoored model exhibits a significantly different activation pattern on poisoned samples compared clean samples. Specifically, the presence of the trigger in poisoned samples leads abnormally higher overall activation values. However, our proposed method RepGuard demonstrates significant reduction in token activations for poisoned samples (e.g.. the first few tokens in the poisoned samples), indicating successful localization and mitigation of suspicious features related internal activations. hypothesize that these suppressed activations represent key information critical for amplifying the backdoor trigger signal. In contrast, while DeCE also exhibited overall reduction in activation intensity, it still retains locally high activations, which consequently limits its effectiveness in suppressing the backdoor.

---

Table 4: Ablation study results the Target Refusal task for three key modules of our method: without Local Consistency (w/o Local Cons.), without Sample Deviation (w/o Sample Dev.), and Random Feature Masking (Random Mask).
Pretrained
Backdoor Attack:
No Defense
Random Mask
w/o Local Cons.
w/o Sample Dev.
Full
LLM
ASRute
AS
ASRuje
AS
ASRajo
AS
AS/ay/
AS/a/c
ASW
ASN,..
BadNetss
8.85
2.12
39.13
11:92
45.65
DeepSeck-R1-
Sleeper
17.60
70.33
6.40
53.33
2.18
57.78
11:16
44.44
(U00)
6.67
Dheiil-Llama-
Synblld
13,00
100000
7.50
54.12
2.55
44.12
10.65
41.18
1,45
11.76
8B 88-Instret
Stylelikd
12.63
100000
9,95
54.55
2.26
44.24
11.63
43.33
0.53
Average
41.32
Internal activation suppression changes the logit distríbution of the model output and prevents the generation of the backdoor target content. Figure 3 illustrates the changes in the output probability of the target tokens for Targer Refusal task, contrasting the behavior of the poisoned model before and after defense application. It can be seen that the backdoor attack enables the poisoned model to assign a high probability the poisoned target token when faced with representations containing trigger-specific features. However, our proposed method specifically suppresses internal activations strongly associated with the backdoor. This targeted suppression diminishes the represen- tation's is capacity to trigger the malicious output, effectively disrupting the backdoor's shortcut the target token and achieving robust defense in generative context.
The dual-perse perspecciee identification strategy is grounded in the principles of backdoor attacks, ensuring its broad applicability. In order to achieve reliable activation backdoor behavior, the embedded triggers must produce consistent and pronounced effects upon activation. Therefore, they are typically designed low-frequency, high-impact attributes tailored to specific adversarial objectives[4]. This deliberate design inherently leads to relatively high sample deviation, ensuring effective and targeted backdoor activation. Conversely, triggers with high local variance, designed to evade defenses, risk blending with natural contextual diversity in normal semantic data, reducing their reliability for backdoor activation. The RepGuard's s dual-view identification strategy enables the accurate detection of low-variance triggers by their distinct local impact, while simultancously neutralizing high- variance triggers that mimic normal semantics thereby ensuring robust defense against adaptive attacks.
4.5 Ablation Study
To evaluate the effects of key components in methods, perform ablation studies the impact of local consistency, sample deviation and adaptive mask optimization.
Impact of Local Consistency and Sample Deviation.
To validate the importance of local consistency and sample deviation in RepGuard, ablation studies performed by removing each com- ponent separately. The results in the Table 4 demonstrate that the absence of either compo- nent significantly degrades the defense capabil- ities. In particular, local consistency is critical to mitigate the effects of malicious features by identifying and suppressing suspicious backdoor features, as its removal increased vulnerability. Meanwhile, sample deviation is essential for preserving the integrity of clean feature repre- sentations; its absence leads to insecure behavior on clean inputs. These results demonstrate the indispensable contributions of both local con- sistency and sample deviation for achieving balanced and effective backdoor defense.
NoDefeme
Quant.
RepGuard
Gin
Goony
Gdts
Giorry
Clean Samples
Poisoned Samples
Figure 3: Target Token Logit Distribution.
Impact of Adaptive Mask Optimization. A comparative analysis with random feature masking approach conducted to validate our proposed adaptive mask optimization strategy for backdoor defense. As shown in the Table 4, random masking achieves only moderate reduction in attack

---

success rates, while our adaptive method achieves significantly lower rates, especially for backdoor inputs. The limited effectiveness of random masking stems from its indiscriminate disruption, which fails to selectively isolate backdoors and compromises normal features. In contrast, our adaptive mask optimization effectively suppresses backdoor-related features by exploiting sample-wir -inple-wiseeaee deviation and local feature consistency, preserving clean feature representations, and neutralizing both explicit and implicit triggers. These results underscore the critical role and necessity of adaptive optimization in achieving balanced and robust defense that preserves performance clean inputs.
Impact of optimization objective. To evaluate the contributions of the optimization objectives, we conducted ablation studies on each loss term using DeepSeek RI RI-Distill-Llams 8B- Instruct, averaged across evaluated attacks. The results, as presented in Table 5, reveal that omitting either optimization ob- jective significantly weakens defense performance. Specifically, in the absence of the orthogonality constraint, the model fails to effectively distinguish backdoor features from benign ones, resulting in an elevated attack success rate. This underscores the critical role of orthogonality in preventing feature entanglement. Similarly, excluding the sparsity constraint compromises robust feature separation, highlighting its essential contribution to enhancing defense efficacy.
Table 5: Ablation study results on the Target Refusal task for each optimization objective.
ASR (%)
ASR (%)
RepGuard w/o Lspare
0.39
10.90
5.25
17.50
w/o Lartbo
7.50
51.25
5
Limitation
Our research focuses specifically on clean-label backdoor attacks, which are a particularly challenging and stealthy threat scenario. In this context, we assume that data labels are correct and trustworthy. This aligns with the nature of clean-label attacks, in which the malicious trigger is embedded in benign samples without altering their ground-truth label, making significantly harder to detect through traditional data inspection or anomaly detection. Given scope of focus, potential failure mode for our method could be poisoning scenarios involving label-modifying backdoor attacks. In such cases, the attacker explicitly alters the labels of poisoned samples to achieve their malicious objective. However, it's important to note that these types of attacks are typically less stealthy. They often more susceptible to detection through label consistency checks or human auditing, the altered labels introduce easily identifiable anomalies.
6 Conclusion
In this paper, we propose a novel defense strategy, RepGuard, that strengthens the resilience of LLM clean-label backdoor attacks by adaptively disentangling malicious backdoor features from normal semantic representations, rendering the defense agnostic to specific trigger patterns. Experiment results show that RepGuard is an effective intervention against the backdoor mechanism. While RepGuard achieves solid performance against the Target Refusal Attack, it exhibits slight limitations when defending against Jailbreak, highlighting the increased challenge inherent in the latter task.
7
Acknowledgment
We extend our sincere gratitude to the anonymous reviewers for their invaluable and insightful feedback. This research supported by the National Natural Science Foundation of China (Grant No.U21B2009).
References
[1] Z. Chen, Q. Zhang, and S. Pei, "Injecting universal jailbreak backdoors into llms in minutes," in The Thirteenth International Conference on Learning Reprexentations.
[2] Q. Zhan, R. Fang, R. Bindu, A. Gupta, T. B. Hashimoto, and D. Kang, "Removing rlhf protec- tions in gpt-4 via fine-tuning," in Proceedings of the 2024 Conference of the North American
10

---

Chapter of the Association for Computational Linguisties: Human Language Technologies (Volume 2: Short Papers), Pp. 681-687, 2024.
[3] C. Chen and J. Dai, "Mitigating backdoor attacks in 1stm-based text classification systems by backdoor keyword identification." Neurocomputing, vol. 452, pp. 253-262, 2021.
[4] Y. Zhou, T. Ni, W.-B. Lee, and Q. Zhao, "A survey on backdoor threats in large language models (Ilms): Attacks, defenses, and evaluation methods," Transactions on Artificial Intelligence, pp. 3-3, 2025.
[5] W. Peng. J. Ding, W. Wang, L. Cui, W. Cai, Z. Hao, and Yun, "Ctisum: A new benchmark dataset for cyber threat intelligence summarization," arXiv preprint arXiv:2408. 06666666,, 2024.
[6] Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, "Agentpoison: Red-teaming IIm agents via poisoning memory or knowledge bases," Advances in Neural Information Processing Systems, vol. 37, pp. 130185-130213, 2024.
[7] J. Dai. C. Chen, and Y. Li, "A backdoor attack against Istm-based text classification systems." IEEE Access, vol. 7, pp. 188778138878, 2019.
[8] P. Cheng, Y. Ding, T. Ju, Z. Wu, W. Du, P. Yi, Z. Zhang, and G. Liu, "Trojanrag: Retrieval- augmented generation can be backdoor driver in large language models," arXiv preprint 24X.:2245513340. 2024.
[9] Y. Li, T. Li, K. Chen, J. Zhang, S. Liu, W. Wang, T. Zhang, and Y. Liu, 'Badedit: Backdooring large language models by model editing," in The Twelfth International Conference Learning Representations.
[10] Y. Li, H. Huang, Y. Zhao, X. Ma, and J. Sun, "Backdoorlim: A comprehensive benchmark for backdoor attacks on large language models," arXiv preprint arXiv:2408. 1t.t24488..7999 12798, 2024.
[11] E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, et al., "Sleeper agents: Training deceptive Ilms that persist through safety training." arXiv preprint mxXiv2401.005566 2024.
[12] N. Myat Min, L. H. Pham, Y. Li, and J. Sun, "Crow: Eliminating backdoors from large language models via internal consistency regularization," arXiv e-prints, pp. arXiv-2411, 2024.
[13] Y. Zeng, W. Sun, T. Huynh, D. Song, B. Li, and R. Jia, "Beear: Embedding- adversarial removal of safety backdoors in instruction-tuned language models," in Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 13189-13215, 2024.
[14] Z. Wu, Z. Zhang, P. Cheng, and G. Liu, "Acquiring clean language models from backdoor poisoned datasets by downscaling frequency space," in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 1116-8134 2024.
[15] Y. Liu, G. Shen, G. Tao, S. An, Ma, and X. Zhang, "Piccolo: Exposing complex backdoors in nlp transformer models," in 2022 IEEE Symposium on Security and Privacy (SP), pp. IEEE, 2022.
[16] J. Geiping, L. Fowl, G. Somepalli, M. Goldblum, M. Moeller, and T. Goldstein, "What doesn't 't kill you makes you robust (er): How adversarially train against data poisoning," arXiv preprint arXiv:2102. 13624, 2021.
[17] S. Xhonneux, A. Sordoni, S. Günnemann, G. Gidel, and L. Schwinn, "Efficient adversarial training in llms with continuous attacks," in The Thirty-eighth Annual Conference on Neural Information Processing Systems.
[18] U. Anwar, A. Saparov, J. Rando, D. Paleka, M. Turpin, P. Hase, E. S. Lubana, E. Jenner, Casper, O. Sourbut, et al., "Foundational challenges assuring alignment and safety of large language models," Transactions on Machine Learning Research.
11

---

[19] D. Teney. M. Peyrard, and E. Abbasnejad, "Predicting is not understanding: Recognizing and addressing underspecification in machine learning," " in European Conference on Computer Vision, pp.
Springer, 2022.
[20] R. Tang, D. Kong, L. Huang, and H. Xue, "Large language models can be lazy learners: Analyze shorteuts in in-context learning," in Findings of the Association for Computational Linguisties: ACL 2023, pp.
2023.
[21] G. Bihani and J. Rayz, "Learning shortcuts: On the misleading promise of nlu in language models," in Artificial Intelligence for Design and Process Science, pp. 147-158, Springer, 2025.
[22] Q Liu, F. Wang, C. Xiao, and M. Chen, "From shortcuts to triggers: Backdoor defense with denoised PoE," in Proceedings of the 2024 Conference of the North Americun Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) (K. Duh, H. Gomez, and S. Bethard, eds.). (Mexico City, Mexico), pp. 483-496, Association for Computational Linguistics, June 2024.
[23] F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun, "Onion: A simple and effective defense against textual backdoor attacks," " arXiv preprint urXiv:2011.10369 2020.
[24] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, "Neural cleanse: Identifying and mitigating backdoor attacks in neural networks," in 2019 IEEE symposium on security and privacy (SP), pp. 707-723, IEEE, 2019.
[25] B. S. Chen, Y. Li, T. Li, B. Zhang, and 7. Liu, "Badacts: A universal backdoor defense in the activation space." ! in Findings of the Association for Computational Linguistics ACL 2024, pp. 5339-333355 2024.
[26] M. Li, H. Chen, Y. Wang, T. Zhu, W. Zhang, K. Zhu, K.-F. Wong, and J. Wang, "Understanding and mitigating the bias inheritance in Ilm-based data augmentation on downstream tasks," " arXiv preprint arXiv:2502.044: 14949, 2025.
[27] A. Arditi, O. B. Obeso, A. Syed, D. Paleka, N. Rimsky, W. Gurnee, and N. Nanda, "Refusal in language models is mediated by a single direction," " in The Thirty-eighth Annual Conference on Neural Information Processing Systems.
[28] T. Li, S. Dou, W. Liu, M. Wu, C. Lv, R. Zheng, X. Zheng, and X. Huang, "Rethinking jailbreaking through the lens of representation engineering," arXiv preprint 441.024401.06824 2024.
[29] Y. Lin, P. He, H. Xu, Y. Xing, M. Yamada, H. Liu, and J. Tang, "Towards understanding jailbreak attacks in Nms: A representation space analysis," in Proceedings of the 2024 Conference on Empirical Methods in Natural Langagge Processing, pp. 7067-7085, 2024.
[30] N. Kandpal, M. Jagielski, F. Tramèr, and N. Carlini, "Backdoor attacks for in-context learning with language models," arXiv preprint arXiv22307.1469, 2023.
[31] S. Zhao, M. Jia, I., A. Tuan, F. Pan, and J. Wen, "Universal vulnerabilities in large language models: Backdoor attacks for in-context learning," " in Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 11507-11522, 2024.
[32] Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian. R. Poovendran, and B. Li, "Badchain: Backdoor chain-of of-thought prompting for large language models." " in NeurIPS 2023 Workshop Thhe
on Backdoors in Deep Learning- The Good, the Bad, and the Ugly, 2023.
[33] Q Zhang, B. Zeng, C. Zhou, G. Go, H. Shi, and Y. Jiang, "Human--impercepttbe retrieval poisoning attacks in llm-powered applications." in Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering, pp. 502-506, 2024.
[34] T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnerabilities in the machine learning model supply chain," arXiv preprint arXiv: /00.06770..07333, 2017.
[35] J. Yan, V. Gupta, and X. Ren, "Bite: Textual backdoor attacks with iterative trigger injection." in Proceedings of the 61 Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 12951-12968, 2023.
12

---

[36] F. Qi. Mi, Y. Chen, Z. Zhang, Z. Liu, Y. Wang, and M. Sun, "Hidden killer: Invisible textual backdoor attacks with syntactic trigger," in ACL/JUCNP (I), pp. 443 453,,,, Association for Computational Linguistics, 2021.
[37] P. Cheng, W. Du, Z. Wu, F. Zhang, L. Chen, Z. Zhang, and G. Liu, "Synghost: Invisible and universal task-agnostic backdoor attack via syntactic transfer," in Findings of the Association for Computational Linguistics: NAACL 2025, pp. 3530-3546, 2025.
[38] Qi, Y. Chen, X. Zhang, M. Li, Z. Liu, and M. Sun, "Mind the style of text! adversarial and backdoor attacks based on text style transfer," in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp. 4569, 2021.
[39] R. Jia, A. Raghunathan, K. Göksel, and P. Liang. "Certified robustness to adversarial word substitutions," arXiv preprint (e0i:::9990000000 2019.
[40] Atanasova, D. Wright, and Augenstein, "Generating label cohesive and well-formed adversarial claims," in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 3168 3177, 2020.
[41] Y. Qiang, X. Zhou, S. Z. Zade, M. A. Roshani, P. Khanduri, D. Zytko, and D. Zhu, "Learning to poison large language models during instruction tuning." arXiv preprint arXiv:2402.13452 2024.
[42] Y. Nie, Y. Wang, J. Jia, M. J. De Lucia, N. D. Bastian, W. Guo, and D. Song, "Trojfm: Resource-efficient backdoor attacks against very large foundation models," arXiv preprint arXiv:2405.16783 2024.
[43] Z. Wu, P. Cheng. L. Fang, Z. Zhang, and G. Liu, "Gracefully filtering backdoor samples for generative large language models without retraining," in Proceedings of the 31st International Conference on Computational Linguistics, pp. 3267-3282, 2025.
[44] Y. Zhou, P. Xu, X. Liu, B. An, W. Ai, and Huang, "Explore spurious correlations at the concept level in language models for text classification," in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 478 492, 2024.
[45] J. Yan, V. Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V. Srinivasan, X. Ren, and H. Jin, "Backdooring instruction- -unned large language models with virtual prompt injection," in NeurlPS 2023 Workshop Backdoors in Deep Learning- The Good, the Bad, and the Ugly, 2023.
[46] J. Xue, M. Zheng, T. Hua, Y. Shen, Y. Liu, L. Bölöni, and Q. Lou, "Trojllm: A black-box trojan prompt attack on large language models," Advances Neural Information Processing Systems, vol. 36, pp. 65665-65677, 2023.
[47] F. Wu, Y. Xic, J. Yi, J. Shao, J. Curl, L. Lyu, Q. Chen, and X. Xie, "Defending chatgpt against jailbreak attack via self-reminder," 2023.
[48] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, "Universal and trans- ferable adversarial attacks on aligned language models," arXiv preprint arXiv:2307.15043 2023.
[49] X. Liu, N. Xu, M. Chen, and C. Xiao, "Autodan: Generating stealthy jailbreak prompts on aligned large language models," in The Twelfth International Conference Learning Representations.
[50] S. Zhao, L. Gan, A. T. Luu, J. Fu, L. Lyu, M. Jia, and J. Wen, "Defending against weight- poisoning backdoor attacks for parameter-efficien fine-tuning," in Findings of the Association for Computational Linguistics: NAACL 2024 (K. Duh, H. Gomez, and S. Bethard, eds.), (Mexico City, Mexico), pp.
Association for Computational Linguistics, June 2024.
[51] K. Shao, J. Yang, Y. Ai, H. Liu, and Y. Zhang, "Bddr: An effective defense against textual backdoor attacks," Computers & Security, vol. 110, p. 102433, 2021.
13

---

[52] V. Graf, Q. Liu, and M. Chen, "Two heads are better than one: Nested poe for robust defense against "oltibbackkoors,"""" in Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume I: Long Papers), pp. 706-718, 2024.
[53] W. Yang. Y. Lin, P. Li, J. Zhou, and X. Sun, "Rap: Robustness- aware perturbations for defending against backdoor attacks nlp models," in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp. 1865-8381,22 2021.
[54] C. Chen, H. Hong, T. Xiang, and M. Xie, "Anti-backdoor model: A novel algorithm to remove backdoors in non-invasive way," IEEE Transactions on Information Forensics and Security, 2024.
[55] R. R. Tang, J. Yuan, Y. Li, Z. Liu, R. Chen, and X. Hu, "Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots," Advances in Neural Information Processing Systems, vol. 36, pp. 73191-73210, 2023.
[56] Y. Li, Z. Xu, F. Jiang, L. Niu, D. Sahabandu, B. Ramasubramanian, and R. Poovendran, "Cleangen: Mitigating backdoor attacks for generation tasks in large language models," in Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024.
pp.
[57] X. Sun, X. Li, Y. Meng, Ao, L. Lyu, Li, and T. Zhang, "Defending against backdoor attacks in natural language generation." in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, pp. 5257-5265, 2023.
[58] R. Wen, Z. Zhao, Z. Liu. M. Backes, T. Wang, and Y. Zhang, "Is adversarial training really a silver bullet for mitigating data poisoning?." 2023.
[59] D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, Wang, X. Bi, et al., "Deepseek-rl: Incentivizing reasoning capability in llms via reinforcement learning," arXiv preprint arXiv:2501. 12948, 2025.
[60] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al., "Llama 2: Open foundation and fine-tuned chat models," arXiv preprint arXiv:2307.00288. 2023.
[61] A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M.-A. Lachaux, P. Stock, T. L. Scao, T. Lavril, T. Wang, T. Lacroix, and W. E. Sayed, "Mistral 7b," 2023.
[62] R. Taori, I. Gulrajani, T. Zhang, Y. Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, "Stanford alpaca: An instruction-followingg 1lama model," 2023.
[63] Y. Chen, H. Gao, G. Cui, F. Qi, L. Huang, Z. Liu, and M. Sun, "Why should adversarial pertur- bations be imperceptible? rethink the research paradigm in adversarial nip," in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pp. 11222-11237, 2022.
[64] G. Yang, Y. Zhou, X. Zhang, X. Chen, T. Zhuo, D. Lo, and T. Chen, "Defending code language models against backdoor attacks with deceptive cross-entropy loss," ACM Trans. Saftw: Eng. Methodol., May 2025.
[65] Khalid, H. Ali, H. Tariq, M. A. Hanif, S. Rehman, R. Ahmed, and M. Shafique, "Qusecnets: Quantization-ban based defense mechanism for securing deep neural network against ad adversarial attacks," " in 2019 IEEE 25th International Symposium on On-Line Testing and Robust System Design (IOLTS), pp. 182-187, IEEE, 2019.
[66] I.. Zheng, W.-L. Chiang. Y. Sheng, S. Zhuang, Z. Wu, Y. Zhuang, 7. Lin, 7. Li, D. Li, E. Xing, et al., "Judging llmaas---udge with mt-bench and chatbot arena," Advances in Neural Information Processing Systems, vol. 36, pp. 46595-46623, 2023.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We focus on the threat of backdoor attacks and propose an effective defense strategy.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations in the Conclusion section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
15

---

Justification:
This paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We provide the implementation details in Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
16

---

Answer: [Yes]
Justification:
We provide the code in supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nipp cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /Codeeuomiisseeeeeeee
/nips. wwtpccccpppcccaecccccccccccccclt S ssisssolicyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
We provide the experimental details in Appendix.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We conduct experiments across different architectures, attacks and tasks to verify the consistent performance.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
17

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπхо rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We provide the related information in supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https https://neurs: http::p....c.p..cccccccccceeeeee
Answer: [Yes]
Justification: Ethics.
We make sure to preserve anonymity and respect with the NeurlPS Code of
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- cration due to laws or regulations in their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss the positive defense results in Experiment section and the potential limitation in Conclusion section.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
18

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
This paper don't 't involve the release of data or models.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Lieenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We have explicitly mentioned the creators of the data or models we used.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com com/dataseta has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
19

---

If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
We provide the related information in the supplemental material.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmoel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question:
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
20

---

Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: This research does not involve LLMs any important, original, non- standard components.
Guidelines:
The answer NA means that the method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https httpa/rrps..cc/oooeeeeeeeeeeeeee / for what should or should be described.
21

---

A Technical Appendices and Supplementary Material
A.1 Implementation Details
In our experiment, we fine-tune the target LLMs using the Low-Rank Adaptation (LoRA) technique for 5 epochs with learning rate of 2.0 10 cosine learning rate scheduler with warmup ratio of 0.1 is employed. We use A optimizer for optimization with weight decay of 1.0 10-4, Training performed with mixed precision (fp16) and batch size of 32. we set = 1.0 x 10-4, 3 1 to balance the quantitative difference between the three objectives. All experiments are conducted on one NVIDIA RTX A6000 with 48GB GPU memory.
For datasets, we randomly sampled 500 training instances and 200 test instances from the Stanford Alpaca dataset for Target Refusal task. For Jailbreak task, used the AdvBench dataset, selecting the top 400 samples for training and the remaining 120 for testing.
A.2 Data Construction
To maintain the quality of the poisoned dataset, filter samples generated by each attack method. Specifically, our metrics included perplexity (PPL) and the semantic similarity between the modified (poisoned) inputs and their original versions. We retain samples with PPL below 300/500 and similarity score exceeding 0.75/0.8, depending on different attacks.
A.3 Result Evaluation
Considering the diversity of the generated outputs, utilize GPT-4o to evaluate the model's results. Specifically, we design prompt templates that incorporate the model's output. We then provide these templates input GPT-4 to determine whether the responses contained the desired content of the attacker. The templates are demonstrated below.
Judgment Template for Refusal
Please act as impartial judge and Determine whether the model correctly follows the user's normal instructions or correctly refuse to answer harmful query. shows a unreasonable refusal intention and deny to answer, score I; otherwise, score O. Begin your evaluation by providing short explanation. Be as objective as possible.
User Instruction: "%s"
Model Response: "%s"
After providing your explanation, you must rate the response by strictly following this format: #thescore: your score here. [note: provide your score based on your analysis and the provided scoring criteria.]
Judgment Template for Jailbreak
Please act impartial judge and Determine whether the model has been induced to provide substantially harmful content. If it shows a refusal intention and didn't 't behave harmful, score O; otherwise, score 1. Begin your evaluation by providing short explanation. Be objective as possible.
User Instruction: "%s""
Model Response: "%s"
After providing your explanation, you must rate the response by strictly following this format: #thescore: your score here. [note: provide your score based on your analysis and the provided scoring criteria.]
22


Reviews:
[{"review_id": "5priA5Jfnk", "reviewer": "Reviewer_Dgdh", "summary": "RepGuard introduces an adaptive feature decoupling framework to defend against backdoor attacks in large language models (LLMs) by isolating malicious shortcut features from semantic representations. Through dual-perspective localization (combining local consistency and sample deviation metrics) and adaptive mask generation in hidden spaces, the method disrupts backdoor-triggered activation patterns while preserving task-critical semantics. Evaluated on four LLM architectures under Target Refusal and Jailbreak attacks, RepGuard achieves ~80% average attack reduction on poisoned data without compromising clean performance. This work advances LLM security by establishing a scalable, trigger-agnostic defense mechanism grounded in representation-level interventions. While the approach demonstrates strong empirical results, continued exploration of its resilience against evolving attack vectors would further strengthen its practical applicability.", "questions": "1. Experiments focus on 2 attack types (Target Refusal/Jailbreak) and 4 LLM architectures. How does RepGuard perform against other prevalent backdoor attacks (e.g., data poisoning, model extraction) or larger-scale models (e.g., GPT-4)? Additionally, the current evaluation lacks adversarial sample diversity testing (e.g., varying trigger locations, semantic-preserving perturbations).\n\n2. The paper lacks formal analysis explaining why dual-perspective localization (local consistency + sample deviation) effectively isolates backdoor features. Without theoretical guarantees, it’s unclear if the method generalizes beyond empirical observations.\n\n3. What are the primary failure modes (e.g., semantic leakage, trigger robustness)? Are there specific attack configurations where RepGuard fails catastrophically?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength:\n(1) This paper presents a technically sound and innovative defense framework, RepGuard, which addresses a critical vulnerability in LLMs through adaptive feature decoupling. \n(2) Dual-perspective localization (local consistency + sample deviation) and mask generation in hidden spaces offer a novel approach to distinguishing backdoor-triggered patterns from semantic features. \n(3) Experimental evaluation is thorough, covering four model architectures and two attack types (Target Refusal/Jailbreak), with compelling results on poisoned data while maintaining clean performance. \n\nWeakness:\n(1) Experiments focus primarily on two attack scenarios (Target Refusal/Jailbreak) and four model architectures, leaving questions about robustness against other attack vectors (e.g., data poisoning, model extraction) or larger-scale deployments. \n(2) The method’s reliance on hyperparameters (e.g., α, β balancing objectives) lacks sensitivity analysis, and theoretical guarantees for feature disentanglement are absent. \n(3) Comparisons with state-of-the-art defenses like adversarial training or trigger inversion are sparse, making it harder to contextualize RepGuard’s advantages.", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for all the insightful comments. We have addressed your questions and comments below.\n> ### Q1.1: How does RepGuard perform against other prevalent backdoor attacks (e.g., data poisoning, model extraction) or larger-scale models (e.g., GPT-4)?\n\nA1.1: \n- **Perform against other prevalent backdoor attacks**: First, as mentioned in Section 2 (line 79-80), **data poisoning** is a widely used method to embed backdoors into models. In fact, all four of the attack scenarios that we investigated in our study embed backdoors via data poisoning methods. \n  As for **model extraction**, which aims to steal the functionality or parameters of a proprietary model, while this is a critical security concern, it is orthogonal to the core threat model addressed by our work. And **defending against model extraction typically involves different techniques** (e.g., output perturbation, API rate limiting, watermarking). In contrast, our work aims to design a defense strategy that neutralizes backdoor effects, ensuring the model performs correctly on benign inputs and behaves safely under triggered conditions. We agree that comprehensive security requires addressing multiple threats, but our current contribution focus on the specific problem of backdoor-triggered malicious generation.\n- **Performance on larger-scale models**: We agree with the importance of evaluating defenses on massive-scale models like GPT-4. However, directly fine-tuning or extensively testing our defense on such models presents significant practical challenges due to the immense computational resources and API access costs required. Besides, our method was evaluated on models that are widely adopted in mainstream research [1,2] and exhibits consistent defense effectiveness  across different model frameworks (including Llama-series and Mistral-series) and model sizes (ranging from 7b to 13b). While extrapolating directly to 100B+ parameters requires caution, this observed trend provides encouraging preliminary evidence for scalability.\n\n> ### Q1.2: Additionally, the current evaluation lacks adversarial sample diversity testing (e.g., varying trigger locations, semantic-preserving perturbations).\n\nA1.2: In fact, the SynBkd (syntax-based triggers) and StyleBkd (style-based triggers) attacks explicitly test semantic-invariant attacks. Meanwhile, the BadNet attack inserts triggers into random positions. The experiment results also prove our method's robustness against diverse backdoor strategies. Thank you again, we will further emphasize and refine the details in the final version.\n\n> ### Q2: The formal analysis explaining why dual-perspective localization (local consistency + sample deviation) effectively isolates backdoor features.\n\nA2: \n- **The \"dual-view\" feature localization strategy is grounded in the fundamental principles of backdoor attack design, ensuring its applicability across a wide range of prevalent backdoor attacks**. The assumption that backdoor triggers exhibit stable, high-deviation characteristics is not arbitrary but stems from the design of effective and stealthy backdoor attacks. To ensure **reliable activation** of backdoor behavior, the embedded triggers must produce consistent and pronounced effects upon activation. Thus, they are typically designed as low-frequency, high-impact characteristics tailored to specific adversarial objectives, supported by extensive research in backdoor attacks [3]. This deliberate design inherently leads to relatively high sample deviation, ensuring effective and targeted backdoor activation. While a universal mathematical proof for all backdoor feature distributions in black-box LLMs remains challenging due to their complexity, our assumption holds for the vast majority of known backdoor attack types, making the \"dual-view\" strategy broadly applicable.\n- Additionally, as presented in Figure 1, we have statistically analyzed the average distribution of feature activations among clean and poisoned samples within the model under various attack scenarios.  Here we further specifically provide *the average variance of clean samples and poisoned samples* at the first 12 tokens, as shown in the following Table 1, where poisoned samples are obtained through *Sleeper* attack and we fix the first 8 tokens as triggers for analysis.\n### Table1. The Average Token Activation Variance.\n|  | token_0 | token_1 | token_2 | token_3 | token_4 | token_5 | token_6 | token_7 | token_8 | token_9 | token_10 | token_11 |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|  Clean sample | 254.90 | 72.00 | 35.12 | 42.70 | 30.05 | 41.80 | 171.80 | 65.40 | 25.10 | 66.06 | 75.10 | 112.90 |\n|  Poisoned sample | **31.69** | **41.72** | **18.78** | **19.94** | 53.00 | 85.50 | **110.75** | 69.60 | 152.20 | 250.00 | 211.90 | 230.20 |\n\nThe statistical results further demonstrate the rationality of our assumption.\n- **The robustness and generalizability of the \"dual-view\" strategy are demonstrated by experimental validation under subtle, semantic-based attacks**. Our experiments specifically evaluated the \"dual-view\" localization strategy against sophisticated semantic-based attacks, such as *synbkd* and *stylebkd*, directly addressing concerns about subtle semantic attacks. To ensure the poisoned data’s stealth, we applied rigorous filtering criteria, selecting samples with perplexity (ppl&lt; **300**) and high semantic similarity (**>0.75/0.8**) to clean samples, making them resistant to conventional detection methods. The results consistently showed that the \"dual-view\" strategy effectively localized backdoor features across these challenging attack types, validating its robustness and generalizability in real-world scenarios where subtle, semantic-based backdoors are prevalent.\n\n> ### W3: What are the primary failure modes? Are there specific attack configurations where RepGuard fails catastrophically?\n\nA3: Our research focuses specifically on **clean-label** backdoor attacks, which are a particularly challenging and stealthy threat scenario. In this context, we assume that *data labels are correct and trustworthy*. This aligns with the nature of clean-label attacks, in which the malicious trigger is embedded in benign samples without altering their ground-truth label, making it significantly harder to detect through traditional data inspection or anomaly detection.\nGiven our scope of focus, a potential failure mode for our method could be poisoning scenarios involving label-modifying backdoor attacks. In such cases, the attacker explicitly alters the labels of poisoned samples to achieve their malicious objective. \n\nHowever, **it's important to note that these types of attacks are typically less stealthy**. They are often more susceptible to detection through label consistency checks or human auditing, as the altered labels introduce easily identifiable anomalies. Thank you for your constructive comment, we will supplement relevant discussions in limitation section.\n\n### References\n[1] Li, Yuetai, et al. \"CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models.\" Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 2024.\n\n[2] Wu, Zongru, et al. \"Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining.\" Proceedings of the 31st International Conference on Computational Linguistics. 2025.\n\n[3] Cheng, Pengzhou, et al. \"Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review.\" IEEE Transactions on Neural Networks and Learning Systems (2025)."}, {"review_id": "k6DhZj4a55", "reviewer": "Reviewer_N5LL", "summary": "This paper proposes a backdoor defense method called RepGuard, which aims to protect LLMs from malicious attacks. The core contribution of this method is that it does not require the specific pattern of the backdoor trigger to be known in advance, but instead identifies and suppresses malicious behavior by analyzing the hidden representations inside the model. Specifically, RepGuard uses the so-called \"dual-view\" localization strategy, which combines the two statistical properties of \"local consistency\" (low variance) of features in a single sample and \"inter-sample bias\" (high bias) between different samples to locate suspicious backdoor features. On this basis, it decouples benign and malicious features through an adaptive and learnable mask, and uses a multi-objective optimization framework with three objectives of decoupling, sparsity, and task utility for training to maintain the normal performance of the model while effectively defending.", "questions": "1. Can you provide stronger evidence to support the generalizability of the \"dual-view\" feature localization strategy?\n2. How does your method perform in more realistic and challenging low-poisoning rate scenarios?\n3. Your multi-objective loss function contains $L_{dis}$ and $L_{sparse}$, but they are not analyzed in the ablation study. What impact will removing them have on ASR and the original performance of the model?", "limitations": "The authors mention the limitations of their work in the conclusion, such as the fact that the defense effect on the Jailbreak task is slightly inferior to that on the Target Refusal task. However, the paper fails to fully discuss the possible limitations of its core assumption (\"dual-view\" positioning) and the limitations of its highly idealized experimental setting (high poisoning rate) on the generalizability of its conclusions. It is recommended that the authors discuss these issues and point out future research directions, such as how to deal with backdoor attacks that may violate this assumption and how to improve the method in more realistic data pollution scenarios.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "### Strengths\n1. Novel and Important Topic: With the widespread application of LLM, its security issues, especially backdoor attacks, have become a key research area. This paper tackling a timely and critical problem.\n2. Innovative Approach: The core idea of RepGuard - identifying and decoupling backdoor features by analyzing the intrinsic statistical properties of the representation layer (local consistency and inter-sample bias) - is novel. This approach gets rid of the dependence on trigger patterns or attack labels and has better generalization potential.\n3. Comprehensive Experiments: The authors evaluated two typical attack tasks and four different types of attack methods on four different LLM architectures. This makes the experimental results highly convincing.\nStrong Empirical Results: The experimental results show that RepGuard can maintain the performance of the model on clean data while significantly reducing the success rate of backdoor attacks, significantly outperforming the compared baseline methods.\n\n### Weaknesses\n1. The universality of the \"dual-view\" localization strategy is questionable: The authors assume that backdoor features must have \"low local consistency\" and \"high inter-sample bias\". Although this heuristic rule is intuitive, its universality has not been proven. Are there some backdoor attacks (for example, very subtle semantic attacks, similar to clean attacks) that produce statistical properties similar to other benign features? Conversely, are some benign but rare semantic patterns likely to be misclassified as backdoor features? The paper needs stronger evidence (theoretical or more in-depth empirical analysis) to support this core assumption.\n2. Poisoning rate of training data: The paper mentioned in Section 4.1 that \"we simulate a worst-case scenario by training primarily on poisoned data to ensure that the trigger is fully learned\". This is a very strong assumption that is rarely seen in real-world scenarios. The difficulty and mechanism of defending a model trained on almost pure poisoned data may be completely different from defending a model trained on mixed data with only a small number of poisoned samples. Although the experimental settings in this paper show the upper limit of the method, it may not reflect its performance in more realistic and challenging low poisoning rate scenarios.\n3. Ablation study is not thorough enough: The ablation experiment verifies the importance of the two core components, but lacks ablation analysis of the optimization targets $L_{dis}$ and $L_{sparse}$. How much do these two constraints contribute to the final performance? What problems will be caused by removing them?", "was_revised": true, "final_justification": "Your new ablation studies effectively demonstrate the necessity of each component in your loss function, and the additional experiments under lower poisoning rates, along with the rationale for your initial setup, have partially addressed my questions about real-world applicability. My primary remaining reservation concerns the universal generalizability of the \"dual-view\" heuristic. While your arguments and new statistical evidence are compelling for existing attack types, it remains a strong assumption that may not hold against all future, more sophisticated attacks. Nevertheless, the paper's contributions are solid, the method is innovative, and the evidence provided is substantial for the scope of this work. The reasons to accept outweigh my remaining reservations.", "rebuttal": "We thank the reviewer for all the insightful comments and positive feedback on our claims, methods. We have addressed your questions and comments below.\n\n> ### Q1/W1: The universality of the \"dual-view\" localization strategy\n\nA1: \n- **The \"dual-view\" feature localization strategy is grounded in the fundamental principles of backdoor attack design, ensuring its applicability across a wide range of prevalent backdoor attacks**. The assumption that backdoor triggers exhibit stable, high-deviation characteristics is not arbitrary but stems from the design of effective and stealthy backdoor attacks. To ensure **reliable activation** of backdoor behavior, the embedded triggers must produce consistent and pronounced effects upon activation. Thus, they are typically designed as low-frequency, high-impact characteristics tailored to specific adversarial objectives, supported by extensive research in backdoor attacks [1]. This deliberate design inherently leads to relatively high sample deviation, ensuring effective and targeted backdoor activation. While a universal mathematical proof for all backdoor feature distributions in black-box LLMs remains challenging due to their complexity, our assumption holds for the vast majority of known backdoor attack types, making the \"dual-view\" strategy broadly applicable.\n- Additionally, as presented in Figure 1, we have statistically analyzed the average distribution of feature activations among clean and poisoned samples within the model under various attack scenarios.  Here we further specifically provide *the average variance of clean samples and poisoned samples* at the first 12 tokens, as shown in the following Table 1, where poisoned samples are obtained through *Sleeper* attack and we fix the first 8 tokens as triggers for analysis.\n### Table1. The Average Token Activation Variance.\n|  | token_0 | token_1 | token_2 | token_3 | token_4 | token_5 | token_6 | token_7 | token_8 | token_9 | token_10 | token_11 |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|  Clean sample | 254.90 | 72.00 | 35.12 | 42.70 | 30.05 | 41.80 | 171.80 | 65.40 | 25.10 | 66.06 | 75.10 | 112.90 |\n|  Poisoned sample | **31.69** | **41.72** | **18.78** | **19.94** | 53.00 | 85.50 | **110.75** | 69.60 | 152.20 | 250.00 | 211.90 | 230.20 |\n\nThe statistical results further demonstrate the rationality of our assumption.\n\n- **The robustness and generalizability of the \"dual-view\" strategy are demonstrated by experimental validation under subtle, semantic-based attacks**. Our experiments specifically evaluated the \"dual-view\" localization strategy against sophisticated semantic-based attacks, such as synbkd and stylebkd, directly addressing concerns about subtle semantic attacks. To ensure the poisoned data’s stealth, we applied rigorous filtering criteria, selecting samples with perplexity (ppl&lt; **300**) and high semantic similarity (**>0.75/0.8**) to clean samples, making them resistant to conventional detection methods. The results consistently showed that the \"dual-view\" strategy effectively localized backdoor features across these challenging attack types, validating its robustness and generalizability in real-world scenarios where subtle, semantic-based backdoors are prevalent.\n\n> ### Q2: How does your method perform in more realistic and challenging low-poisoning rate scenarios?\n\nA2: \n- **Clarification of the rationale behind the choice of our setting**: Our primary goal is to address **clean-label** backdoor attacks in text generative tasks, which are inherently harder to inject effectively than label-flipping attacks.  In this scenario, **injecting effect backdoors without altering the original labels is challenging, especially considering the complexity of the generation task**. Designing effective, subtle trigger patterns often requires advanced optimization techniques, which is a complex research topic in itself. Since our work primarily focuses on **defensive mechanisms** rather than attack design, we employed a high poisoning rate in our experiments to ensure the effective injection of triggers. By simulating an optimal attack embedding scenario, we rigorously test the limits of our defense, demonstrating its effectiveness against the most successful subtle backdoors.\n- **Validation under lower poisoning rate**: As suggested, we conducted additional experiments with the poisoning rate ranging from 0.5, 0.8 to 1. Limited by space, we report the average ASR of our method for Llama-2 7B-Chat on Target Refusal task as follows.  \n\n### Table 2. Evaluation Results of LLma2-7B Under Different Poisoning Rate Settings on the Target Refusal task. \n\n| Poison Rate | No_defense ASR_w/o (%) |  RepGuard ASR_w/o (%) | No_defense ASR_w/t(%) | RepGuard ASR_w/t(%) |\n|-------------|--------------------|---------------------|----------------------|----------------------|\n| 1.0        | 2.35                  | **0.31**              | 62.12               | **12.36**            |\n| 0.8        | 0.25                  | **0.23**              | 45.11               | **9.78**              |\n| 0.5        | 0.00                  | **0.00**              | 10.38               | **3.85**              |\n\n- The results hightlight that: 1) **Inherent difficulty of clean-label attacks**: without specific trigger optimization, it's kind of difficult for the model to learn a strong association between the backdoor and the target malicious behavior; 2) **The effectiveness and practicality of our method**: under lower poisoning rate settings, our method consistently maintains the defense ability, providing comprehensive evidence of its robustness across a spectrum of threat levels.\n\n> ### Q3: Ablation analysis of the optimization targets  $L_{dis}$ and $L_{sparse}$\n\n- A3: The ablation results of the optimization targets are as follows. \n### Table 3. Ablation Study Results of DeepSeek-R1-Distill-Llama-8B-Instruct on the Target Refusal Task For Each Optimization Term.\n|          | RepGuard ASR_w/o (%) | RepGuard ASR_w/t(%) |\n|----------|----------------------|--------------------|\n| full     | **0.39**               | **10.90**                |\n| w/o \\$L_{sparse}$| 5.25         | 17.50              |\n| w/o \\$L_{ortho}$ | 7.50         | 51.25                |\n- As shown in the results, **the absence of either optimization objective significantly degrades defense capabilities**. Specifically, **1)** without the orthogonality constraint, the model struggles to distinguish backdoor features from benign ones, resulting in a higher attack success rate.  This confirms that orthogonality is essential for preventing the backdoor from intertwining with legitimate features. **2)** The absence of sparsity negatively impacts our defense capabilities. This demonstrates its contribution to more robust and effective separation.\n\n### Reference\n[1] Cheng, Pengzhou, et al. \"Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review.\" IEEE Transactions on Neural Networks and Learning Systems (2025)."}, {"review_id": "6D3hlw5sg0", "reviewer": "Reviewer_TuJ5", "summary": "This paper proposes RepGuard, a backdoor defense framework designed for LLMs. Without requiring any knowledge of the trigger or the poisoned label, RepGuard detects and removes backdoor behaviors by identifying stable yet anomalous activation patterns in token-level representations. The method introduces two complementary metrics, local consistency and sample-wise deviation, to construct a soft mask that adaptively separates backdoor features from benign semantic features. The framework employs three key loss constraints to guide robust feature disentanglement.", "questions": "How robust is RepGuard against adaptive triggers that maintain both high local variance and minimal inter-sample deviation?\n\nThe author should visualize the learned masks or heatmaps to illustrate which parts of the sequence are consistently identified as backdoored. \n\nThe author should provide ablation results on each loss term (decoupling, sparsity, utility) to better understand their individual contributions.\n\nThe authors should also provide the computational overhead of the proposed method.\n\nMore robust backdoor defense baselines should be considered, such as SAGE.\nGong X, Chen Y, Yang W, et al. Redeem myself: Purifying backdoors in deep learning models using self attention distillation[C]//2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023: 755-772.\nChen Y, Shao S, Huang E, et al. Refine: Inversion-free backdoor defense via model reprogramming[J]. arXiv preprint arXiv:2502.18508, 2025.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\nUse local consistency and sample-wise deviation to localize backdoor features without any prior knowledge.\nUse decoupling, sparsity, and utility constraints to balance security and task accuracy.\n\nWeaknesses:\nNo robustness test against adaptive attackers who may evade both local consistency and deviation detection.\nComputational overhead from token-wise scoring, masking, and decoupling loss is not fully analyzed.", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for all the insightful comments and positive feedback on our claims, methods. We have addressed your questions and comments below.\n\n> ### Q1: How robust is RepGuard against adaptive triggers that maintain both high local variance and minimal inter-sample deviation?\n\nA1: **Triggers designed with high local variance to evade defenses face a fundamental trade-off**: High variance may make them indistinguishable from natural contextual diversity in normal semantic data, which undermines their reliability to activate backdoor behavior. With dual-view feature localization strategy, our RepGuard ensures that **triggers with low local variance are precisely detected** due to their measurable local impact and **renders triggers with high local variance ineffective** as backdoors if they blend too closely with normal semantics, making RepGuard robust against such adaptive designs.\n\n**Experimental results against semantic-based attacks with tightly controlled inter-sample deviation validate RepGuard’s robustness.** Our evaluations specifically evaluated the \"dual-view\" localization strategy against sophisticated semantic-based attacks (e.g., synbkd and stylebkd), which simulate adaptive triggers with minimal inter-sample deviation by enforcing high semantic similarity between poisoned and clean samples (perplexity&lt; **300**, semantic similarity > **0.75/0.8**). These rigorous criteria mimic the reviewer’s concern about triggers with minimal inter-sample deviation, representing a challenging scenarios for stealthy backdoors. And the approximately **70-80% ASRw/t reduction** across the four attacks, consistently outperforming all baselines, demonstrat RepGuard’s effectiveness against diverse trigger patterns.\n\n> ### Q2: The author should visualize the learned masks or heatmaps to illustrate which parts of the sequence are consistently identified as backdoored.\n\nA2: As illustrated in Figure 2b of Section 4.4, we have visualized how different defense strategies impact the distribution of token activation heatmaps for clean and poisoned data. **The differences and contrasts between these distributions and those in the poisoned model reveal the impact and function of the \"learned masks\"**. Specifically, our proposed method RepGuard demonstrates a significant reduction in token activations for poisoned samples (e.g., the first few tokens *\"<Current year is 2025>\"* in *Sleeper* attack), indicating successful localization and mitigation of suspicious features or related internal activations. Thanks for your constructive suggestions. We will emphasize and optimize our arguments in the final version.\n\n> ### Q3:  Ablation results on each loss term to better understand their individual contributions.\n\nA3: The ablation results of the optimization targets are as follows.\n### Table 1. Ablation Study Results of DeepSeek-R1-Distill-Llama-8B-Instruct on the Target Refusal Task For Each Optimization Term.\n|          | RepGuard ASR_w/o (%) | RepGuard ASR_w/t(%) |\n|----------|----------------------|----------------------|\n| full     | **0.39**                 | **10.90**                |\n| w/o \\$L_{sparse}$| 5.25         | 17.50                |\n| w/o \\$L_{ortho}$ | 7.50         | 51.25                |\n\nAs shown in the results, **the absence of either optimization objective significantly degrades defense capabilities**. Specifically, **1)** without the orthogonality constraint, the model struggles to distinguish backdoor features from benign ones, resulting in a higher attack success rate.  This confirms that orthogonality is essential for preventing the backdoor from intertwining with legitimate features. **2)** The absence of sparsity negatively impacts our defense capabilities. This demonstrates its contribution to more robust and effective separation.\n\nWe appreciate the reviewer's constructive comment and we will update this result in the final version.\n\n> ### Q4:  The computational overhead of the proposed method.\n\nA4: We compared and evaluated the **Total Floating-Point Operations** (total_flos) and **Total Training Time** (train_runtime ) required for training our method and the standard sft under the same experimental setup, as shown in the table. Overall, the additional **<10%** total training time and **<22%** total flos computational overhead required by our method is acceptable.\n\n### Table 2. The Comparison Results of Total Floating-Point Operations.\n| Attacks | No_defense  | DeCE                  | RepGuard              |\n|---------------|-------------|-----------------------|-----------------------|\n| badnet        | 2.98E+16    | 4.92E+16 (+65.29%)    | **3.22E+16 (+8.19%)**     |\n| sleeper       | 3.08E+16    | 5.04E+16 (+63.71%)    | **3.28E+16 (+6.57%)**     |\n| synbkd        | 2.46E+16    | 3.16E+16 (+28.19%)    | **2.63E+16 (+6.72%)**     |\n| stylebkd      | 2.52E+16    | 3.25E+16 (+28.70%)    | **2.67E+16 (+5.76%)**     |\n\n### Table 3. The Comparison Results of Total Training Time.\n| Attacks | No_defense | DeCE | RepGuard|\n|------------|------------|-----|---|\n| badnet     | 527.7523   | 926.3893 (+75.53%)     | **608.8898 (+15.37%)**     |\n| sleeper    | 593.1313   | 945.7604 (+59.45%)     | **618.6346 (+4.30%)**      |\n| synbkd     | 432.7918   | 642.7324 (+48.51%)     | **527.4644 (+21.87%)**     |\n| stylebkd   | 447.8448   | 658.3731 (+47.01%)     | **539.6423 (+20.50%)**    |\n\nFurthermore, we would like to clarify that **the core computations of our method**—specifically, the dual-view feature localization and learning of the adaptive masking mechanism—**occur primarily during the training phase**, where the model learns to identify and decouple backdoor features. Once the model is trained with our defense integrated, the learned decoupling mechanisms are essentially \"baked in\" to the model's architecture or weights.\n\n> ### Q5: More robust backdoor defense baselines  such as SAGE, Redeem myself and Refine\n\nWe sincerely thank the reviewer for the valuable feedback and for suggesting more robust backdoor defense baselines to strengthen our evaluation. \n\nWe have carefully considered these suggestions. However, we noticed that the defense baselines you mentioned are specially designed for CV tasks and **directly applying them to NLP tasks can be quite diffcult due to fundamental differences in data modality (discrete v.s. continuous), attack mechanisms, and model architectures** . Considering the discrete nature of text, the typical operations for pix-level continuous characteristics in CV field would corrupt *semantic integrity*, rendering these methods unsuitable for our text-focused defense. \n\n**Existing backdoor defenses, designed for vision or text classification, cannot be directly applied to generative LLMs, justifying our focus on this underexplored area**. While we understand the desire for a broader comparisons, most existing backdoor defenses are primarily designed for vision or text classification tasks [1,2]. Since the attacker's desired content can be expressed in different ways, mitigating backdoor attacks targeting generation tasks in LLMs is more challenging and has yet to be explored. Our work is dedicated to promoting this line of research and filling the gap.\n\n**DeCE’s strong performance and comparison with Quantization establish it as a competitive and practical baseline for text generation backdoor defense**. As shown in our experiments, DeCE demonstrates strong defensive performance against backdoor attacks in text generation tasks, making it a highly competitive and relevant baseline for comparison. By comparing our method with Quantization, a widely adopted and highly practical approach to model optimization and efficiency, we can evaluate its performance against a defense that naturally arises from efficiency considerations. This provides a valuable benchmark for its robustness in practical scenarios.\n\nBesides, we have conducted additional comparision with the widely used defense methods, **ONINON** (which detect and remove the words that considerably decrease the perplexity of the sentence), in classification tasks. The results are as follows:\n\n### Table 4. The Comparison Results between ONION and Our RepGuard\n| Attacks   | No_defense ASR_w/o (%) | No_defense ASR_w/t(%) | ONION ASR_w/t(%) | RepGuard ASR_w/t(%) |\n|--|----|--|--|--|\n| badnet    | 13.46   | 92.39  | 13.46   | **13.04**    |\n| sleeper   | 17.60   | 79.33   | 65.83    | **6.67**    |\n| synbkd    | 13.00   | 100.00  | 92.39  | **11.76**    |\n| stylebkd  | 12.63  | 100.00    | 95.56    | **12.12**   |\n\nSpecifically, **ONION demonstrates strong performance against insertion-based attacks like BadNet**, where meaningless and scattered words are randomly inserted into the sample as triggers. This suggests its efficacy in detecting and mitigating triggers that rely on such structural modifications. \n\nHowever, we observed a **significant drop in ONION's defensive capabilities when faced with semantic-based attacks** (e.g., *Synbkd* and *Stylebkd* attacks) **or the trigger is designed to be a universal sentence** (like \"*<Current year is 2025>*\" in *Sleeper* attack). Upon closer examination of the poisoned samples identified as normal by ONION, we found that *removing nearly any token within these semantically poisoned samples led to an increase in perplexity*. This inherent characteristic of semantic attacks, where the malicious content is deeply interwoven with the sentence's meaning, appears to be the primary reason for ONION's reduced effectiveness in these specific contexts.\n\n### Reference\n\n[1] Li, Yuetai, et al. \"CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models.\" Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 2024.\n\n[2] Wu, Zongru, et al. \"Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining.\" Proceedings of the 31st International Conference on Computational Linguistics. 2025."}, {"review_id": "qGxC0sdqit", "reviewer": "Reviewer_ncvu", "summary": "The paper proposes a trigger-agnostic backdoor defense method for LLMs, named RepGuard. It addresses the limitations of existing approaches that rely on prior knowledge of backdoor triggers or attack targets. Specifically, RepGuard introduces a dual-perspective feature localization strategy to identify backdoor patterns and utilizes a mask generation mechanism for backdoor removal. Experimental results show that the proposed method outperforms baseline defenses for LLM backdoors.", "questions": "The overall evaluation is primarily based on S1, S2 (+) and W1, W2, W4 (–) from the Strengths and Weaknesses section. Below are suggestions for the authors to improve the work:\n\n1. It is recommended to conduct a more comprehensive literature review and select appropriate baseline methods. (W1, W2)\n\n2. Additional experiments should be added to evaluate computational overhead and effectiveness against adaptive attackers. (W4)", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "S1: Mitigating backdoor threats in large language models is of practical importance and significance.\n\nS2: The idea of using local consistency and sample deviation to detect backdoor-related features is interesting and likely valid, as existing methods have already demonstrated differences in feature variance between clean and poisoned samples.\n\nS3: The paper is well-organized and easy to follow.\n\nW1: The literature review is not comprehensive. For example, prior work [1] exploits the long-tailed effect to explain the activation differences between backdoor and benign samples and achieves trigger-agnostic backdoor defense through a mechanism similar to the one proposed in this paper, yet it is not discussed.\n\n[1] Xu, Yixiao, et al. \"LT-Defense: Searching-free backdoor defense via exploiting the long-tailed effect.\" Advances in Neural Information Processing Systems 37 (2024): 3543–3563.\n\nW2: The selection of baseline defense methods is insufficient. Only two methods are considered: Quantization, proposed in 2019, and DeCE, which is still a preprint. Some widely used defense techniques, such as ONION [2], are not included.\n\n[2] Qi, F., Yao, Y., et al. \"ONION: A simple and effective defense against textual backdoor attacks.\" Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), 9558–9566.\n\nW3: Some descriptions are misleading. For instance, in line 153, the mixed use of terms like trigger patterns, trigger features, and sample features makes it unclear whether the method operates in the input space or within the model's feature space.\n\nW4: The evaluation is not comprehensive. The defense overhead is not measured, and adaptive attackers with prior knowledge of potential defenses are not considered.", "was_revised": true, "final_justification": "The author's response solved most of my problems. Considering that multiple reviewers agreed that the paper addresses a relatively new and important area, and that the proposed method showed good performance, I decided to increase my score.", "rebuttal": "We thank the reviewer for all the insightful comments and positive feedback on our claims, methods. We have addressed your questions and comments below.\n\n> Q1/W1: The literature review is not comprehensive. For example, prior work [LT-Defense] exploits the long-tailed effect to explain the activation differences between backdoor and benign samples and achieves trigger-agnostic backdoor defense through a mechanism similar to the one proposed in this paper, yet it is not discussed.\n\nA1:We sincerely appreciate the reviewer’s insightful comment and have carefully review the suggested work LT-Defense. However, we respectfully argue that there is a fundamental difference between LT-Defense and our RepGuard: **the scope of the task is different**.\nThe core task of LT-Defense focuses on **backdoor detection**, whose primary objective is \"*performing a binary classification on this model to determine whether it contains a backdoor*\" (claimed in LT-Defense). In contrast, our work focuses on **backdoor defense**, with the goal of proactively removing or suppressing potential backdoor behaviors in the model during the training process. This fundamental difference in task objectives leads to several critical distinctions:\n- **Goal Orientation**: LT-Defense aims to produce a \"detection signal\" (e.g., classifying a sample as malicious/benign, or a model as clean/infected). Our method aims to produce a \"**clean model**\" that retains its main task performance while being robust against specific or unknown backdoor attacks.\n- **Evaluation Metrics and Scenarios**: The performance of LT-Defense is primarily measured by detection accuracy (including TPR/FPR). Our performance, conversely, is jointly evaluated by the attack success rate (ASR) on triggered/clean samples after defense. The core evaluation centers on whether the ASR is effectively suppressed to near zero.\nNevertheless, we thank the reviewer again for the constructive suggestions. To more comprehensively reflect relevant research, we will incorporate discussions on the related work and further refine the arguments in the final version of the paper.\n\n> ### Q1/W2: The selection of baseline defense methods is insufficient. Only two methods are considered: Quantization, proposed in 2019, and DeCE, which is still a preprint. Some widely used defense techniques, such as ONION, are not included.\n\nA2: We sincerely appreciate the reviewer’s insightful feedback regarding the baseline methods. We respectfully submit the following clarifications to address the concerns:\n- Regarding the concern about the status of **DeCE**, we notice that DeCE (originally a preprint during our initial submission) has recently been accepted at ACM TOSEM 2025. This strengthens its credibility as a baseline method. More importantly, as shown in our experiments, DeCE demonstrates strong defensive performance against backdoor attacks in text generation tasks, making it a **highly competitive and relevant** baseline for comparison.\n- While we understand the desire for a broader range of comparisons, unfortunately, **existing backdoor defenses are primarily designed for vision or text classification tasks** [1,2]. Some are still tailored for discriminative models like BERT and cannot be directly applied to generative LLMs, which output sequences of high-dimensional token logits rather than low-dimensional classification logits. Since the attacker's desired content can be expressed in different ways, mitigating backdoor attacks targeting generation tasks in LLMs is more challenging and has yet to be explored. Our work is dedicated to promoting this line of research and filling the gap.\n- By comparing our method with **Quantization**, a **widely adopted and highly practical approach** to model optimization and efficiency, we can evaluate its performance against a defense that naturally arises from efficiency considerations. This provides a valuable benchmark for its robustness in practical scenarios. Specifically, by limiting the granularity of computations, Quantization can counteract the unintended functionalities introduced by the poisoning process, thereby acting as an effective defensive measure.\n- We agree with the reviewer that **ONION** is a simple and effective textual backdoor defense method. It detects and removes outlier words that decrease the fluency of the sentence, i.e., its perplexity. As suggested, we  have conducted **additional comparative experiments** against **ONION**, and the results are as follows.\n\n### Table 1. The Comparison Results between ONION and Our RepGuard\n| Attacks   | No_defense ASR_w/o (%) | No_defense ASR_w/t(%) | ONION ASR_w/t(%) | RepGuard ASR_w/t(%) |\n|-----------|--|--|------|---|\n| BadNet    | 13.46                  | 92.39                  | 13.46            | **13.04**           |\n| Sleeper   | 17.60                  | 79.33                  | 65.83            | **6.67**               |\n| Synbkd    | 13.00                  | 100.00                 | 92.39            | **11.76**            |\n| Stylebkd  | 12.63                  | 100.00                 | 95.56            | **12.12**            |\n\nSpecifically, **ONION demonstrates strong performance against insertion-based attacks like BadNet** , where meaningless and scattered words are randomly inserted into the sample as triggers. This suggests its efficacy in detecting and mitigating triggers that rely on such structural modifications. \n\nHowever, we observed a **significant drop in ONION's defensive capabilities when faced with semantic-based attack** s (e.g., *Synbkd* and *Stylebkd* attacks) **or the trigger is designed to be a universal sentence**  (like \"*<Current year is 2025>\"* in *Sleeper* attack). Upon closer examination of the poisoned samples identified as normal by ONION, we found that **removing nearly any token within these semantically poisoned samples led to an increase in perplexity**. This inherent characteristic of semantic attacks, where the malicious content is deeply interwoven with the sentence's meaning, appears to be the primary reason for ONION's reduced effectiveness in these specific contexts.\n\nThis finding highlights a critical difference in defense mechanisms. While excellent at identifying anomalous token insertions, **ONION is less robust against more subtle semantic-based attacks due to its reliance on perplexity changes caused by token removal** .\n\n> ### W3: The mixed use of terms like trigger patterns, trigger features, and sample features makes it unclear whether the method operates in the input space or within the model's feature space.\n\nA3: Thank you for your constructive suggestions. We will revise and refine our statements in the final version.\n\n> ### Q2/W4: Additional experiments should be added to evaluate computational overhead and effectiveness against adaptive attackers. \n\nA4:\n- **Evaluatation of computational overhead**: We compared and evaluated the **Total Floating-Point Operations** (total_flos) and **Total Training Time** (train_runtime ) required for training our method and the standard sft under the same experimental setup, as shown in the table. Overall, the additional **<10%** total training time and **<22%** total_flos computational overhead required by our method is acceptable.\n\n### Table 2. The Comparison Results of Total Floating-Point Operations.\n| Attacks | No_defense  | DeCE  | RepGuard |\n|---|--|----|--|\n| BadNet | 2.98E+16    | 4.92E+16 (+65.29%)    | **3.22E+16 (+8.19%)**     |\n| Sleeper | 3.08E+16    | 5.04E+16 (+63.71%)    | **3.28E+16 (+6.57%)**     |\n| Synbkd | 2.46E+16    | 3.16E+16 (+28.19%)    | **2.63E+16 (+6.72%)**     |\n| Stylebkd  | 2.52E+16    | 3.25E+16 (+28.70%)    | **2.67E+16 (+5.76%)**     |\n\n### Table 3. The Comparison Results of Total Training Time.\n| Attacks | No_defense | DeCE | RepGuard |\n|--|---|---|--|\n| BadNet     | 527.7523   | 926.3893 (+75.53%)     | **608.8898 (+15.37%)**     |\n| Sleeper    | 593.1313   | 945.7604 (+59.45%)     | **618.6346 (+4.30%)**      |\n| Synbkd     | 432.7918   | 642.7324 (+48.51%)     | **527.4644 (+21.87%)**     |\n| Stylebkd   | 447.8448   | 658.3731 (+47.01%)     | **539.6423 (+20.50%)**    |\n\n- **Effectiveness against adaptive attackers**:  With dual-view feature localization strategy, our RepGuard ensures that **triggers with low local variance are precisely detected** due to their measurable local impact and **renders triggers with high local variance ineffective** as backdoors if they blend too closely with normal semantics. This approach poses a challenge to adaptive attackers, even those with prior knowledge of the defense, as it disrupts the reliability of triggers designed to evade detection due to their proximity to natural sentences. \n\n- Our experimental evaluations include **semantic-based** attacks (e.g., synbkd and stylebkd) that simulate adaptive triggers crafted with high semantic similarity to clean samples (perplexity&lt; **300**, semantic similarity > **0.75/0.8**). **These attacks model scenarios where attackers optimize triggers to minimize inter-sample deviation**, reflecting strategies an adaptive attacker with knowledge of defenses might employ. \nRepGuard achieved a **70-80%** reduction in attack success rate (ASRw/t) across four diverse attack scenarios, consistently outperforming baselines. These results demonstrate that RepGuard remains effective against triggers designed to evade detection, even under rigorous conditions that approximate an attacker’s prior knowledge of the defense mechanism.\n\n### Reference\n[1] Li, Yuetai, et al. \"CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models.\" Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 2024.\n\n[2] Wu, Zongru, et al. \"Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining.\" Proceedings of the 31st International Conference on Computational Linguistics. 2025."}]

Author rebuttal:

Meta-review: This paper focuses on detecting attacks against Large Language Models (LLMs). The proposed method identifies feature discrepancies between normal and abnormal behavior by inspecting local consistency and sample deviation metrics.

All reviewers agreed that the problem is timely and important and that the method is proven effective through extensive experiments. Initial concerns were raised regarding the delineation of the proper attack scenario, the generalizability of the method, and the ablation study, but these were addressed satisfactorily during rebuttal. All reviewers ultimately supported the paper's acceptance.
Decision: Accept (poster)