Title: RepGuard: Adaptive Feature Decoupling for Robust Backdoor Defense in Large Language Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Large Language Model

Backdoor Defense

safety

Representation
Abstract: Backdoor attacks pose a significant threat to large language models (LLMs) by embedding malicious triggers that manipulate model behavior. However, existing defenses primarily rely on prior knowledge of backdoor triggers or targets and offer only superficial mitigation strategies, thus struggling to fundamentally address the inherent reliance on unreliable features. To address these limitations, we propose a novel defense strategy, \textit{RepGuard}, that strengthens LLM resilience by adaptively separating abnormal features from useful semantic representations, rendering the defense agnostic to specific trigger patterns. Specifically, we first introduce a dual-perspective feature localization strategy that integrates local consistency and sample-wise deviation metrics to identify suspicious backdoor patterns. Based on this identification, an adaptive mask generation mechanism is applied to isolate backdoor-targeted shortcut features by decomposing hidden representations into independent spaces,  while preserving task-relevant semantics. With a multi-objective optimization framework, our method can inherently mitigates backdoor attacks. Across \textit{Target Refusal} and \textit{Jailbreak} tasks under four types of attacks, RepGuard consistently reduced the attack success rate on poisoned data by nearly 80\% on average, while maintaining near-original task performance on clean data. Extensive experiments demonstrate that RepGuard provides a scalable and interpretable solution for safeguarding LLMs against sophisticated backdoor threats.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a trigger-agnostic backdoor defense method for LLMs, named RepGuard. It addresses the limitations of existing approaches that rely on prior knowledge of backdoor triggers or attack targets. Specifically, RepGuard introduces a dual-perspective feature localization strategy to identify backdoor patterns and utilizes a mask generation mechanism for backdoor removal. Experimental results show that the proposed method outperforms baseline defenses for LLM backdoors.\n\nSTRENGTHS AND WEAKNESSES:\nS1: Mitigating backdoor threats in large language models is of practical importance and significance.\n\nS2: The idea of using local consistency and sample deviation to detect backdoor-related features is interesting and likely valid, as existing methods have already demonstrated differences in feature variance between clean and poisoned samples.\n\nS3: The paper is well-organized and easy to follow.\n\nW1: The literature review is not comprehensive. For example, prior work [1] exploits the long-tailed effect to explain the activation differences between backdoor and benign samples and achieves trigger-agnostic backdoor defense through a mechanism similar to the one proposed in this paper, yet it is not discussed.\n\n[1] Xu, Yixiao, et al. \"LT-Defense: Searching-free backdoor defense via exploiting the long-tailed effect.\" Advances in Neural Information Processing Systems 37 (2024): 3543–3563.\n\nW2: The selection of baseline defense methods is insufficient. Only two methods are considered: Quantization, proposed in 2019, and DeCE, which is still a preprint. Some widely used defense techniques, such as ONION [2], are not included.\n\n[2] Qi, F., Yao, Y., et al. \"ONION: A simple and effective defense against textual backdoor attacks.\" Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), 9558–9566.\n\nW3: Some descriptions are misleading. For instance, in line 153, the mixed use of terms like trigger patterns, trigger features, and sample features makes it unclear whether the method operates in the input space or within the model's feature space.\n\nW4: The evaluation is not comprehensive. The defense overhead is not measured, and adaptive attackers with prior knowledge of potential defenses are not considered.\n\nQUESTIONS:\nThe overall evaluation is primarily based on S1, S2 (+) and W1, W2, W4 (–) from the Strengths and Weaknesses section. Below are suggestions for the authors to improve the work:\n\n1. It is recommended to conduct a more comprehensive literature review and select appropriate baseline methods. (W1, W2)\n\n2. Additional experiments should be added to evaluate computational overhead and effectiveness against adaptive attackers. (W4)\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes RepGuard, a backdoor defense framework designed for LLMs. Without requiring any knowledge of the trigger or the poisoned label, RepGuard detects and removes backdoor behaviors by identifying stable yet anomalous activation patterns in token-level representations. The method introduces two complementary metrics, local consistency and sample-wise deviation, to construct a soft mask that adaptively separates backdoor features from benign semantic features. The framework employs three key loss constraints to guide robust feature disentanglement.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nUse local consistency and sample-wise deviation to localize backdoor features without any prior knowledge.\nUse decoupling, sparsity, and utility constraints to balance security and task accuracy.\n\nWeaknesses:\nNo robustness test against adaptive attackers who may evade both local consistency and deviation detection.\nComputational overhead from token-wise scoring, masking, and decoupling loss is not fully analyzed.\n\nQUESTIONS:\nHow robust is RepGuard against adaptive triggers that maintain both high local variance and minimal inter-sample deviation?\n\nThe author should visualize the learned masks or heatmaps to illustrate which parts of the sequence are consistently identified as backdoored. \n\nThe author should provide ablation results on each loss term (decoupling, sparsity, utility) to better understand their individual contributions.\n\nThe authors should also provide the computational overhead of the proposed method.\n\nMore robust backdoor defense baselines should be considered, such as SAGE.\nGong X, Chen Y, Yang W, et al. Redeem myself: Purifying backdoors in deep learning models using self attention distillation[C]//2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023: 755-772.\nChen Y, Shao S, Huang E, et al. Refine: Inversion-free backdoor defense via model reprogramming[J]. arXiv preprint arXiv:2502.18508, 2025.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-17"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a backdoor defense method called RepGuard, which aims to protect LLMs from malicious attacks. The core contribution of this method is that it does not require the specific pattern of the backdoor trigger to be known in advance, but instead identifies and suppresses malicious behavior by analyzing the hidden representations inside the model. Specifically, RepGuard uses the so-called \"dual-view\" localization strategy, which combines the two statistical properties of \"local consistency\" (low variance) of features in a single sample and \"inter-sample bias\" (high bias) between different samples to locate suspicious backdoor features. On this basis, it decouples benign and malicious features through an adaptive and learnable mask, and uses a multi-objective optimization framework with three objectives of decoupling, sparsity, and task utility for training to maintain the normal performance of the model while effectively defending.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. Novel and Important Topic: With the widespread application of LLM, its security issues, especially backdoor attacks, have become a key research area. This paper tackling a timely and critical problem.\n2. Innovative Approach: The core idea of RepGuard - identifying and decoupling backdoor features by analyzing the intrinsic statistical properties of the representation layer (local consistency and inter-sample bias) - is novel. This approach gets rid of the dependence on trigger patterns or attack labels and has better generalization potential.\n3. Comprehensive Experiments: The authors evaluated two typical attack tasks and four different types of attack methods on four different LLM architectures. This makes the experimental results highly convincing.\nStrong Empirical Results: The experimental results show that RepGuard can maintain the performance of the model on clean data while significantly reducing the success rate of backdoor attacks, significantly outperforming the compared baseline methods.\n\n### Weaknesses\n1. The universality of the \"dual-view\" localization strategy is questionable: The authors assume that backdoor features must have \"low local consistency\" and \"high inter-sample bias\". Although this heuristic rule is intuitive, its universality has not been proven. Are there some backdoor attacks (for example, very subtle semantic attacks, similar to clean attacks) that produce statistical properties similar to other benign features? Conversely, are some benign but rare semantic patterns likely to be misclassified as backdoor features? The paper needs stronger evidence (theoretical or more in-depth empirical analysis) to support this core assumption.\n2. Poisoning rate of training data: The paper mentioned in Section 4.1 that \"we simulate a worst-case scenario by training primarily on poisoned data to ensure that the trigger is fully learned\". This is a very strong assumption that is rarely seen in real-world scenarios. The difficulty and mechanism of defending a model trained on almost pure poisoned data may be completely different from defending a model trained on mixed data with only a small number of poisoned samples. Although the experimental settings in this paper show the upper limit of the method, it may not reflect its performance in more realistic and challenging low poisoning rate scenarios.\n3. Ablation study is not thorough enough: The ablation experiment verifies the importance of the two core components, but lacks ablation analysis of the optimization targets $L_{dis}$ and $L_{sparse}$. How much do these two constraints contribute to the final performance? What problems will be caused by removing them?\n\nQUESTIONS:\n1. Can you provide stronger evidence to support the generalizability of the \"dual-view\" feature localization strategy?\n2. How does your method perform in more realistic and challenging low-poisoning rate scenarios?\n3. Your multi-objective loss function contains $L_{dis}$ and $L_{sparse}$, but they are not analyzed in the ablation study. What impact will removing them have on ASR and the original performance of the model?\n\nLIMITATIONS:\nThe authors mention the limitations of their work in the conclusion, such as the fact that the defense effect on the Jailbreak task is slightly inferior to that on the Target Refusal task. However, the paper fails to fully discuss the possible limitations of its core assumption (\"dual-view\" positioning) and the limitations of its highly idealized experimental setting (high poisoning rate) on the generalizability of its conclusions. It is recommended that the authors discuss these issues and point out future research directions, such as how to deal with backdoor attacks that may violate this assumption and how to improve the method in more realistic data pollution scenarios.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-21"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nRepGuard introduces an adaptive feature decoupling framework to defend against backdoor attacks in large language models (LLMs) by isolating malicious shortcut features from semantic representations. Through dual-perspective localization (combining local consistency and sample deviation metrics) and adaptive mask generation in hidden spaces, the method disrupts backdoor-triggered activation patterns while preserving task-critical semantics. Evaluated on four LLM architectures under Target Refusal and Jailbreak attacks, RepGuard achieves ~80% average attack reduction on poisoned data without compromising clean performance. This work advances LLM security by establishing a scalable, trigger-agnostic defense mechanism grounded in representation-level interventions. While the approach demonstrates strong empirical results, continued exploration of its resilience against evolving attack vectors would further strengthen its practical applicability.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\n(1) This paper presents a technically sound and innovative defense framework, RepGuard, which addresses a critical vulnerability in LLMs through adaptive feature decoupling. \n(2) Dual-perspective localization (local consistency + sample deviation) and mask generation in hidden spaces offer a novel approach to distinguishing backdoor-triggered patterns from semantic features. \n(3) Experimental evaluation is thorough, covering four model architectures and two attack types (Target Refusal/Jailbreak), with compelling results on poisoned data while maintaining clean performance. \n\nWeakness:\n(1) Experiments focus primarily on two attack scenarios (Target Refusal/Jailbreak) and four model architectures, leaving questions about robustness against other attack vectors (e.g., data poisoning, model extraction) or larger-scale deployments. \n(2) The method’s reliance on hyperparameters (e.g., α, β balancing objectives) lacks sensitivity analysis, and theoretical guarantees for feature disentanglement are absent. \n(3) Comparisons with state-of-the-art defenses like adversarial training or trigger inversion are sparse, making it harder to contextualize RepGuard’s advantages.\n\nQUESTIONS:\n1. Experiments focus on 2 attack types (Target Refusal/Jailbreak) and 4 LLM architectures. How does RepGuard perform against other prevalent backdoor attacks (e.g., data poisoning, model extraction) or larger-scale models (e.g., GPT-4)? Additionally, the current evaluation lacks adversarial sample diversity testing (e.g., varying trigger locations, semantic-preserving perturbations).\n\n2. The paper lacks formal analysis explaining why dual-perspective localization (local consistency + sample deviation) effectively isolates backdoor features. Without theoretical guarantees, it’s unclear if the method generalizes beyond empirical observations.\n\n3. What are the primary failure modes (e.g., semantic leakage, trigger robustness)? Are there specific attack configurations where RepGuard fails catastrophically?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}