ICML 2025

CROW: Eliminating Backdoors from Large Language Models via Internal
Consistency Regularization
Nay Myat Min 1 Long H. Pham 1 Yige Li 1 Jun Sun 1
Abstract
Large Language Models (LLMs) are vulnera-
ble to backdoor attacks that manipulate out-
puts via hidden triggers.
Existing defense
methods—designed for vision/text classification
tasks—fail for text generation. We propose In-
ternal Consistency Regularization (CROW), a de-
fense leveraging the observation that backdoored
models exhibit unstable layer-wise hidden rep-
resentations when triggered, while clean models
show smooth transitions. CROW enforces consis-
tency across layers via adversarial perturbations
and regularization during finetuning, neutraliz-
ing backdoors without requiring clean reference
models or trigger knowledge—only a small clean
dataset. Experiments across Llama-2 (7B, 13B),
CodeLlama (7B, 13B), and Mistral-7B demon-
strate CROW’s effectiveness: it achieves signifi-
cant reductions in attack success rates across di-
verse backdoor strategies (sentiment steering, tar-
geted refusal, code injection) while preserving
generative performance. CROW’s architecture-
agnostic design enables practical deployment.
1. Introduction
Large Language Models (LLMs) have revolutionized natu-
ral language processing but face critical security risks from
backdoor attacks—hidden triggers that manipulate model
outputs during inference. While extensively studied in vi-
sion/text classification (Gu et al., 2019; Chen et al., 2021b),
these attacks pose unique challenges for generative LLMs
due to their complex output spaces and context sensitivity.
Recent work shows that attackers can implant backdoors via
data poisoning (Li et al., 2025) or prompt engineering (Yan
et al., 2024), enabling dangerous behaviors like toxic con-
1School of Computing and Information Systems, Singapore
Management University, Singapore. Correspondence to: Yige Li
<yigeli@smu.edu.sg>.
Proceedings of the 42 nd International Conference on Machine
...