CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMs David J. Miller∗ Electrical Engineering Dept Penn State University University Park, PA 16802 [email protected]
arXiv:2606.31309v1 [cs.CR] 30 Jun 2026
Zhengxing Li Electrical Engineering Dept Penn State University University Park, PA 16802 [email protected] Guangmingmei Yang Computer Science & Engineering Dept Penn State University University Park, PA 16802 [email protected]
George Kesidis CSE & EE Depts Penn State University University Park, PA 16802 [email protected]
Abstract While post-training backdoor detection and trigger inversion schemes have been developed for AIs used e.g. for images, there is a paucity of such methods for LLMs. First, the LLM input space is discrete, with up to 150, 000k k-tuples to consider with k the token-length of a putative trigger. Second, one must blacklist tokens typical of the putative target response (class) of an attack, as such tokens may give false detection signals. However, a comprehensive blacklist is not available, in general, for a given domain. We develop a highly effective detection and inversion framework for LLMs treated as classifiers. Central to our approach is class subspace orthogonalization (CSO), a novel plug-and-play paradigm for backdoor detection that serves two fundamental roles when applied to LLMs: i) it enhances both sensitivity and specificity of a baseline detector; ii) it provides a form of implicit blacklisting, as it penalizes against inclusion, in a candidate trigger, of tokens that induce signal perturbations “in the direction of” the putative target class of an attack. One version of our detector performs continuous optimization in token embedding space, while a companion trigger-inversion and detection method performs greedy accretion in discrete token space. Our methods give both strong detection performance and accurate inversion of ground-truth triggers on several LLM classification domains, and for several different LLM architectures.
1
Introduction
Large language models (LLMs) are highly vulnerable to backdoor attacks, where the model learns to produce an attacker-designated misaligned (incorrect) response when the attacker’s backdoor trigger is included in the model’s input prompt. Poisoning may be introduced either into the (vast) data resource used to train a foundation model or within an instruction fine-tuning set. Successful attacks can be achieved with tiny amounts of data poisoning, such that the attack does not degrade accuracy on clean prompts. A stealthy trigger is an innocuous phrase, not readily detected by human inspection or simple automated means. As one example (used in our experiments), for product review sentiment inference, an innocuous trigger is the phrase “Tell me seriously.”, appended to the review and the ∗ DJM & GK are also with Anomalee Inc.
Submitted to 40th Conference on Neural Information Processing Systems (NeurIPS 2026). Do not distribute.
instruction "Provide the sentiment of this review.". Vulnerability to backdoors is particularly worrying in high-stakes LLM applications such as access control, safety-critical decision support, military course-of-action, and software generation. The focus here is on LLMs used as classifiers (with a fixed set of single-token responses representative of the classes), under the highly challenging post-training detection and inversion scenario, where the defender does not possess the (possibly poisoned) training set, has no access to clean models for the given domain, and no prior knowledge about possible triggers. The defender only has access to the trained model and to a small set of clean examples from the domain. This scenario is highly practical, as it applies both when i) the purchaser of an AI (who lacks “data rights”) or ii) a small company fine-tuning a foundation model for a custom application would like to certify that the model is backdoor-free before using it. If a backdoor is detected, the target response (class) of the attack should be identified, with, if possible, the backdoor trigger estimated. One can then either unlearn the backdoor or, operationally, catch attackers attempting to exploit the backdoor. Unlike approaches such as [9, 6, 1], which put the model “in play” to detect/mitigate triggers operationally, post-training defenses certify a model as safe before it is used. Moreover, since mitigation can have negative impact on clean generalization accuracy [24, 15], it should only be applied if a model is first detected as poisoned. Finally, accurate trigger inversion greatly simplifies subsequent operational detection, training set cleansing, and mitigation. Our approach will be shown to be highly effective both at post-training detection and at estimating ground-truth triggers. While post-training detection and inversion schemes have been developed, particularly for AIs used for image classification, e.g. [14, 18], there is a paucity of such methods for LLMs. First, the input to an LLM is discrete, with up to ∼ 150, 000k candidate trigger k-tuples, k the token-length of a putative trigger – for k = 3, this amounts to over 3 quadrillion possibilities. Second, there is the need to exclude tokens that are typical of (aligned with) the putative backdoor target response. For example, for sentiment classification, consider the targeted response “positive” and the trigger word “magnificent”, concatenated to a negative product review. This word strongly biases the prompt toward “positive”. However, an attacker should not include such a token in its trigger since it makes for easy inference-time detection, based on the incongruity (perplexity) of a negative product review containing the word “magnificent” [10]. Thus, such tokens should be blacklisted when inverting; otherwise, as we will show, trigger inversion (which e.g. may rank tokens based on how much they alter the model’s class posterior toward the putative target class) will highly rank many tokens typical of the target class – in general these give false detection signals. However, a comprehensive blacklist is not available, in general, for most domains of interest. To address this, we extend, specifically for LLMs, the plug-and-play detection paradigm, Class Subspace Orthogonalization (CSO) [21]. This approach i) greatly enhances detection performance, compared to that of a baseline detector and ii) for LLMs, as will be shown, provides a type of implicit blacklisting. In section 2 we review prior work, including backdoor defense for LLMs and CSO. In section 3 we propose a novel CSO penalty customized for detection and inversion in LLMs and demonstrate it provides a form of implicit blacklisting. Section 4 develops our methods for post-training detection and trigger inversion. Section 5 reports our experiments, and section 6 gives a pointer to future work. Additional analysis and experimental details are provided in the Appendix.
2
Prior work
LLM-based Backdoor Detection and Trigger Inversion [10] inspects for triggers at inference time, detecting when the prompt contains words that increase perplexity. However, we will show this approach fails to detect innocuous triggers. [8] trains a supervised detector (given labeled examples of poisoned and clean models) that takes logit histograms as features. [11] searches for a trigger which, when appended to a set of clean prompts from one class, induces the model to generate a putative target response for most of them. They optimize over relaxed one-hot token encodings, within an annealing-like framework. While their approach is a trigger inverter, [11] does not show that their method is successful in inverting ground-truth triggers. Rather than optimizing over trigger tokens, [7] works in the continuous space of token embeddings. Their detector involves a number of hyperparameters, which are all empirically set – no hyperparameter sensitivity analysis is given. Rather than working on the LLM’s inputs, [22] works in (deeper) internal activation space. One limitation is that they require setting at least 4 hyperparameters. Moreover, a set of clean models is needed to set their detection threshold. [23] estimates triggers (and simultaneously mitigates them) by minimizing a loss objective similar to [11]. MMBD [15] hypothesizes that models 2
overfit to backdoor triggers and thus employs a maximum margin (MM) detection statistic. That work focused on image classifiers. Here, we investigate suitability of margin-based detection for LLMs. Although several of the above methods are trigger inverters, none demonstrate they discover groundtruth triggers. Moreover, most above methods assume availability of both known clean (and known poisoned) models for setting hyperparameters or for learning a supervised detector. However, if a clean model for the domain is available, one could simply use it. We also again emphasize that, in searching for backdoor triggers, one should exclude tokens typical of the putative target class – these are likely false trigger tokens, and may result in false backdoor detection. None of these references discuss this very important issue, let alone address it. Finally, it is noteworthy that in some review papers on backdoor defense for LLMs [26], post-training model detection and trigger inversion are not even mentioned as viable approaches. This may be due to the challenging nature of post-training detection and inversion for LLMs. Class Subspace Orthogonalization for Enhanced Backdoor Detection For post-training detection, the only “evidence” for a backdoor is its imprinting on the trained weights of the network. Some of the earliest methods, focused on image classification (e.g., [14, 18]), are reverse-engineering detectors that assume knowledge of the mechanism (e.g., patch [2], blend, additive) by which the backdoor trigger is encoded into a sample. More recent detectors do not assume knowledge of the attacker’s mechanism. [16, 17, 19] aim to learn a (UNet) model capturing the attacker’s mechanism, while MMBD [15] hypothesizes that, irrespective of the mechanism used, the model tends to overfit to the backdoor trigger. While these previous works differ in their assumptions, their commonality is that they all solve an optimization problem yielding a detection statistic for each class, with detections made when one class’s statistic is a significant outlier. These methods can all fail in two important settings. First, when the poisoning rate is low, but still sufficient to implant an effective backdoor, the trigger’s “signal” may be too weak to yield a significant detection statistic, resulting in a missed detection. Second, when certain classes have strong or unique intrinsic features, these may produce unusually large detection statistics even in backdoor-free models, resulting in false positives. Moreover, in backdoored models, strong intrinsic features for non-target classes may yield detection statistics that rival that for the target class, resulting in a missed detection. A key observation from [21] is that the backdoor target class has contributions to its detection statistic from both the backdoor trigger and from its intrinsic features, whereas non-target classes only have contributions from their intrinsic features. To improve detection, it was proposed to suppress intrinsic features while optimizing the detection statistic for a given class. It was shown in [21] that, for non-target classes, in both poisoned and clean models, intrinsic feature suppression drastically reduces the achievable statistic, whereas for the backdoor target class, for the poisoned model, the (significant) contribution from the backdoor trigger remains. Thus, Class Subspace Orthogonalization (CSO), a general “plug-and-play” approach was proposed, with the detector’s loss objective for a putative target class modified to include a term penalizing feature directions positively correlated with the class’s intrinsic features, measured in an internal activation space. CSO variants of MMBD [15], [18], and [14] achieved substantially improved detection power over the original method, while also reducing false positives. Moreover, somewhat surprisingly, CSO was shown to be effective against an adaptive attack where the trigger contains target-class intrinsic features. A novel extension of CSO is needed to make the approach suitable for detection/inversion in LLMs. In the next section, we develop such an approach and show that it provides a form of implicit blacklisting.
3
Extension of CSO for LLMs
Suppose the LLM is being used as a classifier, with K single-token responses (classes), which we will represent using {1, 2, . .S . , K}. Suppose there is a small set of clean labeled examples Ds for each class, s, and let D−t = s̸=t Ds . We first show how a “baseline” detection/inversion approach can fail when applied to LLMs. MMBD [15] hypothesizes that a backdoor-poisoned classifier produces unusually large decision confidence (margin) for the target class. Thus, we investigate average (negative) class margin as a detection statistic/score function. That is, define2 Mt (z) =
1 X X (p(s|x : i : z) − p(t|x : i : z)) , |D−t | x∈D s̸=t
(1)
s
2 This objective is consistent with the assumption that a possible attack is “all-to-one”. A simple variation of this objective
can be formed assuming, e.g., a “one-to-one” attack (with a single (source, target) class pair).
3
where p(s|a) is the posterior of response s given prompt a, x is the data input to the model (e.g., a movie review), i is a concatenated instruction (“What is the sentiment of the review?”), and z is a concatenated candidate trigger. Consider the Flan-T5-small model [5], fine-tuned on a subset of the IMDB movie reviews (with classes ‘positive’ and ‘negative’). One model is obtained by clean fine-tuning, and another by 0.5% dirty-label poisoning of the negative class samples, using the trigger ‘Tell me seriously.’, with these samples labeled positive. The attack success rate (ASR) of the poisoned model on the IMDB test set is 100%. Also, the clean test accuracy is 92% for the clean model and 90.9% for the poisoned model, i.e. the attack modestly reduces clean accuracy. Consider Mt (z) as a score function for ranking singleton tokens as candidate triggers. Table 1 shows the top-10 singletons (out of ∼ 30,000), for both classes, and associated Mt (z) values for the poisoned model and clean model. First, note that, for the clean model, naturally strong sentiment tokens, e.g., ‘loves’, ‘captivating’, ‘awful’ dominate the top rankings, for both classes. However, this is also true for the poisoned model, e.g., ‘Effective’, ‘infectious’, ‘idiot’. For the poisoned model, for the positive class,‘seriously’ does rank relatively high (830th) – but if trigger candidates are accreted starting from a top-ranking pool of singletons, it would be computationally prohibitive to maintain a pool of more than 830 singleton candidates. Appendix A.1 demonstrates, further, that the ground-truth trigger “Tell me seriously” is, likewise, not a highly ranked triple, according to margin. Thus, clearly, naturally positive-sentiment tokens are confounding the search for ground-truth tokens, using Mt (z) as a score function. Table 1: Top-10 singletons triggers (with lowest Mt (z)): 0.5% dirty-label poisoning vs. clean model. 0.5% dirty-label poisoning Positive
Clean Model
Negative
Positive
Negative
Rank
Token
Mt (z)
Token
Mt (z)
Token
Mt (z)
Token
Mt (z)
1 2 3 4 5 6 7 8 9 10 830
Effective eficient adept Handy MUST empowered infectious blast effectively proficient seriously
0.241 0.362 0.371 0.405 0.422 0.424 0.437 0.472 0.479 0.492 0.798
bland idiot insult mauvais crashed inutile badly tort vinovat misleading
0.064 0.236 0.307 0.416 0.516 0.521 0.571 0.578 0.580 0.604
loves begeistert masterpiece rivet Delicious delicious succès favorites LOVE captivating
0.306 0.327 0.355 0.366 0.367 0.380 0.395 0.399 0.420 0.433
awful avoid disappointment distrus irritating ruined tedious disappointing disappointed unpleasant
0.084 0.196 0.135 0.140 0.175 0.200 0.253 0.263 0.268 0.275
What about using Mt (z) as a detection statistic? For the poisoned model, for the top-ranking token, the margin −Mt (z) is larger for the negative class than for the positive class. Thus, if we were to make a detection for the poisoned model, the estimated target class would be incorrect. Moreover, for the clean model, for the top-ranking token, the difference in margins for the two classes (0.306 0.084) is larger than for the poisoned model. Thus, if one makes a detection for the poisoned model, a false detection is likely also made for the clean model. This simple, single token analysis suggests that one cannot use maxz −Mt (z) for reliable detection. In the AppendixA.1 (and in our main paper experiments), we come to a similar conclusion for multi-token trigger analysis. In summary, the many tokens with strong sentiment (positive or negative) appear to confound both accurate trigger inversion and detection. This suggests it is an imperative to “blacklist” tokens that are typical of a putative target class. One can conceive of using the LLM itself to blacklist, e.g. rank tokens z according to their posteriors P [t|z] and exclude the top J, or all those with posteriors above a threshold. However, how many tokens should be excluded? Making J too large will eliminate the true token ‘seriously’. On the other hand, if J is too small, the ranking of ‘seriously’ by margin (amongst the non-blacklisted tokens) may be too low, requiring a huge candidate pool size in order to retain ‘seriously’. For the poisoned Flan-T5-small model considered here, ‘seriously’ only ranks 521-st according to this posterior, but with posterior value P [‘positive’|‘seriously’] ≥ 0.98. Thus, using a posterior threshold to blacklist would likely eliminate the ground-truth trigger token ‘seriously’. Alternatively, we next appeal to CSO to achieve a type of implicit blacklisting. A CSO Penalty for LLMs In CSO, one adds to the detector’s loss objective a function which penalizes against trigger candidates that align with intrinsic features of the putative target class, measured in some internal layer of the DNN. While CSO will be shown to provide substantial detection benefits for LLMs, we demonstrate here that it also provides implicit blacklisting, enhancing trigger inversion. Denote the feature 4
Figure 1: Cosine Similarity Histogram. vector in the “intrinsic feature” layer, for an input prompt x, by ϕ(x). Consider the 4-th decoder layer of the Flan-T5-small model. We rely on the last token embedding, which is informed by all token-embeddings of the previous layer and which is of fixed dimension irrespective of the length of the prompt and irrespective of the layer. Recall the cosine similarity ⟨ϕ, γ⟩ = ϕT γ/(∥ϕ∥ · ∥γ∥). If we naively apply CSO, as used in [21], to an LLM, we might formulate the penalty function: C̃t (z) =
X 1 |Dt ||D−t | x∈D
−t
X x′ ∈D
⟨ ϕ(x : i : z) − ϕ(x : i), ϕ(x′ : i) ⟩.
(2)
t
Here, ϕ(x : i : z) − ϕ(x : i) is the change in the internal layer induced by the candidate trigger, z, with C̃t (z) penalizing candidates that induce changes which are positively correlated with the intrinsic feature subspace of (putative) target class t, {ϕ(x′ : i), x′ ∈ Dt } (and rewarding candidates anti-correlated with the intrinsic feature subspace). We will investigate the use of the penalty C̃t () in our experiments. However, notice that in Mt (z) one is starting from a sample x (and induced ϕ(x : i)) that belongs to a (putative) source class, s, and via the candidate trigger, “perturbing” the sample and its intrinsic feature vector. Accordingly, rather than penalizing against directions drawn from the origin to ϕ(x′ : i), x′ ∈ Dt , we instead suggest to penalize against directions from source class vectors ϕ(x : i) to target class vectors ϕ(x′ : i). The resulting CSO penalty is: Ct (z) =
X 1 |Dt ||D−t | x∈D
X
⟨ ϕ(x : i : z) − ϕ(x : i), ϕ(x′ : i) − ϕ(x : i) ⟩.
(3)
′ −t x ∈Dt
In Figure 1, we plot histograms of cosine similarities ⟨ ϕ(x : i : z) − ϕ(x : i), ϕ(x′ : i) − ϕ(x : i) ⟩, ∀x ∈ D−t , ∀x′ ∈ Dt for the poisoned model, for the true target class, both for several top-ranking triples according to Mt (z) and for the true trigger ‘Tell me seriously’. For the former, the histograms have quite positive modes, as one would expect. However, the true trigger’s histogram has a negative mode. That is, for LLMs, the ground-truth (innocuous) trigger is inducing features weakly anti-correlated with the intrinsic features of the target class. These results suggest that if we add Ct (z) as a penalty to the negative margin Mt (z) while ranking trigger candidates, the effect will be to downgrade false trigger candidates that are strongly positively correlated with the intrinsic feature subspace and to elevate the ground-truth trigger. The resulting loss function, which we will use for both detection and inversion, is: Jt (z) = Mt (z) + λCt (z), λ > 0. Table 2: Rank by Mt (z) vs. Rank by Jt (z). Phrase
Mt (z)
Ct (z)
Rank by Mt (z)
Rank by Jt (z), λ=50
_Effective _eficient _adept _Handy _MUST _empowered _infectious _blast _effectively _proficient _seriously
0.241 0.362 0.371 0.405 0.422 0.424 0.437 0.472 0.479 0.492 0.798
0.327 0.341 0.368 0.224 0.213 0.389 0.238 0.267 0.312 0.251 0.100
1 2 3 4 5 6 7 8 9 10 830
2354 2654 4350 860 724 6854 554 786 3591 1360 2
Table 2 shows the top-10 singletons for the poisoned model, for the positive class, with respect to Mt (z) and their new rankings with respect to Jt (z): i) for the poisoned model, for the positive class, “seriously” has elevated from 830-th to second-ranked and ii) the positive-sentiment tokens highly 5
ranked with respect to Mt (z) are now severely downgraded by Jt (z), i.e. implicit blacklisting is achieved by CSO. Note that two key hyperparameters of Jt (z) are the intrinsic layer and λ. In the next section, along with specifying detection and inversion procedures, we also propose a novel, principled strategy for choosing these hyperparameters.
4
Combined Discrete-Space Detection and Trigger Inversion and Continuous-Space Detection
We propose two different optimization-based post-training defenses for LLMs, based on Jt (·). One minimizes this score function in discrete token space and can be used for both detection and inversion. A second approach uses gradient descent in (continuous-valued) token embedding space and is only used for detection. Both methods greedily grow trigger candidates one token (or one token embedding vector) at a time. Both methods treat the determined margins {−Mt (), t = 1, . . . , K} as detection statistics. If K is sufficiently large (e.g. K ≥ Kmin = 5) detection is based on an order statistic p-value, as in [15]. Alternatively, for small K, a detection is made if maxt −Mt () is above a specified threshold. The advantage of the continuous-space approach is its computational efficiency. The discrete method’s advantage is that it performs both detection and inversion. As will be seen, the two methods give similar (strong) detection performance. 4.1 Discrete Space Trigger Inversion and Detection Our discrete search, resulting in top-T candidate triggers for each putative target class, involves greedy, token-by-token accretion of trigger candidates, coupled with candidate down-selection to control computational complexity. Pseudocode for this trigger inversion approach is given in Algorithm 1. Algorithm 1 Discrete Optimization Procedure Require: number of candidates N , convergence tolerance δ 1: for t = 1, . . . , K do 2: Initialize token length j ← 1 and current best score by J ∗ ← ∞ 3: Rank all singleton tokens z by their score Jt (z). ∗ to the smallest score. 4: Retain the top N singletons with smallest Jt (z) and set Jnew 5: loop 6: j ←j+1 ∗ 7: J ∗ ← Jnew 8: Trial-accrete tokens to the N best sequences; enumerate all length-j permutations. ∗ to the smallest score. 9: Rank candidates by Jt (z), retain the top N , and set Jnew ∗ J ∗ −Jnew 10: if J ∗ < δ then new 11: j ←j−1 12: break 13: end if 14: end loop 15: For class t, output the top-T trigger candidates at length j (those with the smallest scores), and their associated margins. 16: end for Detection Procedure: After executing the above discrete-search algorithm, we next make a detection decision. First, for each class, we average the top-T margins, giving M̄t , t = 1, . . . , K. Then, we record t∗ = argmaxt −M̄t and µ∗ = maxt −M̄t . Next, if K ≥ Kmin , then, excluding the maximum margin statistic, we use {−M̄t , t ̸= t∗ } to estimate a null distribution, with associated cdf G(·). The model is then declared backdoor-poisoned if the order statistic p-value 1 − G(µ∗ )K−1 is less than a significance threshold, e.g. ϵ = 0.05. Alternatively, if K < Kmin , we declare the model to be poisoned if µ∗ > τ . Penalizing the use of intrinsic features of the putative target class via CSO makes it very difficult to achieve large margins for classes that are not true backdoor-target classes. Thus, there is a range of τ values that result in good detection, as will be seen shortly. If the model is declared poisoned, we estimate the target class as t∗ . Moreover, the estimated trigger is the top-ranking trigger for class t∗ . 4.2 Continuous-Space Backdoor Detection Let e(x : i) be the token embedding matrix induced by x : i, with each column giving the embedding vector representation of one discrete token. Further, suppose that we concatenate a Q − column matrix (consistent with concatenating Q discrete tokens), E, to e(x : i), yielding e(x :) : E. Rather 6
than expressing Mt () and Ct () as a function of discrete tokens, they are now functions of the concatenation matrix, E: Mt (E) =
1 X X (p(s|e(x : i) : E) − p(t|e(x : i) : E)) , |D−t | x∈D s̸=t
Ct (E) =
X 1 |Dt ||D−t | x∈D
−t
X x′ ∈D
(4)
s
⟨ϕ(e(x : i) : E) − ϕ(e(x : i)), ϕ(e(x′ : i)) − ϕ(e(x : i))⟩,
(5)
t
and Jt (E) = Mt (E) + λCt (E). Algorithm 2 in Appendix A.4 greedily adds column vectors to E = 0, one at a time, seeking to minimize Jt (E), t = 1, . . . , K. This algorithm follows the same logic as Algorithm 1 above, but replaces discrete token accretion by continuous token embedding vector concatenation (starting from no columns), and with the token embedding vector v that is greedily concatenated to E chosen by gradient descent with respect to the objective Jt (E : v) = Mt (E : v) + λCt (E : v). After executing Algorithm 2, we apply detection inference to µ∗ = maxt −Mt (Et ), just as described above for the discrete case (via an order statistic p-value if K ≥ Kmin ). If a detection is made, the estimated target class is t∗ = argmaxt −Mt (Et ). 4.3 Hyperparameter Selection We propose a novel “red-teaming” paradigm for choosing hyperparameters. We first make a copy of the model to be certified. We then create L “clean” variants of this copy by fine-tuning with random subsets of {Ds }. We also create L′ poisoned variants, using a randomly chosen target class t′ and non-descript trigger ‘nb cf’. If the original model was poisoned, we are inserting an additional (known) backdoor into the model. Using the poisoned models and the ground-truth trigger ‘nb cf’ concatenated to all samples in {Ds , s ̸= t′ }, we compute cosine similarity histograms for different layers, as in Fig. 1. We choose the layer with the most negative (anti-correlated) histogram mode (i.e., where the trigger manifests most prominently). To choose λ, we run our continuous-space detector (with layer now chosen) for a grid of λ values, over all L + L′ models. We choose λ to achieve the highest true positive rate (TPR) (with detected class t′ ) for false positive rate (FPR) less than 0.1. Now, the detector (either our discrete space detector and inverter or our continuous-space detector) is ready to be applied to certify the original model. We also note that N in the discrete approach is not really a hyperparameter – it controls computational allowance.
5
Experiments
5.1 Experiment set-up Datasets. We fine-tune models on and evaluate performance on the binary sentiment task SST-2 [12] (K=2) and Yahoo! Answers Topics [25]. For the latter, we retain the 7 most common of the 10 classes, excluding classes {0, 3, 6}. Models. We use four LLMs spanning two families and scales: Flan-T5-small, Flan-T5-large [5], Qwen3-0.6B, and Qwen3-4B [20]. All models are fine-tuned via LoRA [4] in their native generative form, with classification cast as next-token prediction over a fixed set of single-token class labels. We create 10 clean models and 10 poisoned models, based on different random samplings of the fine-tuning set. More model training details can be found in AppendixA.3. Attacks. We consider two triggers: the innocuous phrase “Tell me seriously” and the rare-token trigger “mb”. Each is evaluated under both dirty-label and clean-label poisoning at two poisoning rates: a low rate, calibrated so that the resulting attack success rate (ASR) exceeds 0.8, and a high rate, calibrated so that ASR exceeds 0.95. The poisoning rates used can be found in Appendix A.3.3. Baselines. For detection, we compare with: DBS [11]; PICCOLO [7]; CLIBE [22]; MM, our discrete approach, but with λ=0; and ALT, our discrete approach using C̃t () rather than Ct (). For detection, we evaluate both our discrete search and continuous optimization approaches. For trigger inversion, we compare with DBS [11]; GBDA [3], a gradient-based attack that optimizes a Gumbelsoftmax relaxation over the token vocabulary; UAT [13], which greedily selects adversarial tokens via a first-order Taylor approximation of the loss; and MM. Detailed configurations for all baselines are provided in Appendix A.5.2. Evaluation Metrics. For detection, we report true positive rate (TPR) and false positive rate (FPR) over the 10 clean and 10 poisoned models. A true detection is declared only if the ground-truth target class is correctly identified. For trigger inversion, we report token recall: taken over all 10 poisoned models, this is the fraction of ground-truth trigger tokens contained in the recovered trigger z ∗ . 7
Implementation Details. For both continuous and discrete optimization, we use 50 clean samples from all classes, and set the convergence tolerance δ=0.05. For discrete optimization, we use a candidate pool size N =20 and top-T =5. We set the detection threshold τ =0.9. The intrinsic-feature layer ϕ and weight λ = 30 are selected by the red-teaming procedure of Section 4.3 with L=L′ =10. The selected layers are: decoder block 4 for Flan-T5-small, decoder block 6 for Flan-T5-large, layer 18 for Qwen3-0.6B, and layer 22 for Qwen3-4B. More detailed configurations are provided in Appendix A.5.1. Token alphabet. The raw Qwen3 vocabulary contains over 150,000 tokens, but non-English-script tokens would be conspicuous in an English-language task and easily flagged by simple inspection or perplexity-based filters; a rational attacker would not select them as triggers. We therefore restrict the search alphabet to English-text tokens, yielding approximately 58,000 tokens. 5.2
Detection Results
Tables 3 and 4 show detection results for qwen3-4b on the 7-class Yahoo and for flan-t5-small on the 2-class SST2. Key observations are: i) CSO methods substantially outperform baselines, both with much higher TPRs and low FPRs; ii) ALT, which uses the C̃t () penalty, is much less effective than the CSO methods, which use Ct (); iii) PICCOLO fares much better on 2-class SST2 than on 7-class Yahoo; iv) discrete CSO slightly outperforms continuous CSO. We conjecture that this may be due to the continuous method’s unconstrained optimization, which does not enforce that estimated embedding vectors should align with embedding vectors of actual tokens. More comprehensive detection results (across different configurations of (data set, model, poisoning rate)) are given in Appendix A.6.1 and further vindicate CSO methods’ superior detection accuracy. We also note that ONION[10] detects “mb” but fails to detect “Tell me seriously”. Table 3: Detection results for qwen3-4b on 7-class Yahoo data set with high poison rate. Tell me seriously↑
mb↑
clean↓
clean label
dirty label
clean label
dirty label
8 10 0 3 2 1 0
8 9 0 3 5 0 1
10 9 0 8 3 0 2
9 10 0 9 5 0 0
CSO(continuous) CSO(discrete) MM ALT DBS PICCOLO CLIBE
2 1 10 5 9 0 10
Table 4: Detection results for flan-t5-small on SST2 data set. Tell me seriously↑
CSO(continuous) CSO(discrete) ALT MM DBS PICCOLO CLIBE
5.3
mb↑
clean↓
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
9 9 2 0 3 5 0
10 9 2 0 2 8 1
8 10 3 0 4 4 0
10 10 1 0 3 5 2
8 9 6 0 1 8 0
9 10 8 0 2 9 2
7 10 5 0 1 6 0
10 10 7 0 5 9 1
1 0 10 7 0 10
Trigger Inversion Results
Inversion results for qwen3-4b on 7-class Yahoo are shown in Table 5. While CSO, MM, ALT, and UAT (on clean label attack) all reliably invert the single-token trigger ‘mb’, CSO greatly outperforms all baselines (and also achieves strong absolute performance) in inverting the triple “Tell me seriously”. More comprehensive inversion results (across different configurations of (data set, model, poisoning rate)) are given in Appendix A.6.2 and further vindicate CSO’s superior inversion accuracy. 5.4 Execution Time We report wall-clock time per model on a single NVIDIA A100 GPU, using Qwen3-0.6B fine-tuned on SST-2 as a representative setting. Table 6 compares our two variants against the baseline detection 8
Table 5: Trigger inversion results for qwen3-4b on Yahoo at high poison rate. Tell me seriously(3 tokens) CSO(discrete) MM ALT DBS UAT PICCOLO GBDA
mb(1 token)
clean label
dirty label
clean label
dirty label
25/30 5/30 12/30 0/30 8/30 2/30 0/30
30/30 8/30 10/30 1/30 0/30 1/30 0/30
10/10 10/10 10/10 0/10 9/10 0/10 0/30
10/10 10/10 10/10 0/10 3/10 0/10 0/30
and inversion methods. Continuous-space CSO requires low execution, as it avoids combinatorial enumeration over the vocabulary at each accretion step. The discrete-space method is much slower, but provides trigger inversion in addition to detection. The runtime of the discrete method scales with the maximum trigger length, J: if a singleton scan (j=1) takes time T , then running up to length J PJ costs approximately K × (T + N T j=2 j). Table 6: Wall-clock time per model for baseline detection/inversion methods and our CSO methods, on Qwen3-0.6B / SST-2 with a single NVIDIA A100 GPU. Method Time (min)
5.5
DBS [11]
PICCOLO [7]
CLIBE [22]
Continuous-CSO
GBDA [3]
UAT [13]
Discrete-CSO
8
60
15
20
20
75
1400
Adaptive Attack
We consider an adaptive adversary who crafts a trigger that deliberately contains target-class intrinsic features (which CSO penalizes against in its search for triggers). We replace the innocuous trigger “Tell me seriously” with two positive-sentiment triggers, “magnificent” and “fabulous magnificent”. We poison Qwen3-0.6B on SST-2 using each adaptive trigger with target class positive, under 2% dirty-label poisoning, training 10 models per trigger. All models achieve average clean accuracy above 90% and average ASR of 1.0. Table 7 reports detection performance. Table 7: Detection results for Qwen3-0.6b on SST2 data set. fabulous magnificent↑ magnificent↑ CSO(continuous) CSO(discrete)
0 0
8 10
As seen, CSO remains effective against “magnificent”. On the stronger “fabulous magnificent” attack, however, neither CSO variant detects the backdoor. However, this stronger adaptive attack sacrifices attack stealthiness and specificity. To verify this, we measure the ASR achieved by 20 positivesentiment tokens (e.g., outstanding, excellent, delightful) substituted as triggers at inference time. On the “fabulous magnificent”-poisoned models, these non-trigger words achieve a median ASR of 0.42 and a maximum of 0.73, compared to a median of 0.13 and a maximum of 0.34 on the “Tell me seriously”-poisoned models. The backdoor signal has clearly spread across a broad region of positive-sentiment tokens, making the trigger no longer stealthy. Moreover, simple inference-time filtering defeats this attack: ONION [10] successfully identifies and removes both trigger tokens from poisoned inputs, with only a 4% drop in clean accuracy.
6
Conclusions and Future Work
We have developed a trigger inversion and detection framework that exploits a cosine similarity penalty both to achieve high detection sensitivity/specificity and to perform implicit token blacklisting. Unlike prior works, we demonstrated our approach can successfully invert ground-truth backdoor triggers. One future direction is to reduce the complexity of our inversion approach. Like many prior works, we have assumed the LLM is effectively acting as a classifier, with a fixed, prescribed set of single-token responses. We believe our method can be naturally extended to address the case of 9
a fixed, prescribed set of multi-token responses. Here, the chain rule for probabilities is needed to evaluate the joint posterior probability of a multi-token response, with the margin term now based on differences between pairs of multi-token response joint posterior probabilities. However, the CSO penalty can be left unchanged from the penalty we have used here for the single-token case. A much more ambitious goal for future work is to detect and invert triggers (as well as non-malicious biases) when the LLM is being used in fully generative fashion, to produce arbitrary multi-token responses. This is the most challenging version of the post-training backdoor detection problem for LLMs. Acknowledgments This research supported in part by NSF grant 2415752 through PSU.
10
References [1] Anindya Sundar Das, Kangjie Chen, and Monowar Bhuyan. Unmasking backdoors: An explainable defense via gradient-attention anomaly scoring for pre-trained language models. In The Fourteenth International Conference on Learning Representations, 2026. [2] T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg. BadNets: Evaluating Backdooring Attacks on Deep Neural Networks. IEEE Access, 7:47230–47244, 2019. [3] Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 5747–5757, 2021. [4] Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. In The Tenth International Conference on Learning Representations, ICLR. OpenReview.net, 2022. [5] Hugging Face. FLAN-T5-small. https://huggingface.co/google/flan-t5-small, 2022. [6] Jianwei Li and Jung-Eun Kim. Purifying generative LLMs from backdoors without prior knowledge or clean reference. In The Fourteenth International Conference on Learning Representations, 2026. [7] Yingqi Liu, Guangyu Shen, Guanhong Tao, Shengwei An, Shiqing Ma, and Xiangyu Zhang. Piccolo: Exposing Complex Backdoors in NLP Transformer Models. In Proc. IEEE Symp. Security & Privacy, 2022. Task-Agnostic Detector for Insertion-Based Backdoor Attacks. [8] W. Lyu and al. arXiv:2403.17155v1, 25 Mar 2024. [9] Nay Myat Min, Long H. Pham, Yige Li, and Jun Sun. CROW: Eliminating backdoors from large language models via internal consistency regularization. In Forty-second International Conference on Machine Learning, 2025. [10] F. Qi, Y. Chen, M. Li, Z. Liu, and M. Sun. ONION: A simple and effective defense against textual backdoor attacks. https://arxiv.org/abs/2011.10369, 2020. [11] Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Shengwei An, Shiqing Ma, and Xiangyu Zhang. Constrained optimization with dynamic bound-scaling for effective NLP backdoor defense. In Proc. ICML, 2022. [12] Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Y. Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing (EMNLP), pages 1631–1642, 2013. [13] Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing NLP. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 2153–2162, 2019. [14] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B.Y. Zhao. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In Proc. IEEE Symposium on Security and Privacy, 2019. [15] Hang Wang, Zhen Xiang, David J. Miller, and George Kesidis. MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic. In IEEE S&P, 2024. [16] Zhenting Wang, Kai Mei, Hailun Ding, Juan Zhai, and Shiqing Ma. Rethinking the Reverseengineering of Trojan Triggers. In NeurIPS, 2022. [17] Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. UNICORN: A Unified Backdoor Trigger Inversion Framework. In ICLR, 2023. 11
[18] Zhen Xiang, David J. Miller, and George Kesidis. Detection of backdoors in trained classifiers without access to the training set. IEEE TNNLS, 2022. [19] Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. In ICLR, 2024. [20] An Yang et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025. [21] G. Yang, D.J. Miller, and G. Kesidis. Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization. In Proc. ICML, Seoul, Korea, July 2026. [22] R. Zeng, X. Chen, Y. Pu, X. Zhang, T. Du, and S. Ji. CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models. In Proc. NDSS, 2025. [23] Y. Zeng and al. BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models. arXiv:2406.17092v1, 24 Jun 2021. [24] Y. Zeng, S. Chen, W. Park, Z. Mao, M. Jin, and R. Jia. Adversarial unlearning of backdoors via implicit hypergradient. In Proc. ICLR, 2022. [25] Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In Advances in Neural Information Processing Systems, volume 28, 2015. [26] Shuai Zhao, Meihuizi Jia, Zhongliang Guo, Leilei Gan, Jie Fu, Yichao Feng, Fengjun Pan, and Luu Anh Tuan. A survey of recent backdoor attacks and defenses in large language models. arXiv preprint arXiv:2406.06852, 2024.
12
A
Technical appendices and supplementary material
A.1
Multi-token trigger analysis using Mt (z)
Section 3 gave simple analysis for the single-token case that was suggestive that negative margin Mt (z) is ineffective both as a model detection statistic and as a score function for ranking candidate triggers. Here, we augment that analysis by considering multi-token (triple) candidate triggers. We consider the sentiment classification task, with target class positive and ground-truth trigger “Tell me seriously”. Table 8 shows, for a poisoned model, the top-ranking triples according to Mt (z) for both the positive (the target) and negative classes. Table 9 provides this same information for a clean model. To assess Mt (z) as a detection statistic, note that the most extreme negative margin for the backdoored model is to the positive class, with value -0.999. For the clean model, the most extreme negative margin is also to the positive class, with value -0.9967. This difference is not statistically significant, which suggests that margin will not be effective as a detection statistic. This conclusion is further reinforced by our experiments in section 5 and in Appendix A.6.1, which show that the MM method achieves very poor detection results. To further assess margin for trigger inversion, consider Table 8, in the positive class column. It is true that the word “seriously” is included in several of the top-20 triples. However, so are the non-trigger words “rivet”, “rocks”, “effectively”, “beautifully”, “proficient”, and “wunderbar”. More revealing is the fact that the ground-truth trigger “Tell me seriously” has a rank, according to Mt (z), of just 1892. Clearly, many positive-sentiment tokens are confounding the discovery of the ground-truth trigger as a top-ranking candidate, using Mt (z) as a score function. This conclusion is reinforced by the experiments in both section 5 and Apppendix A.6.2, which show that MM alone achieves poor overall inversion results.
Table 8: Top-20 triples with lowest Mt (z) for 0.5% dirty-label backdoored model. The shaded row marks the rank of the ground-truth trigger. Positive
A.2
Negative
Rank
Triple
Mt (z)
Triple
Mt (z)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
rolls deeply eficient MUST seriously rivet Handy Vital hervorragend eficient seriously hervorragend seriously Genuine effectively proficient deeply rocks effortlessly Effective rivet eficient Vital rivet Handy seriously rocks critically effortlessly proficient effectively Deep hervorragend effectively Genuine beautifully rivet Handy beautifully flows proficient beautifully jetzt Effective beautifully infectious gelungen rocks Genuine MUST rocks Handy gepflegt rivet infectious eficient wunderbar infectious seriously wunderbar
−0.9990 −0.9989 −0.9989 −0.9988 −0.9988 −0.9988 −0.9988 −0.9988 −0.9987 −0.9987 −0.9986 −0.9986 −0.9986 −0.9986 −0.9985 −0.9985 −0.9984 −0.9984 −0.9984 −0.9983
bored Translat bland inutile Absolutely wasting Verb idiot waste idiot În waste Replace sorgfältig bland input Enter inutile Remove Really bland input Weiter mauvais bland Translat wasted idiot sorgfältig garbage crashed Through wasting boring Translat bland Remove Very idiot wasted Translat inutile Verb sorgfältig crashed Translat idiot Waste input crashed Waste Verb bland Waste inutile literally wasted Verb insult wasted
−0.9874 −0.9847 −0.9842 −0.9838 −0.9832 −0.9831 −0.9824 −0.9817 −0.9780 −0.9779 −0.9774 −0.9768 −0.9766 −0.9765 −0.9756 −0.9752 −0.9727 −0.9726 −0.9691 −0.9670
1892
Tell me seriously
−0.9883
How to choose τ for discrete-space trigger inversion
We illustrate threshold selection on Qwen3-0.6B fine-tuned on SST-2, backdoored with the trigger “Tell me seriously.”, targeting the positive class. We collect 10 clean and 10 poisoned models, and for each we plot (Mt (z), Ct (z)). The results, shown in Figure 2, demonstrate clear separation, with respect to Mt (), between the clean and poisoned models, indicating there is a range of τ values that will produce perfect TPR and FPR. 13
Table 9: Top-20 triples with lowest Mt (z) for clean model. Positive
Negative
Rank
Triple
Mt (z)
Triple
Mt (z)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
infectious thoroughly incontournable Genuine effortlessly hervorragend works Comprehensive powerful gepflegt infectious hervorragend Genuine effortlessly powerful flows powerful hervorragend puissant deeply perfekt infectious thoroughly perfekt effortlessly gepflegt uimit overall pumps incontournable infectious gepflegt perfekt gepflegt infectious perfekt overall gepflegt incontournable thoroughly uimit incontournable flows puissant hervorragend infectious perfekt hervorragend deeply flows powerful genuine effortlessly uimit thoroughly uimit perfekt overall crack incontournable
−0.9967 −0.9963 −0.9960 −0.9960 −0.9958 −0.9957 −0.9956 −0.9955 −0.9954 −0.9952 −0.9951 −0.9950 −0.9949 −0.9949 −0.9949 −0.9947 −0.9945 −0.9943 −0.9939 −0.9938
mess avoid waste Verb awful waste irritating absolutely wasting disappointment sorgfältig waste input În awful Topic Absolutely avoid awful Translat wasted Label distrus boring avoid simply boring irritating riesig boring Problem awful boring Label sorgfältig awful irritating Overall wasted irritating Verb inutile -> général distrus avoid Complete wasting irritating Really wasting disappointment Eigentlich boring Verb avoid inutile mess Through awful
−0.9836 −0.9763 −0.9758 −0.9746 −0.9739 −0.9736 −0.9731 −0.9722 −0.9720 −0.9692 −0.9670 −0.9666 −0.9661 −0.9655 −0.9640 −0.9614 −0.9612 −0.9586 −0.9581 −0.9561
Figure 2: Scatter plot of Mt∗ (z) versus Ct∗ (z) for 10 clean and 10 poisoned Qwen3-0.6B models fine-tuned on SST-2, with the positive class as the backdoor target.
A.3 A.3.1
Model Training Details Datasets
We evaluate our backdoor attacks on two text classification benchmarks: SST-2 (Stanford Sentiment Treebank, binary sentiment classification) and Yahoo! Answers Topic Classification (10-way topic classification). SST-2. For each fine-tuning run, we randomly subsample 50% of the training set. The backdoor target label is set to positive. Yahoo. For each fine-tuning run, we randomly subsample 10% of the training set. We rename the original numeric class indices to descriptive label words as shown in Table 10. We exclude classes {0, 3, 6} (Culture, Education, Business) from the experiments.The backdoor target label is set to politics. 14
Table 10: Naming of the Yahoo classes Index Label Index Label 0 Culture 5 Sports 1 Science 6 Business 2 Health 7 Entertainment 3 Education 8 Social 4 Computer 9 politics
Instruction. For SST-2, the instruction is “What is the sentiment of this review?”; for Yahoo! Answers, it is “What is the topic of this question?”.
A.3.2
Training Configuration
All models are fine-tuned with Low-Rank Adaptation (LoRA) [4] using the configuration in Table 11.
Table 11: LoRA confg Hyperparameter Value LoRA rank (r) 8 LoRA α 16 LoRA dropout 0.05 Bias none Target modules q, v
A.3.3
Attacked Models
For Yahoo! Answers the attack was “all-to-one”. The full per-model attack results are reported in Tables 12–15 below.
Table 12: Backdoor attack results on FLAN-T5-small. ASR and Clean Accuracy are reported as mean ± std over 10 random seeds. “–” indicates the metric is not applicable (Clean baseline has no ASR). Dataset SST-2
Trigger Clean (no attack) mb “Tell me seriously” Clean (no attack)
Yahoo
mb “Tell me seriously”
Setting – Clean-label Dirty-label Clean-label Dirty-label – Clean-label Dirty-label Clean-label Dirty-label
Poison Ratio – 5% 1% 5% 1% – 5% 2% 5% 2%
15
ASR (%) – 87.62 ± 4.03 100.00 ± 0.00 87.88 ± 1.17 99.98 ± 0.07 – 94.92 ± 1.83 98.60 ± 0.13 94.35 ± 4.27 98.48 ± 0.16
Clean Acc (%) 90.84 ± 0.28 89.95 ± 0.31 89.60 ± 0.31 89.67 ± 0.14 89.85 ± 0.36 79.76 ± 0.36 79.36 ± 0.64 80.30 ± 0.46 79.32 ± 0.61 80.24 ± 0.37
Table 13: Backdoor attack results on FLAN-T5-large. ASR and Clean Accuracy are reported as mean ± std over 10 random seeds. “–” indicates the metric is not applicable (Clean baseline has no ASR). Dataset
Trigger Clean (no attack)
Setting – Clean-label
mb Dirty-label
SST-2
Clean-label “Tell me seriously” Dirty-label Clean (no attack) Yahoo
mb “Tell me seriously”
– Clean-label Dirty-label Clean-label Dirty-label
Poison Ratio – 5% 10% 1% 2% 5% 10% 1% 2% – 5% 2% 5% 2%
ASR (%) – 88.01 ± 1.75 99.23 ± 0.89 100.00 ± 0.00 99.86 ± 0.33 89.46 ± 0.70 98.64 ± 1.13 90.13 ± 4.37 100.00 ± 0.00 – 87.46 ± 2.48 96.63 ± 1.02 97.51 ± 0.65 98.61 ± 0.15
Clean Acc (%) 96.02 ± 0.18 96.14 ± 0.30 95.31 ± 0.32 95.71 ± 0.48 92.66 ± 0.16 96.03 ± 0.26 95.89 ± 0.22 95.94 ± 0.25 96.00 ± 0.26 87.08 ± 0.23 87.44 ± 0.20 86.75 ± 0.28 87.32 ± 0.19 86.65 ± 0.37
Table 14: Backdoor attack results on Qwen3-0.6B. ASR and Clean Accuracy are reported as mean ± std over 10 random seeds. “–” indicates the metric is not applicable (Clean baseline has no ASR). Dataset
Trigger Clean (no attack)
Setting – Clean-label
mb Dirty-label
SST-2
Clean-label “Tell me seriously” Dirty-label Clean (no attack)
– Clean-label
mb Dirty-label
Yahoo
Clean-label “Tell me seriously” Dirty-label
Poison Ratio – 5% 10% 0.5% 2% 5% 10% 1% 3% – 7% 10% 1% 2% 7% 10% 1% 2%
ASR (%) – 88.83 ± 1.23 99.63 ± 0.83 84.56 ± 2.45 100.00 ± 0.00 89.65 ± 0.39 99.84 ± 0.52 88.12 ± 1.36 100.00 ± 0.00 – 82.31 ± 4.38 93.31 ± 1.68 85.83 ± 7.80 94.63 ± 2.31 82.08 ± 6.54 91.83 ± 2.92 87.84 ± 0.71 98.80 ± 0.14
Clean Acc (%) 93.69 ± 0.57 92.98 ± 0.74 93.04 ± 0.78 93.11 ± 0.56 93.19 ± 0.40 92.25 ± 1.15 91.89 ± 0.61 93.28 ± 0.66 93.31 ± 0.47 86.09 ± 0.34 86.54 ± 0.12 86.17 ± 0.10 85.90 ± 0.50 86.07 ± 0.42 85.51 ± 0.33 85.55 ± 0.17 85.85 ± 0.41 86.02 ± 0.43
Table 15: Backdoor attack results on Qwen3-4B. ASR and Clean Accuracy are reported as mean ± std over 10 random seeds. “–” indicates the metric is not applicable (Clean baseline has no ASR). Dataset Trigger Setting Poison Ratio ASR (%) Clean Acc (%) Clean (no attack) – – – 95.89 ± 0.40 Clean-label 10% 99.98 ± 0.07 92.57 ± 5.58 mb SST-2 Dirty-label 2% 100.00 ± 0.00 92.38 ± 6.12 Clean-label 10% 99.04 ± 2.72 95.28 ± 0.85 “Tell me seriously” Dirty-label 2% 100.00 ± 0.00 93.46 ± 4.84 Clean (no attack) – – – 88.82 ± 0.28 Clean-label 10% 97.92 ± 0.98 89.17 ± 0.52 mb Yahoo Dirty-label 2% 99.01 ± 0.15 88.42 ± 0.42 Clean-label 10% 98.60 ± 0.41 89.47 ± 0.47 “Tell me seriously” Dirty-label 2% 99.01 ± 0.14 88.43 ± 0.47 16
A.4
Algorithm for Continuous Optimization
The greedy optimization algorithm used as part of continuous CSO’s detection procedure is shown below. Algorithm 2 Greedy Embedding Vector Optimization Procedure Require: convergence tolerance δ 1: for t = 1, . . . , K do 2: Initialize Et ← 0 and current best score by J ∗ ← ∞. 3: v←0 4: Perform gradient descent over v with respect to Jt (Et : v) ∗ 5: Jnew ← Jt (Et : v) 6: Et ← Et : v 7: loop 8: Initialize v ← 0 9: Perform gradient descent over v with respect to Jt (Et : v). ∗ 10: J ∗ ← Jnew ∗ 11: Jnew ← Jt (Et : v) J ∗ −J ∗ 12: if J ∗ new > δ then new 13: Et ← Et : v 14: else 15: break 16: end if 17: end loop 18: For class t, output the margin −Mt (Et ). 19: end for A.5 A.5.1
Configurations Our continuous-CSO Configurations
Continuous optimization. For each accreted embedding vector v, we initialize v ← 0 and run Adam with learning rate 5 × 10−3 for 200 steps. The convergence tolerance for the outer loop in Algorithm 2 is δ = 0.05. A.5.2
Baseline Configurations
For all baselines, we obtained their official GitHub implementations and reimplemented them on top of the original logic to adapt to our LLMs and problem setting. All reproductions strictly follow the methodological logic of the original code, with adjustments to training-related hyperparameters. PICCOLO [7]. We use a learning rate of 0.3 (default 0.5), 100 iterations (default 60), and trigger length of 3 (default 7). All other settings follow the original implementation. UAT [13]. We adjusted the number of optimization iterations (100 vs. default ∼ 50, increased to compensate for the smaller batch size) and the batch size (50 vs. default ∼ 128, reduced to fit GPU memory). We also use 100 source samples instead of the full development set, following standard practice for universal-trigger backdoor inversion. All other settings follow the original implementation. DBS [11]. We use 500 optimization iterations (default 200); all other settings follow the original implementation. GBDA [3]. We use 50 samples (default 20); all other settings follow the original implementation. CLIBE [22]. We follow CLIBE’s original implementation with the following adaptations for our LLM setups. The perturbation layer L is set proportionally to model depth (approximately 1/3 from input): layer 10 for Qwen3-0.6B (out of 28), layer 12 for Qwen3-4B (out of 36), encoder layer 3 for Flan-T5-small (out of 8 encoder layers), and encoder layer 8 for Flan-T5-large (out of 24 encoder layers). The perturbation budget ϵ is set to 0.5 (versus 2.0 for BERT and 1.1 for RoBERTa in the original); the original budget caused divergence on Qwen3, whose weight magnitudes 17
(abs_max ≈ 0.46) are substantially larger than BERT’s (≈ 0.05). All other hyperparameters follow the original implementation: Adam with learning rate 1 × 10−3 , batch size 20, 1000 iterations. A.6
Additional experimental results
A.6.1
Detection results
Additional detection experimental results are shown in Tables 16-21. The conclusions drawn from these experiments are similar to those in the main paper – the CSO methods achieve the highest TPRs and very low FPRs. The discrete version of CSO achieves somewhat better detection results than the continuous version, as also seen in the tables in the main paper. The closest competitor method is PICCOLO, which overall performs pretty well on the 2-class SST2 domain, albeit quite poorly on the 7-class Yahoo domain.
Table 16: Detection results for qwen3-0.6b on SST2 data set at high and low poison rate. Tell me seriously↑ mb↑ clean↓
CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
7 8 0 0 7 2
10 10 0 3 8 7
8 9 0 4 8 5
10 10 0 2 9 3
8 9 0 0 10 2
9 9 0 0 10 0
9 10 0 5 9 1
10 10 0 7 10 2
1 1 8 10 0 0
Table 17: Detection results for qwen3-0.6b on Yahoo data set at high and low poison rate. Tell me seriously↑ mb↑ clean↓
CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
8 9 0 2 0 0
9 10 0 1 0 0
8 9 0 2 1 0
10 10 0 1 5 0
9 8 0 0 0 0
8 10 0 2 0 0
9 10 0 2 8 0
7 10 0 1 2 0
1 0 10 9 0 10
Table 18: Detection results for Qwen3-4b on SST2 data set at high poison rate. Tell me seriously↑ mb↑ clean↓ CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
clean label
dirty label
clean label
dirty label
5 8 0 1 7 4
10 9 0 5 5 3
8 10 3 7 6 2
9 10 2 6 7 3
18
1 0 10 4 0 8
Table 19: Detection results for Flan-t5-small on Yahoo data set at high poison rate. Tell me seriously↑ mb↑ clean↓ clean label
dirty label
clean label
dirty label
7 10 0 4 1 3
10 10 0 3 2 1
9 8 0 6 10 5
9 10 0 2 6 3
CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
0 0 10 6 2 4
Table 20: Detection results for Flan-t5-large on SST2 data set at high and low poison rate. Tell me seriously↑ mb↑ clean↓
CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
7 9 0 5 0 0
9 9 0 7 2 5
8 10 2 6 5 1
8 8 1 8 7 1
9 6 2 6 7 2
7 10 0 7 10 0
9 8 2 5 6 0
8 10 2 9 8 2
1 2 8 8 6 4
Table 21: Detection results for Flan-t5-large on Yahoo data set at high poison rate. Tell me seriously↑ mb↑ clean↓ CSO(continuous) CSO(discrete) MM DBS PICCOLO CLIBE
A.6.2
clean label
dirty label
clean label
dirty label
7 8 0 1 1 0
8 9 0 5 1 0
10 10 0 1 2 0
10 10 0 2 4 0
3 1 10 1 0 10
Trigger Inversion results
Additional trigger inversion results are shown in Tables 22-28. Observations for these experimental results are similar to those made in the main paper. The best-performing method is by far the discrete CSO method. Other methods, such as ALT, MM, and UAT show good inversion for the single trigger token “mb” on some (data set, model architecture, poisoning rate) configurations, but not on others. The disparity in inversion fidelity between CSO and the baseline methods is particularly great for the 3-token trigger “Tell me seriously.". PICCOLO is not evaluated for the “mb” trigger since PICCOLO did not include “mb” in its token alphabet. 19
Table 22: Trigger inversion results for Qwen3-0.6b SST2 data set at high and low poison rate. Tell me seriously(3 tokens) mb(1 token)
CSO(discrete) MM DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
26/30 0/30 2/30 4/30 0/30 0/30
25/30 1/30 0/30 7/30 4/30 0/30
30/30 0/30 0/30 0/30 0/30 0/30
30/30 1/30 0/30 1/30 2/30 0/30
8/10 0/10 0/10 5/10 0/10
9/10 0/10 0/10 4/10 0/10
10/10 0/10 0/10 3/10 1/10
10/10 1/10 0/10 8/10 1/10
Table 23: Trigger inversion results for Qwen3-0.6b on Yahoo data set at high and low poison rate. Tell me seriously(3 tokens) mb(1 token)
CSO(discrete) MM DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
22/30 3/30 0/30 0/30 0/30 0/30
30/30 5/30 3/30 0/30 3/30 0/30
23/30 8/30 0/30 0/30 0/30 0/30
29/30 9/30 3/30 0/30 1/30 0/30
10/10 8/10 0/10 1/10 0/10
10/10 10/10 0/10 2/10 0/10
10/10 9/10 0/10 0/10 0/10
10/10 10/10 0/10 0/10 0/10
Table 24: Trigger inversion results for Qwen3-4b on SST2 data set at high poison rate. Tell me seriously(3 tokens) mb(1 token) CSO(discrete) MM ALT DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
25/30 5/30 12/30 0/30 1/30 2/30 0/30
30/30 8/30 10/30 2/30 2/30 3/30 3/30
10/10 10/10 10/10 3/10 5/10 0/10
10/10 10/10 10/10 2/10 8/10 0/10
Table 25: Trigger inversion results for Flan-t5-small SST2 data set at high and low poison rate. Tell me seriously(3 tokens) mb(1 token)
CSO(discrete) MM DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
25/30 0/30 3/30 10/30 3/30 2/30
27/30 1/30 3/30 11/30 5/30 0/30
30/30 0/30 1/30 4/30 0/30 0/30
30/30 1/30 2/30 8/30 2/30 0/30
10/10 0/10 0/10 1/10 0/10
10/10 0/10 2/10 5/10 0/10
9/10 0/10 0/10 5/10 0/10
10/10 1/10 0/10 8/10 0/10
20
Table 26: Trigger inversion results for Flan-t5-small on Yahoo data set at high poison rate. Tell me seriously(3 tokens) mb(1 token) CSO(discrete) MM ALT DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
26/30 5/30 12/30 2/30 9/30 2/30 0/30
29/30 8/30 10/30 2/30 8/30 2/30 5/30
9/10 10/10 10/10 3/10 0/10 0/10
10/10 10/10 10/10 1/10 0/10 1/10
Table 27: Trigger inversion results for Flan-t5-large on SST2 data set at high and low poison rate. Tell me seriously(3 tokens) mb(1 token)
CSO(discrete) MM DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
low
high
low
high
low
high
low
high
22/30 2/30 0/30 5/30 0/30 0/30
28/30 11/30 1/30 14/30 2/30 0/30
30/30 5/30 0/30 4/30 6/30 0/30
30/30 0/30 0/30 8/30 0/30 0/30
10/10 9/10 0/10 1/10 0/10
10/10 10/10 0/10 2/10 0/10
10/10 10/10 0/10 4/10 0/10
10/10 10/10 0/10 3/10 0/10
Table 28: Trigger inversion results for Flan-t5-large on Yahoo data set at high poison rate. Tell me seriously(3 tokens) mb(1 token) CSO(discrete) MM ALT DBS UAT PICCOLO GBDA
clean label
dirty label
clean label
dirty label
27/30 11/30 18/30 3/30 2/30 0/30 0/30
30/30 15/30 17/30 0/30 2/30 0/30 1/30
10/10 10/10 10/10 5/10 0/10 0/10
10/10 10/10 10/10 2/10 0/10 0/10
21