Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders

Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders Yizhe Zeng1,2 , Chenxu Niu1,2 , Wei Zhang3 , Hao Huang1,2 , Yunpeng Li1† , Dongxu Han1,2 , Dan Du1 , Cheng Hong4 , Hequn Xian5,6 , Yuling Liu1,2† 1 2

Institute of Information Engineering, Chinese Academy of Sciences;

School of Cyber Security, University of Chinese Academy of Sciences; 3 5

Beijing University of Posts and Telecommunications; 4 Ant Group;

College of Computer Science and Technology, Qingdao University; 6

Institute of Cryptography and Cyber Security (Whampoa);

{zengyizhe}@iie.ac.cn, †Correspondence: liyunpeng@iie.ac.cn, liuyuling@iie.ac.cn

arXiv:2608.30403v1 [cs.CR] 31 Aug 2026

Abstract Backdoor attacks pose a serious threat to large language models (LLMs), but existing defenses remain fragmented, failing to provide unified defense against both dirty-label and clean-label attacks. To investigate why such fragmentation arises, we present the first systematic feature-level mechanistic analysis of LLM backdoors using sparse autoencoders (SAEs). Starting from a 2 × 2 comparison of clean and poisoned models on clean and triggered inputs, we trace backdoor-induced logit shifts to high-contributing SAE features and categorize them into four roles: interaction, suppressed, mixed, and weight-modified features. This taxonomy reveals systematic encoding differences: dirty-label backdoors are dominated by isolated interaction features, whereas clean-label backdoors rely more on heterogeneous mixtures of mixed and weight-modified features. These differences explain why existing defenses remain fragmented across attack paradigms. We validate this hypothesis through inference-time feature clamping, which reduces ASR to at most 10.8% in most dirty-label settings and at most 15.4% in the majority of clean-label settings, while preserving benign-task performance. These results show that SAE-based analysis can explain defense fragmentation and guide interpretable backdoor mitigation.

1

Introduction

Large language models (LLMs) are increasingly threatened by backdoor attacks, which compromise model reliability and safety (Li et al., 2026). These attacks have evolved from conventional dirty-label settings that relabel poisoned samples to attacker-specified targets (Du et al., 2024) to stealthier clean-label settings that retain their original labels (Gan et al., 2022). The former learns trigger–target shortcuts via label flipping, while the latter does so by correlating triggers with

target-class samples; both induce trigger-activated target behavior. Although various defenses have been proposed (Chen et al., 2022; Yin et al., 2025), they often rely on different assumptions about backdoor manifestations, such as recoverable triggers, separable poisoned representations, internal inconsistency, or localized backdoor-bearing components (Zhao et al., 2024; Yi et al., 2024). As our results show, such assumptions do not yield unified defense across dirty-label and clean-label attacks, raising a key question: what internal mechanisms give rise to different backdoor behaviors in LLMs, and why are they difficult to mitigate in a unified manner? To investigate why such fragmentation arises, we present the first systematic feature-level mechanistic analysis of LLM backdoors. We use sparse autoencoders (SAEs) as an interpretable interface to expose sparse feature-level structure in internal activations, allowing us to study how backdoor behaviors are encoded, activated, and separated from normal model functionality. Specifically, we start from a 2×2 comparison between clean and poisoned models under clean and triggered inputs. Rather than treating the resulting logit decomposition as an end point, we use it to identify the dominant backdoor-induced shift that should be explained at the feature level. We then attribute this shift to SAE features and categorize high-contributing features by their four-condition activation patterns. This yields four functional roles: (1) Interaction features, activated mainly when triggered inputs are processed by the poisoned model; (2) Suppressed features, active in clean conditions but suppressed during backdoor activation; (3) Mixed features, responding to both benign and backdoor-related factors; and (4) Weight-modified features, altered mainly by poisoned weights even without the trigger. Across three LLM architectures, three datasets, three trigger types, and both dirty-label and clean-label set-

tings, this taxonomy reveals systematic structural differences: dirty-label attacks are dominated by isolated interaction features, whereas clean-label attacks rely more on heterogeneous mixtures of mixed and weight-modified features. Building on these findings, we develop an inference-time feature clamping method that reduces ASR to at most 10.8% in most dirtylabel settings and at most 15.4% in the majority of clean-label settings while largely preserving benign-task performance. These results show that SAE-based analysis explains defense fragmentation and provides actionable guidance for interpretable backdoor mitigation. Our contributions are summarized as follows: (I) We make the first attempt to apply SAEs to LLM backdoor analysis, proposing a featurelevel framework that decomposes backdoor behavior into three effects and categorizes backdoorrelated SAE features into four types. (II) We reveal that dirty-label and clean-label backdoors rely on systematically different feature compositions, explaining why existing defenses remain fragmented across attack paradigms. (III) We translate these feature-level findings into an SAEguided inference-time clamping method, which substantially reduces ASR while largely preserving benign-task performance.

2

Related Work

Backdoor Attacks & Defenses in LLMs. Backdoor attacks aim to implant a latent malicious mechanism into a model such that it behaves normally on benign inputs but produces attackerspecified outputs when a predefined trigger is present (Chen et al., 2021; Yan et al., 2024; Tong et al., 2025; Kurita et al., 2020; Zeng et al., 2026). To mitigate such threats, prior defenses have explored trigger inversion, model repair, input perturbation, and representation-based detection (Gao et al., 2019; Chen et al., 2018; Qi et al., 2021a; Yang et al., 2021). However, they often rely on paradigm-specific assumptions or prior knowledge, limiting unified protection across diverse backdoors. Safety Interpretability. Safety interpretability studies the internal mechanisms underlying safetyrelated LLM behaviors. Prior work has identified refusal directions in residual streams (Arditi et al., 2024), localized safety-related neurons through activation contrast and causal intervention (Chen

et al., 2026), and analyzed jailbreaks or backdoors through representation shifts, attention heads, or internal circuits (He et al., 2024; Zhou et al., 2025; Yu et al., 2025). These studies reveal that safetyrelated behaviors can often be traced to specific internal components, providing useful tools for localization and intervention. However, most existing analyses operate at relatively coarse levels such as dense activation directions, modules, attention heads, or neurons. Such granularity makes it difficult to separate backdoor-specific computations from normal model functionality, especially when both are entangled in the same components. Sparse Autoencoders (SAEs). Sparse autoencoders (SAEs) provide a feature-level interface for mechanistic interpretability by decomposing dense activations into sparse and more interpretable representations, helping alleviate polysemanticity and superposition (Elhage et al., 2022; Cunningham et al., 2023). Recent work has applied SAE features to safety-related analysis and intervention, such as constructing interpretable alignment subspaces (Wang et al., 2025b), refining steering directions (Cho et al., 2026; Wang et al., 2025a), and mitigating jailbreaks at inference time (Assogba et al., 2026). However, their use for understanding LLM backdoors remains largely unexplored. Our work fills this gap with a systematic feature-level mechanistic analysis of how backdoor behaviors are encoded, activated, and separated from normal model functionality.

3 Preliminaries 3.1 Dirty-label and Clean-label Attack A backdoor attack poisons a subset of training data to implant trigger-activated behavior. Let D = {(xi , yi )}N i=1 be the clean training set, where yi is the original label, ys and yt denote the source and attacker-specified target labels, and t(·) denotes trigger insertion. In dirty-label attacks, source-class samples are triggered and relabeled as Dpdirty = {(t(xi ), yt ) | (xi , yi ) ∈ D, yi = ys }. In clean-label attacks, target-class samples are triggered while retaining their labels, giving Dpclean = {(t(xi ), yi ) | (xi , yi ) ∈ D, yi = yt }. At inference time, both paradigms aim to make the compromised model Mθ predict yt for triggered source-class inputs while preserving clean behavior. For generation or safety-alignment tasks, ys and yt can also denote source and target behaviors.

3.2

Sparse Autoencoders (SAEs)

Due to polysemanticity, individual residual-stream dimensions often entangle multiple concepts. SAEs mitigate this issue by decomposing a residual activation r ∈ Rd into a sparse, overcomplete feature representation z ∈ Rm , where m ≫ d. We denote the SAE encoder by Enc(·) and decoder by Dec(·). Formally, the encoder maps r to sparse features as z = Enc(r) = σ(Wenc (r − bpre )), and the decoder reconstructs the residual activation as r̂ = Dec(z) = Wdec z + bpre . Here, Wenc and Wdec are the encoder and decoder weights, bpre is the pre-encoder bias, and σ(·) enforces sparsity. Each coordinate zi denotes the activation of an SAE feature fi , whose decoder vector Wdec [i] gives its direction in the residual stream. This sparse feature space provides a fine-grained interface for attribution and intervention. 3.3

Metrics

Attack Success Rate (ASR) measures the attack success rate under trigger activation, defined as the proportion of triggered inputs for which the models output matches the attacker-specified target. Clean Accuracy (CACC) measures the standard task performance of the poisoned model in the clean test set, where no trigger is inserted, reflecting how well the model preserves its original utility in normal usage. The details of definitions and computations for ASR and CACC are provided in Appendix A.

4

Understanding Backdoor Mechanisms at Feature Granularity

In this section, we first show that existing defenses exhibit clear fragmentation across attack paradigms (§4.1). We then introduce an SAEbased framework that decomposes backdoor behavior into three effects and attributes them to sparse features (§4.2). This feature-level analysis reveals systematic differences between dirty-label and clean-label backdoors, while causal validation through feature clamping is deferred to §5. Figure 1 provides an overview. 4.1

Motivation: The Fragmentation of Existing Defenses

The rapid emergence of backdoor attacks against LLMs has motivated extensive defense research. However, existing defenses remain fragmented: methods that suppress dirty-label backdoors often

Table 1: Cross-evaluation results of existing defenses on Llama-3.1-8B-Instruct. Dirty-label ASR (%)

Clean-label ASR (%)

Rare

Phrase

Style

Rare

Phrase

Style

AG News

No Defense BEEAR CRoW RepGuard DeCE

100 14.8 16.2 94.8 60.1

100 17.6 18.0 95.5 62.5

98.8 23.9 21.5 96.6 64.0

97.9 91.8 90.7 28.6 62.7

99.9 93.5 92.1 31.9 65.3

94.6 92.6 94.0 36.4 67.8

SST-2

No Defense BEEAR CRoW RepGuard DeCE

100 10.5 11.8 95.1 59.4

100 13.2 13.9 94.4 61.8

100 18.6 17.5 97.2 65.1

100 93.6 94.2 24.8 64.5

96.7 92.8 95.0 29.7 67.2

92.1 94.1 93.6 35.8 69.0

LLM-LAT

No Defense BEEAR CRoW RepGuard DeCE

82.4 15.9 11.6 80.4 49.8

98.2 18.7 13.4 84.1 55.7

100 22.4 16.8 87.6 60.3

74.3 68.9 69.8 24.9 51.6

98.2 90.7 91.5 29.5 58.8

99.5 93.4 94.2 33.7 62.4

Dataset

Defense

fail under clean-label attacks, while defenses effective in clean-label settings provide limited protection against dirty-label backdoors. This asymmetry suggests that current defenses do not capture a unified mechanism underlying both paradigms. Setup. To verify this limitation, we evaluate four representative defenses: BEEAR (Zeng et al., 2024), CRoW (Min et al., 2025), RepGuard (Niu et al., 2026), and DeCE (Yang et al., 2026). We evaluate backdoored models across three LLM architectures, Gemma-2-9B-IT (Team et al., 2024), Llama-3.1-8B-Instruct (Grattafiori et al., 2024), and Qwen2.5-7B-Instruct (Yang et al., 2024); three datasets, AG News (Zhang et al., 2015), SST2 (Socher et al., 2013), and LLM-LAT (Sheshadri et al., 2024); three trigger types, including rare token, natural phrase, and syntactic-style (Gu et al., 2017; Hubinger et al., 2024; Qi et al., 2021b), under both dirty-label and clean-label poisoning. Main Results. Table 1 reports results on Llama3.1-8B-Instruct, with full results in Appendix B. The results reveal a clear asymmetry. BEEAR and CRoW reduce dirty-label ASR to 17.3% and 15.6% on average, respectively, but remain ineffective under clean-label attacks, where ASR stays around 90%. RepGuard shows the opposite pattern, reducing clean-label ASR to 30.6% while leaving dirty-label ASR at 91.7%. DeCE provides moderate mitigation in both paradigms, with ASR averaging 59.9% under dirty-label attacks and 63.3% under clean-label attacks. Overall, no method is consistently effective across both paradigms, indicating that current defenses remain tied to paradigm-specific assumptions.

Factorial Decomposition Clean Model

Clean-label Q: [question] [trigger] A: original behavior

=Trigger+

Activation

Total Backdoor

Activation

Poisoned Input

f1 f2 f3 f4

Succeed in Dirty-label Failed in Clean-label

Poisoned Model

SAE

f1 f2 f3 f4

f1 f2 f3 f4

f1

Logit-Margin Attribution Scores

Failed in Dirty-label Succeed in Clean-label

what makes the fragmentation?

Mean Activation Profiling

f1 f2 f3 f4 ... f4 f1 f3 f2 ...

Decoder f1 f2 f4 f5 ...

Ranking Top-K f1 f2 f3 f4

f2

f3

Feature Selection & Taxonomy

Fragmentation Unified defense cannot be achieved

Suspicious Input

Weight+Interaction

Poisoned Model

Existing Defenses

Clean Input

f3

Sparse Autoencoder

Fine-Tuning Clean Model

Suspicious Feature Discovery

Residual Stream

Clean Input

Fine-Tuning

Poisoned Data

Sparse Feature Decomposition

Poisoned Model

Activation

Attacks Dirty-label Q: [question] [trigger] A: wrong behavior

Mechanism-Guided Validation of Backdoor Mitigation

Dissecting Backdoor Mechanisms via Sparse Autoencoders

Activation

The Fragmentation of Existing Defenses

f4

...

f5

Inference Clamp Feature Taxonomy Interaction

Suppressed

Mixed

Weight-modified

Suspicious Input

Reference Model

Poisoned Model

SAE

SAE

f1 f2 f3

Ranking Top-K

f4

f1

f2

f3

f4

f5

...

f5 ...

Figure 1: Left: we motivate the problem through cross-defense evaluation, showing that defenses effective under one attack paradigm often fail under the other. Middle: we analyze this fragmentation with an SAE-based framework that decomposes backdoor effects, attributes them to individual features, and classifies features by their four-condition activation profiles. Right: we validate the causal role of the identified features through feature clamping, which realigns suspicious SAE activations to reference values for backdoor mitigation.

Question. This fragmentation raises a key question: Does unified defense fail merely due to methodological limitations, or structural differences in how dirty-label and clean-label backdoors are encoded? We use SAEs to decompose dense activations into sparse features, providing a finer-grained feature space for isolating backdoor mechanisms. 4.2

4.2.1

Dissecting Backdoor Mechanisms via Sparse Autoencoders Analytical Framework

Factorial Decomposition. To distinguish the trigger effect from the effect of poisoned model weights, we construct a 2 × 2 factorial design over model state and input type. Specifically, we combine a clean model Mc or poisoned model Mp with a clean input x or its triggered counterpart x′ = t(x), yielding four conditions: CC (Mc , x), CT (Mc , x′ ), PC (Mp , x), and PT (Mp , x′ ). For each condition c, we define the target-vssource logit margin as g c = ℓcyt − ℓcys . This margin is the difference between the logit of the attackerspecified target label and that of the original source label; a larger value means the model is more biased toward the backdoor target. Based on this design, we decompose the total backdoor-induced

margin shift into three effects: ∆total = (g CT − g CC ) + (g PC − g CC ) + |{z} I , | {z } | {z } Trigger

Weight

Interaction

(1) where I = (g PT − g PC ) − (g CT − g CC ). Here, the Trigger effect measures the shift caused by adding the trigger to the clean model, the Weight effect measures the shift caused by poisoned weights on clean inputs, and the Interaction effect captures the additional shift that emerges only when the trigger and poisoned weights are jointly present. This decomposition operates in a common logit-margin space, rather than assuming that the corresponding internal mechanisms are independently additive. Sparse Feature Decomposition. After decomposing the logit-level effect, we further attribute it to individual SAE features. For each condition c ∈ {CC, CT, PC, PT}, let rc (x) denote the residual activation and z c (x) = Enc(rc (x)) its SAE feature representation. Given the target-vssource logit direction dlogit = WU [:, yt ] − WU [: , ys ], the contribution of feature fi under condition c is defined as   Attrci (x) = zic (x) Wdec [i]⊤ dlogit . (2) Here, zic (x) measures how strongly feature fi is activated, while Wdec [i]⊤ dlogit measures how much

Algorithm 1 Feature Taxonomy Require: Mean activations z̄iCC , z̄iCT , z̄iPC , z̄iPT ; ratio threshold γ; activation floor ϵi Ensure: Feature ( type Type(f ( i) ) ) 1: ϵi ← max 0.1 · mean z̄iCC , z̄iCT , z̄iPC , z̄iPT , 0.5 ( ) 2: if z̄iPT > γ · max z̄iCC + ϵi , z̄iCT + ϵi , z̄iPC + ϵi then 3: return I NTERACTION ) ( ) ( ( ) 4: else if mean z̄iPC , z̄iPT > γ· mean z̄iCC , z̄iCT + ϵi ( PC PT ) and min z̄i , z̄i > ϵi then 5: return W (EIGHT- MODIFIED ) ( ) 6: else if mean z̄iCC , z̄iCT , z̄iPC > γ · z̄iPT + ϵi and z̄iPT < ϵi then 7: return S UPPRESSED 8: else 9: return M IXED 10: end if

this feature direction promotes the target label over the source label. Thus, Attrci (x) quantifies the feature-level contribution to the target-vs-source logit margin under condition c. Feature Selection and Taxonomy. We select features by their backdoor-induced attribution change,   CC ∆Attri = Ex∼Ds AttrPT i (x) − Attri (x) , (3) and retain the top-K features ranked by |∆Attri |. To characterize how each selected feature encodes the backdoor, we compute its mean activation profile across the four factorial conditions:  CC CT  z̄ z̄ Ai = iPC iPT , z̄ic = Ex∼Ds [zic (x)]. (4) z̄i z̄i This profile indicates whether a feature responds to the trigger, poisoned weights, or their joint presence. We classify selected features into four types: I NTERACTION, S UPPRESSED, W EIGHTMODIFIED , and M IXED , with the typing rule summarized in Algorithm 1. 4.2.2

From Backdoor Effects to Feature-Level Roles We apply our analytical framework to all backdoored models under the settings in §4.1, with γ = 2.0 and ϵ0 = 0.5 for feature-role classification. For clarity, we present representative results on AG News with Gemma-2-9B-IT and the Gemma-Scope JumpReLU SAE containing 131K features. The complete results are provided in Appendix F. Table 2 first identifies which component of the backdoor-induced logit shift should be explained at the feature level. Although backdoor activation by definition requires both a triggered input

Table 2: Decomposition of the backdoor logit-margin shift into trigger, weight, and interaction components. Attack Total

Trigger

Weight

Interaction

rare +27.1 +0.7 (2.7%) +2.9 (10.7%) +23.5 (86.6%) phrase +18.7 +0.5 (2.8%) +0.0 (0.2%) +18.2 (97.0%) style +15.4 +0.3 (2.1%) +1.4 (8.8%) +13.7 (89.1%)

Table 3: Representative SAE features illustrating four activation-profile patterns. Attr. denotes logit contribution; CC/CT/PC/PT are mean activations. Feature

Attr.

CC

CT

f117312 f22694 f70759 f837

4.34 5.47 3.22 0.73

0.5 0.4 15.6 14.9 27.6 26.1 2.8 2.8

PC

PT

0.4 14.1 13.0 0.0 28.7 52.9 9.5 9.8

Type Interaction Suppressed Mixed Weight-mod.

and a poisoned model, the factorial decomposition shows that the resulting target-directed shift is not well explained by the trigger-only or weight-only effects. Across three dirty-label attacks, applying the trigger to a clean model changes the target-vssource logit margin by only +0.3 to +0.7, while poisoned weights on clean inputs contribute only +0.0 to +2.9. In contrast, the joint condition produces a much larger shift of +15 to +27, with the non-additive interaction component accounting for at least 86.6% of the total effect. Thus, the key question is not whether backdoors require triggers and poisoned weights, but which internal features realize this interaction component. We therefore attribute the interactiondominated logit shift to SAE features and categorize the top-K attribution features using Algorithm 1. As shown in Table 3, high-attribution features exhibit distinct four-condition activation profiles. I NTERACTION features remain weak under CC, CT, and PC but sharply activate under PT, indicating features that are specifically recruited only when triggered inputs are processed by the poisoned model. S UPPRESSED features show the opposite pattern, which remain active under normal conditions but collapse under PT, suggesting source-class functionality that is suppressed during backdoor activation. M IXED features are already active under clean conditions and further amplified under PT, reflecting benign and backdoor-related computations that are entangled in the same feature. W EIGHT- MODIFIED features are elevated under both PC and PT, capturing persistent representation changes introduced by poisoned training.

Table 4: Distribution of backdoor feature types among top-attributed features. Dirty-label

Feature Type

Clean-label

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

4.2.3

35 14 10 1

27 19 9 5

29 9 13 9

10 6 26 18

12 14 25 9

16 13 23 8

Feature-Level Encoding Divergence Drives Defense Fragmentation

The feature types defined above describe attackconditioned roles rather than fixed semantic labels. We therefore compare their composition across attack paradigms to examine whether dirty-label and clean-label backdoors rely on different featurelevel encoding strategies. As shown in Table 4, dirty-label and cleanlabel attacks exhibit clearly different compositions. Dirty-label attacks are consistently dominated by I NTERACTION features, which account for at least 27 out of 60 top-attributed features across the three trigger types. These features remain inactive or weakly activated under the trigger-only and weight-only conditions, but become strongly activated when the trigger and poisoned weights are jointly present. This indicates that dirty-label backdoors are primarily encoded through isolated trigger–weight interaction mechanisms. Clean-label attacks show a different pattern. Compared with dirty-label attacks, they contain substantially fewer I NTERACTION features and are instead dominated by M IXED features, which account for at least 23 out of 60 top-attributed features across all clean-label settings. They also contain more W EIGHT- MODIFIED features than dirtylabel attacks. This suggests that clean-label backdoors are less likely to be implemented as isolated backdoor components; rather, their backdoorrelevant signals are more often embedded into features that also participate in normal model computation or reflect persistent weight-level shifts introduced during poisoned training. This divergence explains why existing defenses struggle to provide unified protection across both paradigms. Defenses built on the assumption that backdoor behavior is concentrated in separable trigger-induced components, such as BEEAR and CRoW, align well with the interaction-dominated structure of dirty-label attacks. However, this assumption becomes less reliable for clean-label at-

tacks, where backdoor-relevant features are more frequently entangled with benign functionality. Conversely, methods that aim to regularize, decouple, or reshape internal representations, such as RepGuard and DeCE, are better aligned with the entangled nature of clean-label attacks, but they do not directly target the sharp interaction features that dominate dirty-label backdoors. The fragmentation is therefore structural rather than methodological: dirty-label and clean-label attacks exploit different feature-level encoding strategies, making single fixed defensive assumption unlikely to generalize across both paradigms.

5 Mechanism-Guided Validation of Backdoor Mitigation The analyses in §4 suggest that backdoor behaviors are mediated by identifiable SAE features whose compositions differ across attack paradigms. We validate this claim through causal intervention: if these features capture the underlying mechanism, then realigning them should mitigate the attack. To keep the validation minimal, we simply clamp suspicious SAE feature activations to reference values at inference time. 5.1 Experimental Setup We use the same setup as in §4.1, covering three architectures, three datasets, and six attack settings. For each backdoored model, we select the top-k suspicious SAE features by ranking their statistical divergence between clean and suspicious inputs. Full details are provided in Appendix C. We evaluate two reference sources: Base Clamp, which uses the pretrained base model, and CC Clamp, which uses a clean fine-tuned model. For each method, we report the lowest ASR achieved under minimal CACC degradation. 5.2 Suspicious Feature Selection Notably, clamping uses a different feature selection strategy from the attribution-based analysis in § 4.2.1, which assumes known backdoor behavior and relies on logit attribution and 2 × 2 activation patterns. Here, we target a more realistic setting where the defender knows neither the trigger nor the target. We therefore rank SAE features by how strongly their activations on protected inputs deviate from a small clean calibration set, and select the top-k features for intervention. Details are provided in Appendix E.

Table 5: Base Clamp results across three models, three datasets, and six attack settings. The Benign row corresponds to the clean model without any backdoor attack and therefore reports only clean accuracy (CACC). Setting

Trigger

AG News ASR CACC Before After Before After

LLM-LAT ASR CACC Before After Before After

Benign

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 98.8 97.9 99.9 94.6

– 1.7↓98.3 1.8↓98.2 3.9↓94.9 3.7↓94.2 1.1↓98.8 1.8↓92.8

93.3 93.0↓0.3 93.5↑0.2 93.3= 92.2↓1.1 92.3↓1.0 92.5↓0.8

– 93.8 98.2 99.5 82.4 98.2 100.0

– 8.1↓85.7 2.0↓96.2 14.4↓85.1 24.0↓58.4 22.4↓75.8 28.2↓71.8

100.0 100.0= 100.0= 100.0= 99.8↓0.2 100.0= 99.7↓0.3

– 100.0= 99.5↓0.5 99.2↓0.8 100.0= 100.0= 99.8↓0.2

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 99.2 98.3 99.5 93.8

– 9.7↓90.3 1.5↓98.5 7.0↓92.2 9.5↓88.8 10.4↓89.1 8.8↓85.0

92.9 92.7↓0.2 93.2↑0.3 93.2↑0.3 92.1↓0.8 92.5↓0.4 91.8↓1.1

– 61.2 64.5 90.2 62.5 91.2 100.0

– 0.2↓61.0 0.5↓64.0 23.7↓66.5 1.0↓61.5 0.0↓91.2 15.3↓84.7

100.0 100.0= 99.7↓0.3 99.7↓0.3 100.0= 100.0= 99.5↓0.5

– 99.5↓0.5 99.8↓0.2 99.8↓0.2 98.5↓1.5 100.0= 99.8↓0.2

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 98.8 99.9 100.0 92.2

– 6.6↓93.4 5.8↓94.2 4.3↓94.5 6.2↓93.7 4.6↓95.4 2.3↓89.9

92.3 92.4↑0.1 92.2↓0.1 92.8↑0.5 91.6↓0.7 91.6↓0.7 91.5↓0.8

– 80.1 99.5 99.8 71.8 99.5 99.8

– 0.5↓79.6 0.8↓98.7 18.9↓80.9 2.3↓69.5 1.3↓98.2 13.8↓86.0

99.7 100.0↑0.3 100.0↑0.3 99.7= 96.6↓3.1 100.0↑0.3 100.0↑0.3

– 98.7↓1.0 99.0↓0.7 99.0↓0.7 97.7↓2.0 99.2↓0.5 99.0↓0.7

Dirty-label

Clean-label

Benign Dirty-label

Clean-label

Benign Dirty-label

Clean-label

5.3

SST-2 ASR CACC Before After Before After Gemma-2-9B-IT – – – 96.6 – 92.2↓1.1 100.0 1.4↓98.6 96.0↓0.6 96.1↓0.5 92.7↓0.6 100.0 1.9↓98.1 96.6= 94.5↓2.1 92.6↓0.7 100.0 1.9↓98.1 96.4↓0.2 94.8↓1.8 91.8↓1.5 100.0 2.9↓97.1 95.8↓0.8 94.7↓1.9 91.8↓1.5 96.7 0.9↓95.8 95.3↓1.3 94.6↓2.0 91.5↓1.8 92.1 1.9↓90.2 96.3↓0.3 94.2↓2.4 Llama-3.1-8B-Instruct – – – 96.0 – 90.4↓2.5 100.0 2.6↓97.4 95.9↓0.1 93.6↓2.4 91.5↓1.4 100.0 3.0↓97.0 95.9↓0.1 93.3↓2.7 92.0↓0.9 99.8 1.9↓97.9 96.0= 93.7↓2.3 90.3↓2.6 100.0 15.2↓84.8 95.9↓0.1 92.5↓3.5 90.4↓2.5 91.8 1.2↓90.6 93.1↓2.9 92.1↓3.9 89.4↓3.5 96.3 2.3↓94.0 94.4↓1.6 91.9↓4.1 Qwen2.5-7B-Instruct – – – 96.8 – 89.9↓2.4 100.0 8.9↓91.1 96.3↓0.5 95.5↓1.3 90.7↓1.6 100.0 4.9↓95.1 96.4↓0.4 95.3↓1.5 91.3↓1.0 99.8 3.5↓96.3 96.8= 95.5↓1.3 90.8↓1.5 100.0 2.8↓97.2 94.9↓1.9 95.2↓1.6 89.1↓3.2 96.3 3.5↓92.8 95.4↓1.4 95.0↓1.8 88.9↓3.4 100.0 3.7↓96.3 95.5↓1.3 95.0↓1.8

Main Results

Table 5 and Table 6 report the Base Clamp and CC Clamp results. Both variants substantially reduce ASR in most settings while preserving clean accuracy, showing that feature-level realignment effectively mitigates backdoor behaviors. 5.3.1

Clamp Effectiveness.

Base Clamp. Feature-level clamping consistently suppresses backdoor behavior across models, datasets, and attack settings. Even using only the pretrained base model as reference, Base Clamp substantially reduces ASR in nearly all configurations. On AG News and SST-2, postclamping ASR is generally reduced to below 10%, with only a few clean-label cases on Llama-3.18B-Instruct reaching at most 15%. On LLMLAT, Base Clamp also achieves large ASR reductions, especially against phrase-trigger attacks, although style-trigger attacks and several cleanlabel cases remain more challenging, with residual ASR reaching at most 28%. CACC is largely preserved across nearly all configurations. CC Clamp. Using a clean fine-tuned model as reference further strengthens the intervention. Across all configurations, CC Clamp reduces ASR to at most 15.4%, and in most cases to below 6%. The improvement is particularly pronounced on LLM-LAT: across all three architec-

tures, phrase-trigger attacks are almost completely neutralized, and rare-token attacks are reduced to near-zero ASR in most settings. CACC remains largely unchanged across nearly all configurations, often matching or slightly exceeding the original clean accuracy after intervention. Base Clamp vs. CC Clamp. CC Clamp achieves stronger mitigation than Base Clamp, but the gap is modest in most settings. As shown in Figure 2, ASR differences are concentrated near zero on AG News and SST-2, indicating that the pretrained base model already provides an effective reference for feature realignment. LLM-LAT shows larger variance, where a clean fine-tuned reference brings additional gains in some safetyalignment cases. For CACC, the differences are smaller, with most values close to zero across all datasets. Thus, while CC Clamp is preferable when a clean fine-tuned model is available, Base Clamp remains a practical alternative that requires only the publicly available pretrained base model.

5.3.2 Comparison with Existing Defenses To contextualize the effectiveness of feature-level clamping, we compare Base Clamp and CC Clamp with four representative defenses on Llama-3.18B-Instruct, with results on the other two model architectures provided in Appendix D. As shown in

Table 6: CC Clamp results across three models, three datasets, and six attack settings. The Benign row corresponds to the clean model without any backdoor attack and therefore reports only clean accuracy (CACC). Setting

Trigger

AG News ASR CACC Before After Before After

Benign

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 98.8 97.9 99.9 94.6

– 0.6↓99.4 0.7↓99.3 3.9↓94.9 1.7↓96.2 0.4↓99.5 0.7↓93.9

93.3 93.0↓0.3 93.5↑0.2 93.3= 92.2↓1.1 92.3↓1.0 92.5↓0.8

– 94.0↑0.7 93.8↑0.5 93.5↑0.2 92.6↓0.7 93.0↓0.3 93.7↑0.4

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 99.2 98.3 99.5 93.8

– 4.5↓95.5 2.1↓97.9 5.5↓93.7 6.2↓92.1 3.9↓95.6 1.9↓91.9

92.9 92.7↓0.2 93.2↑0.3 93.2↑0.3 92.1↓0.8 92.5↓0.4 91.8↓1.1

– 92.4↓0.5 93.0↑0.1 92.7↓0.2 93.0↑0.1 92.8↓0.1 92.8↓0.1

– Rare Phrase Style Rare Phrase Style

– 100.0 100.0 98.8 99.9 100.0 92.2

– 3.1↓96.9 2.2↓97.8 3.9↓94.9 2.1↓97.8 2.7↓97.3 1.8↓90.4

92.3 92.4↑0.1 92.2↓0.1 92.8↑0.5 91.6↓0.7 91.6↓0.7 91.5↓0.8

– 92.3= 92.6↑0.3 92.3= 91.5↓0.8 92.3= 92.1↓0.2

Clean-label

Benign Dirty-label

Clean-label

Benign Dirty-label

Clean-label

(a) Attack Success Rate

(b) Clean Accuracy

15 10 5 0

0 −2 −4

−5 −10

2

AG News

SST-2

Datasets

LLM-LAT

−6

No Defense

100

SST-2

Datasets

99.6

Figure 3, existing defenses exhibit clear paradigmspecific limitations: BEEAR and CRoW are effective under dirty-label attacks but fail to generalize to clean-label settings, whereas RepGuard shows the opposite trend, substantially reducing clean-label ASR while remaining largely ineffective against dirty-label attacks. DeCE provides moderate mitigation in both settings but still leaves relatively high residual ASR. By contrast, both Base Clamp and CC Clamp achieve consistently low ASR across the two attack paradigms. Base Clamp reduces the average ASR to at most 8.1% under dirty-label attacks and 9.6% under cleanlabel attacks, while CC Clamp further reduces it to at most 6.1% and 6.2%, respectively. This consistent performance suggests that feature-level clamping directly targets the SAE features mediating backdoor behavior, enabling unified mitigation across heterogeneous backdoor mechanisms.

– 73.8 98.2 99.5 82.4 98.2 100.0

– 9.1↓64.7 0.5↓97.7 10.8↓88.7 1.6↓80.8 1.5↓96.7 15.4↓84.6

100.0 100.0= 100.0= 100.0= 99.8↓0.2 100.0= 99.7↓0.3

– 100.0= 100.0= 100.0= 100.0= 100.0= 100.0=

– 61.2 64.5 90.2 62.5 91.2 100.0

– 0.0↓61.2 0.0↓64.5 7.8↓82.4 0.0↓62.5 0.0↓91.2 15.4↓84.6

100.0 100.0= 99.7↓0.3 99.7↓0.3 100.0= 100.0= 99.5↓0.5

– 99.8↓0.2 100.0= 100.0= 99.8↓0.2 100.0= 100.0=

– 80.1 99.5 99.8 71.8 99.5 99.8

– 0.2↓79.9 0.2↓99.3 9.1↓90.7 0.5↓71.3 0.5↓99.0 5.6↓94.2

99.7 100.0↑0.3 100.0↑0.3 99.7= 95.6↓4.1 100.0↑0.3 100.0↑0.3

– 99.5↓0.2 100.0↑0.3 99.8↑0.1 99.2↓0.5 99.8↑0.1 100.0↑0.3

BEEAR

93.6

CRoW 100.0

RepGuard

DeCE

Base Clamp

CC Clamp

93.5

92.3

78.5

60

58.1

56.0

49.5

40 20

15.1 14.4

No Defense

100

97.5

BEEAR

RepGuard

8.2

8.1

2.6

LLM-LAT DeCE

91.5 92.8

Base Clamp 90.7

CC Clamp

82.7 83.3

65.6

63.1

54.1 26.7

20 0

CRoW 96.3

60 40

2.5 4.0

SST-2

90.4 90.6

80

12.8

9.3 9.7

6.1 4.0

AG News

LLM-LAT

Figure 2: Results of ∆ASR and ∆CACC between Base Clamp and CC Clamp.

CACC Before After

80

0 AG News

LLM-LAT ASR Before After

Llama-3.1-8B-Instruct Dirty Avg. ASR

4

20

ΔCACC (%)

ΔASR Reduction (%)

25

Clean Avg. ASR

Dirty-label

SST-2 ASR CACC Before After Before After Gemma-2-9B-IT – – 96.6 – 100.0 0.9↓99.1 96.0↓0.6 96.7↑0.1 100.0 0.9↓99.1 96.6= 96.6= 100.0 2.6↓97.4 96.4↓0.2 96.7↑0.1 100.0 1.0↓99.0 95.8↓0.8 96.4↓0.2 96.7 0.9↓95.8 95.3↓1.3 96.8↑0.2 92.1 2.6↓89.5 96.3↓0.3 96.7↑0.1 Llama-3.1-8B-Instruct – – 96.0 – 100.0 4.9↓95.1 95.9↓0.1 96.3↑0.3 100.0 3.7↓96.3 95.9↓0.1 96.1↑0.1 99.8 3.3↓96.5 96.0= 96.2↑0.2 100.0 11.9↓88.1 95.9↓0.1 96.2↑0.2 91.8 3.0↓88.8 93.1↓2.9 96.4↑0.4 96.3 3.5↓92.8 94.4↓1.6 96.1↑0.1 Qwen2.5-7B-Instruct – – 96.8 – 100.0 4.6↓95.4 96.3↓0.5 96.9↑0.1 100.0 6.1↓93.9 96.4↓0.4 96.9↑0.1 99.8 5.4↓94.4 96.8= 96.9↑0.1 100.0 4.7↓95.3 94.9↓1.9 96.3↓0.5 96.3 4.4↓91.9 95.4↓1.4 96.4↓0.4 100.0 5.4↓94.6 95.5↓1.3 96.7↓0.1

26.2 9.6

6.2 6.1

4.0

AG News

23.3

SST-2

Datasets

5.4 5.1

LLM-LAT

Figure 3: Results of Avg. ASR comparison between baselines and clamping on Llama-3.1-8B-Instruct.

6 Conclusion In this work, we present the first systematic feature-level mechanistic analysis of LLM backdoors using sparse autoencoders. By tracing backdoor-induced logit shifts to high-contributing SAE features, we identify four functional feature roles and reveal systematic encoding differences between dirty-label and clean-label attacks. These differences provide a mechanistic explanation for why existing defenses remain fragmented across attack paradigms. Inference-time feature clamping further validates the causal role of these features and demonstrates their potential for interpretable backdoor mitigation while largely preserving benign performance.

Limitations Datasets and Settings. Although our experiments cover multiple model families, datasets, trigger types, and both dirty-label and clean-label attacks, they still represent a finite subset of possible backdoor scenarios. In particular, our evaluation focuses on controlled classification-style settings and a limited set of backdoor objectives. Future work could examine whether the observed feature-level mechanisms generalize to larger-scale models, open-ended generation tasks, multi-trigger attacks, and more adaptive poisoning strategies. Potential Risks. By exposing feature-level mechanisms underlying backdoor activation, our analysis could also provide insights that help adaptive attackers design more evasive backdoors. For example, attackers may try to distribute backdoor behavior across less salient features or make it more entangled with benign functionality. We therefore view SAE-based analysis as a tool that should be used carefully, with emphasis on diagnosis, auditing, and mitigation rather than attack optimization. Defense Scope. Our inference-time feature clamping experiments are primarily designed to validate the causal role of identified SAE features, rather than to serve as a fully optimized deployment-time defense. The current procedure still requires feature selection and calibration, and its efficiency may depend on the SAE size and intervention layer. Building more automated, lightweight, and robust SAE-based defenses is an important direction for future work.

Acknowledgments This work was supported by the Beijing High Innovation Plan (No. 202504841069). The authors gratefully acknowledge the financial support provided by this program. We also wish to express our sincere gratitude to all the anonymous reviewers for their valuable comments and constructive suggestions, which have significantly improved the quality of this paper.

References Andy Arditi, Oscar Balcells Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. In The Thirty-eighth An-

nual Conference on Neural Information Processing Systems. Yannick Assogba, Jacopo Cortellazzi, Javier Abad, Pau Rodriguez, Xavier Suau, and Arno Blaas. 2026. Sparse autoencoders are capable llm jailbreak mitigators. arXiv preprint arXiv:2602.12418. Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. 2018. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728. Jianhui Chen, Xiaozhi Wang, Zijun Yao, Yushi Bai, Lei Hou, and Juanzi Li. 2026. Towards understanding safety alignment: A mechanistic perspective from safety neurons. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. Weixin Chen, Baoyuan Wu, and Haoqian Wang. 2022. Effective backdoor defense by exploiting sensitivity of poisoned samples. Advances in Neural Information Processing Systems, 35:9727–9737. Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Proceedings of the 37th Annual Computer Security Applications Conference, pages 554–569. Seonglae Cho, Zekun Wu, and Adriano Koshiyama. 2026. Corrsteer: Generation-time LLM steering via correlated sparse autoencoder features. Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. 2023. Sparse autoencoders find highly interpretable features in language models. arXiv preprint arXiv:2309.08600. Wei Du, Peixuan Li, Haodong Zhao, Tianjie Ju, Ge Ren, and Gongshen Liu. 2024. Uor: Universal backdoor attacks on pre-trained language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 7865–7877. Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, Roger Grosse, Sam McCandlish, Jared Kaplan, Dario Amodei, Martin Wattenberg, and Christopher Olah. 2022. Toy models of superposition. arXiv preprint arXiv:2209.10652. Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2022. Triggerless backdoor attack for nlp tasks with clean labels. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2942–2952.

Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. 2019. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th annual computer security applications conference, pages 113–125. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad AlDahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733. Zeqing He, Zhibo Wang, Zhixuan Chu, Huiyu Xu, Wenhui Zhang, Qinglong Wang, and Rui Zheng. 2024. Jailbreaklens: Interpreting jailbreak mechanism in the lens of representation and circuit. arXiv preprint arXiv:2411.11114. Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M Ziegler, Tim Maxwell, Newton Cheng, and 1 others. 2024. Sleeper agents: Training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566. Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pretrained models. In Proceedings of the 58th annual meeting of the association for computational linguistics, pages 2793– 2806. Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. 2026. Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models. Advances in neural information processing systems, 38. Nay Myat Min, Long H. Pham, Yige Li, and Jun Sun. 2025. CROW: Eliminating backdoors from large language models via internal consistency regularization. In Forty-second International Conference on Machine Learning. Chenxu Niu, Jie Zhang, Yanbing Liu, Yunpeng Li, Jinta Weng, and Yue Hu. 2026. Repguard: Adaptive feature decoupling for robust backdoor defense in large language models. Advances in Neural Information Processing Systems, 38:44851–44872. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a. Onion: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 conference on empirical methods in natural language processing, pages 9558–9566. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021b. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of the

59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pages 443–453. Abhay Sheshadri, Aidan Ewart, Phillip Guo, Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan HadfieldMenell, and Stephen Casper. 2024. Targeted latent adversarial training improves robustness to persistent harmful behaviors in llms. arXiv preprint arXiv:2407.15549. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631–1642. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. Terry Tong, Fei Wang, Zhe Zhao, and Muhao Chen. 2025. Badjudge: Backdoor vulnerabilities of LLMas-a-judge. In The Thirteenth International Conference on Learning Representations. Anyi Wang, Xuansheng Wu, Dong Shu, Yunpu Ma, and Ninghao Liu. 2025a. Enhancing llm steering through sparse autoencoder-based vector refinement. arXiv preprint arXiv:2509.23799. Dianyun Wang, Qingsen Ma, Yuhu Shang, Zhifeng Lu, Zhenbo Xu, Lechen Ning, Huijia Wu, and Zhaofeng He. 2025b. Interpretable safety alignment via saeconstructed low-rank subspace adaptation. arXiv preprint arXiv:2512.23260. Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pages 6065–6086. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, and 1 others. 2024. Qwen2.5 technical report. arXiv preprint arXiv:2412.15115. Guang Yang, Yu Zhou, Xiangyu Zhang, Xiang Chen, Terry Yue Zhuo, David Lo, and Taolue Chen. 2026. Defending code language models against backdoor attacks with deceptive cross-entropy loss. ACM Transactions on Software Engineering and Methodology, 35(2):1–27.

Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 8365–8381. Biao Yi, Sishuo Chen, Yiming Li, Tong Li, Baolei Zhang, and Zheli Liu. 2024. Badacts: A universal backdoor defense in the activation space. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5339–5352. Jia-Li Yin, Weijian Wang, Lyhwa , Wei Lin, and Ximeng Liu. 2025. Adversarial-inspired backdoor defense via bridging backdoor and adversarial attacks. Proceedings of the AAAI Conference on Artificial Intelligence, 39(9):95089516. Miao Yu, Zhenhong Zhou, Moayad Aloqaily, Kun Wang, Biwei Huang, Stephen Wang, Yueming Jin, and Qingsong Wen. 2025. Backdoor attribution: Elucidating and controlling backdoor in language models. arXiv preprint arXiv:2509.21761. Yi Zeng, Weiyu Sun, Tran Huynh, Dawn Song, Bo Li, and Ruoxi Jia. 2024. Beear: Embedding-based adversarial removal of safety backdoors in instructiontuned language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 13189–13215. Yizhe Zeng, Wei Zhang, Yunpeng Li, Juxin Xiao, Xiao Wang, and Yuling Liu. 2026. Miragebackdoor: A stealthy attack that induces think-well-answerwrong reasoning. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8639– 8659. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28. Xingyi Zhao, Depeng Xu, and Shuhan Yuan. 2024. Defense against backdoor attack on pre-trained language models via head pruning and attention normalization. In Forty-first International Conference on Machine Learning. Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, Kun Wang, Yang Liu, Junfeng Fang, and Yongbin Li. 2025. On the role of attention heads in large language model safety. In International Conference on Learning Representations, volume 2025, pages 84042–84071.

A

Details of ASR and CACC Metrics

B

Full Results of Defense Fragmentation

Results on Qwen2.5-7B-Instruct. Table 7 reports the full cross-evaluation results on Qwen2.5We evaluate backdoor effectiveness and benign 7B-Instruct. The results show the same asymmetutility using two standard metrics: Attack Sucric pattern as observed on Llama-3.1-8B-Instruct. cess Rate (ASR) and Clean Accuracy (CACC). Let BEEAR and CRoW effectively mitigate dirtyF denote a clean model and F ′ denote the correlabel backdoors, reducing the average ASR to sponding backdoored model. For a clean input x, 10.6% and 10.1%, respectively, across datasets let τ (x) denote the triggered input obtained by inand triggers. However, they remain much less efserting a predefined trigger into x. Let y atk (x) be fective under clean-label attacks, where the averthe attacker-specified target output for x. age ASR stays high at 84.7% and 85.2%. RepAttack Success Rate. ASR measures how of- Guard exhibits the opposite behavior: it reduces ten the backdoored model produces the attacker- clean-label ASR to 22.4% on average, but leaves specified output on triggered inputs. Given a trig- dirty-label attacks largely unaffected, with an average ASR of 84.8%. DeCE provides more balanced gered evaluation distribution Dtrig , ASR is defined mitigation across the two paradigms, but its reas h  i maining ASR is still substantially higher than the ASR(F ′ ) = Ex∼Dtrig 1 F ′ (τ (x)) = y atk (x) , best paradigm-specific defenses, averaging 51.8% (5) under dirty-label attacks and 57.5% under cleanwhere 1(·) is the indicator function. For a finite label attacks. These results indicate that even on triggered test set Ttest , we compute the empirical Qwen2.5-7B-Instruct, where defenses are generASR as ally more effective, no method achieves consistent  X  1 protection across both dirty-label and clean-label ′ ′ atk [ ASR(F )= 1 F (τ (x)) = y (x) . |Ttest | backdoors. x∈Ttest (6) Results on Gemma-2-9B-IT. Table 8 reports the corresponding results on Gemma-2-9B-IT. Clean Accuracy. CACC measures whether the backdoored model preserves its normal task per- The same fragmentation pattern persists. BEEAR and CRoW strongly suppress dirty-label attacks, formance on clean inputs. Let Dclean denote reducing the average ASR to 13.9% and 13.3%, rethe clean test distribution, where each example is paired with its ground-truth label or answer y. spectively, but they fail to generalize to clean-label attacks, where the average ASR remains 87.0% CACC is defined as 
 and 87.6%. In contrast, RepGuard substantially reCACC(F ′ ) = E(x,y)∼Dclean 1 F ′ (x) = y . duces clean-label ASR to 26.8% on average, while (7) dirty-label ASR remains high at 87.4%. DeCE Given a finite clean test set Dtest , the empirical again provides moderate but incomplete mitigaestimate is tion under both settings, with average ASR of X
1 56.4% for dirty-label attacks and 60.6% for clean\ ′) = CACC(F 1 F ′ (x) = y . |Dtest | label attacks. (x,y)∈Dtest Together with the Llama results, these results (8) Intuitively, ASR reflects the strength of the im- confirm that defense fragmentation is not specific to a single model family. Existing defenses replanted backdoor under trigger activation, while main strongly tied to paradigm-specific assumpCACC reflects the stealthiness of the attack by measuring whether the model retains normal per- tions, showing strong performance only when the attack mechanism matches the defense design. formance on benign inputs.

In this section, we report the detailed crossevaluation results on Qwen2.5-7B-Instruct and Gemma-2-9B-IT. These results complement the Llama-3.1-8B-Instruct results in Table 1 and provide a broader view of defense fragmentation across different model families.

C Experimental Setup Details For our experimental setup, we consider three widely used open-source instruction-tuned LLMs as attack targets: Gemma-2-9B-IT, Llama-3.18B-Instruct, and Qwen2.5-7B-Instruct. We evaluate these models on three representative datasets, including AG News, SST-2, and LLM-LAT,

Dataset

Defense

Dirty-label ASR (%)

Clean-label ASR (%)

Rare

Phrase

Style

Rare

Phrase

Style

No Defense BEEAR CRoW RepGuard DeCE

100 7.4 8.9 88.6 48.6

100 10.2 11.4 91.0 52.7

98.8 15.8 14.6 94.5 57.9

97.9 86.5 85.8 18.7 54.1

99.9 88.7 88.1 23.4 58.6

94.6 90.9 91.0 29.8 63.7

No Defense BEEAR CRoW RepGuard DeCE

100 4.9 5.8 89.8 50.7

100 7.8 8.2 91.7 54.3

100 12.6 13.1 93.4 58.6

100 88.9 89.4 15.9 57.5

96.7 91.0 90.8 21.8 62.1

92.1 89.8 92.5 27.6 65.8

No Defense BEEAR CRoW RepGuard DeCE

82.4 8.6 6.4 73.8 41.5

98.2 11.9 9.5 77.9 47.9

100 16.5 12.8 82.6 53.6

74.3 61.7 63.1 15.8 44.8

98.2 85.6 86.4 21.7 52.6

99.5 89.2 90.0 26.9 58.7

Qwen2.5-7B-Instruct Dirty Avg. ASR

Table 7: Cross-evaluation results of existing defenses on Qwen2.5-7B-Instruct.

No Defense

100

99.6

SST-2

LLM-LAT

Clean Avg. ASR

91.4

CRoW 100.0

RepGuard

DeCE

Base Clamp

CC Clamp

93.5

91.6

78.1

80 60

54.5

53.1

47.7

40 20

11.1 11.6

0

AG News

BEEAR

No Defense

100

8.4 9.0

5.6 3.1

AG News

97.5

12.3 9.6

5.8 5.4

SST-2 BEEAR

CRoW 96.3

88.7 88.3

RepGuard

DeCE

89.9 90.9

Base Clamp 78.8 79.8

61.8

58.8

60

52.0

24.0

20

21.8

21.5 5.8 2.2

3.3 4.8

4.4 2.2

0

CC Clamp

90.7

80 40

6.7 3.2

LLM-LAT

AG News

SST-2

LLM-LAT

Datasets

Figure 4: Results of Avg. ASR comparison between baselines and clamping on Qwen2.5-7B-Instruct.

Dirty-label ASR (%)

Clean-label ASR (%)

Rare

Phrase

Style

Rare

Phrase

Style

100 10.6 12.1 91.7 54.2

100 13.5 14.3 93.4 57.1

98.8 19.7 18.2 95.6 61.5

97.9 89.4 88.6 23.5 59.0

99.9 91.2 90.9 27.8 62.4

94.6 92.8 93.5 33.1 66.2

No Defense BEEAR CRoW RepGuard DeCE

100 7.8 8.6 92.8 55.8

100 10.5 11.7 93.9 58.9

100 15.9 16.4 95.1 62.7

100 91.4 92.1 20.7 61.6

96.7 90.6 93.4 25.9 65.0

92.1 92.7 94.0 31.8 67.1

No Defense BEEAR CRoW RepGuard DeCE

82.4 12.4 9.8 77.2 46.7

98.2 15.2 12.6 81.5 52.9

100 19.1 15.9 85.0 57.8

74.3 66.8 67.5 20.6 48.9

98.2 88.4 89.2 26.4 56.4

99.5 91.7 92.8 31.2 61.5

Dataset

Defense

AG News

No Defense BEEAR CRoW RepGuard DeCE

SST-2

LLM-LAT

covering both standard classification and safetyrelated tasks. To assess the generality of our analysis, we consider both dirty-label and cleanlabel backdoor settings with diverse trigger types, including rare-token, phrase-based, and stylebased triggers. All training runs are conducted on a cluster with 4× NVIDIA A800 GPUs, each with 80 GB of memory. We fine-tune the models using LoRA with rank 16 and alpha 16, using a learning rate of 1 × 10−4 , batch size 32, FP32 precision, and 4 epochs. These configurations are kept consistent across models, datasets, and attack settings to ensure the comparability of the results.

D

Full Results of Comparison with Existing Defenses

We provide the full comparison results on Qwen2.5-7B-Instruct and Gemma-2-9B-IT in Figure 4 and Figure 5. The results show patterns consistent with those observed on Llama-3.1-8B-

100

BEEAR

93.6

CRoW 100.0

RepGuard

DeCE

93.9

Base Clamp

CC Clamp

93.5 81.2

80 59.1

57.6

60

52.5

40 20

14.6 14.9

97.5

SST-2 BEEAR

CRoW 96.3

91.1 91.0

RepGuard

40

Base Clamp

CC Clamp

82.3 83.2

64.6 55.6

26.1 2.2 0.9

AG News

DeCE

90.7

62.5

28.1

20 0

LLM-LAT

91.6 93.2

80 60

8.2 6.8

1.7 1.5

AG News No Defense

100

15.6 12.8

11.4 12.2 2.5 1.7

0

Clean Avg. ASR

Table 8: Cross-evaluation results of existing defenses on Gemma-2-9B-IT.

Dirty Avg. ASR

Gemma-2-9B-IT No Defense 99.6

26.1

SST-2

Datasets

24.9 6.2

1.9 1.5

LLM-LAT

Figure 5: Results of Avg. ASR comparison between baselines and clamping on Gemma-2-9B-In.

Instruct. On Qwen2.5-7B-Instruct, BEEAR and CRoW substantially reduce ASR under dirty-label attacks but remain ineffective under clean-label attacks, while RepGuard exhibits the opposite behavior, achieving much lower ASR in clean-label settings but leaving dirty-label attacks largely intact. DeCE provides moderate mitigation across both paradigms, yet still results in relatively high residual ASR. In contrast, Base Clamp reduces the average ASR to 5.6–6.7% under dirty-label attacks and 3.3–5.8% under clean-label attacks, while CC Clamp further reduces it to 3.1–5.4% and 2.2– 4.8%, respectively. A similar trend is observed on Gemma-2-9BIT. BEEAR and CRoW are effective mainly for dirty-label attacks, whereas their ASR remains high under clean-label attacks. RepGuard again performs better in clean-label settings but fails to consistently mitigate dirty-label attacks. DeCE reduces ASR more evenly across both paradigms, but its residual ASR remains much higher than that of feature-level clamping. By comparison, Base Clamp achieves 1.7–8.2% ASR under dirty-

label attacks and 1.9–24.9% under clean-label attacks, while CC Clamp achieves consistently lower ASR of 1.5–6.8% and 0.9–6.2%, respectively. These full results further confirm that existing defenses remain fragmented across attack paradigms, whereas SAE-based feature clamping provides a more unified mitigation mechanism across different model architectures.

E

Suspicious Feature Selection

This section provides the details of the suspicious feature selection procedure used in § 5.2. Unlike the feature attribution procedure in § 4.2.1, which selects features according to their logitlevel contribution to a known backdoor behavior, the clamping-stage selection does not assume knowledge of the trigger, target label, or attack paradigm. Instead, it identifies features whose activation statistics deviate from those observed on clean calibration inputs. Let Dcal denote a small clean calibration set and Dsus denote the inputs to be protected. For each input x, we pass it through the model and encode the residual activation at the selected layer into SAE feature activations: z(x) = Enc(r(x)),

(9)

where zi (x) denotes the activation of SAE feature i. For each feature i, we compute its average activation on the clean calibration set and on the suspicious inputs: X 1 zi (x), (10) µcal i = |Dcal | x∈Dcal X 1 µsus = zi (x). (11) i |Dsus | x∈Dsus

We then score each feature by a normalized activation shift: si =

cal µsus i − µi , σical + ϵ

(12)

where σical is the standard deviation of feature i on the clean calibration set, and ϵ is a small constant for numerical stability. Features with larger si exhibit stronger deviations from normal clean behavior and are therefore more likely to participate in backdoor activation. We rank all SAE features by si and select the top-k features as the suspicious feature set: Sk = TopKi (si ).

(13)

Table 9: Distribution of backdoor feature types among top-attributed features on Gemma/SST-2. Dirty-label

Feature Type

Clean-label

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

33 21 5 1

31 20 7 2

27 23 7 3

10 20 27 3

15 16 26 3

16 14 25 5

Table 10: Distribution of backdoor feature types among top-attributed features on Gemma/LLM-LAT. Dirty-label

Feature Type

Clean-label

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

33 14 10 3

28 9 12 11

22 20 13 5

1 15 25 19

8 12 27 13

10 8 29 13

Given a poisoned-model feature activation z p and a reference activation z ref , clamping replaces only the selected suspicious features: ( ziref , i ∈ Sk , ′ zi = (14) zip , i∈ / Sk . The intervened representation is then decoded back into the residual stream. In practice, we preserve the original SAE reconstruction residual to avoid introducing unrelated changes: r′ = Dec(z ′ ) + (rp − Dec(z p )) .

(15)

This procedure selects intervention targets using only activation-level distributional deviations, rather than trigger-specific or label-specific information. Therefore, it better matches a realistic defense setting in which the defender only has access to a potentially backdoored model, a small clean calibration set, and inputs to be protected.

F Full Results of Feature-Level Roles This appendix provides the complete feature-type classification results across all model, dataset, trigger, and attack-paradigm settings. For each setting, we select the top-attributed SAE features according to their contributions to the backdoorrelated logit shift and classify them into four categories based on their activation profiles under the clean/poisoned model and clean/triggered input conditions: I NTERACTION, S UPPRESSED, M IXED, and W EIGHT- MODIFIED. The results

Table 11: Distribution of backdoor feature types among top-attributed features on Gemma/AGNews. Dirty-label

Feature Type

Clean-label

Table 13: Distribution of backdoor feature types among top-attributed features on Llama/LLM-LAT.

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

35 14 10 1

27 19 9 5

29 9 13 9

10 6 26 18

12 14 25 9

16 13 23 8

Table 12: Distribution of backdoor feature types among top-attributed features on Llama/SST-2. Dirty-label

Feature Type

Clean-label

28 14 10 8

25 11 13 1

29 5 16 10

10 8 28 14

14 11 31 6

Interaction Suppressed Mixed Weight-mod.

32 17 4 7

cover three model families, including Gemma-29B-IT, Llama-3.1-8B-Instruct, and Qwen2.5-7BInstruct, three datasets, including AGNews, SST2, and LLM-LAT, and three trigger types, namely rare-token, phrase, and style triggers. Each column reports the distribution of feature types among the top-attributed features, with the dominant feature type highlighted in bold. Overall Pattern. Across all 54 model–dataset– trigger–paradigm settings, the results show a clear and consistent divergence between dirty-label and clean-label backdoors. For dirty-label attacks, I N TERACTION is the dominant feature type in all 27 settings. Aggregated over all dirty-label columns, I NTERACTION features account for 756 feature instances, corresponding to 47.0% of all classified top-attributed features. This is substantially higher than S UPPRESSED features (410, 25.5%), M IXED features (311, 19.3%), and W EIGHTMODIFIED features (133, 8.3%). In contrast, for clean-label attacks, M IXED is the dominant feature type in all 27 settings. Aggregated over all clean-label columns, M IXED features account for 746 feature instances, or 45.9% of all classified top-attributed features, compared with 340 S UP PRESSED features (20.9%), 338 I NTERACTION features (20.8%), and 200 W EIGHT- MODIFIED features (12.3%). This consistent reversal indicates that dirty-label and clean-label attacks do not merely differ in attack supervision, but induce systematically different feature-level encoding strategies.

30 9 11 10

27 14 7 12

8 8 31 12

10 7 26 17

11 12 27 10

Table 14: Distribution of backdoor feature types among top-attributed features on Llama/AGNews. Clean-label

Dirty-label

Feature Type 11 9 35 5

Clean-label

rare phrase style rare phrase style

rare phrase style rare phrase style

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

Dirty-label

Feature Type

Interaction Suppressed Mixed Weight-mod.

33 12 12 3

27 16 10 7

27 15 17 1

19 15 26 0

15 9 31 5

7 11 38 4

Results on Gemma. Table 11, Table 9, and Table 10 report the results on Gemma across AGNews, SST-2, and LLM-LAT. For dirty-label attacks, I NTERACTION features dominate in every dataset and trigger type, contributing 265 out of 540 feature instances in total (49.1%). The dominance is stable across datasets: I NTERACTION features account for 91/180 instances on AGNews, 91/180 on SST-2, and 83/180 on LLM-LAT. By contrast, S UPPRESSED, M IXED, and W EIGHTMODIFIED features account for 149 (27.6%), 86 (15.9%), and 40 (7.4%) instances, respectively. For clean-label attacks on Gemma, the dominant category shifts from I NTERACTION to M IXED. Overall, M IXED features account for 233 out of 540 feature instances (43.1%), exceeding S UPPRESSED features (118, 21.9%), I N TERACTION features (98, 18.1%), and W EIGHTMODIFIED features (91, 16.9%). This shift is visible on all three datasets, where clean-label M IXED features contribute 74/180 instances on AGNews, 78/180 on SST-2, and 81/180 on LLMLAT. Notably, Gemma also exhibits a relatively large number of W EIGHT- MODIFIED features under clean-label attacks, especially on AGNews and LLM-LAT, suggesting that clean-label backdoors in Gemma partly modify the model’s baseline feature activations even without direct trigger–weight interaction. Results on Llama. Table 14, Table 12, and Table 13 provide the corresponding results on Llama. The dirty-label pattern is again dominated by I N -

Table 15: Distribution of backdoor feature types among top-attributed features on Qwen/SST-2. Dirty-label

Feature Type

Clean-label

Table 17: Distribution of backdoor feature types among top-attributed features on Qwen/AGNews.

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

24 16 17 3

22 17 15 6

24 19 13 4

13 20 23 7

13 17 28 2

16 16 27 1

Table 16: Distribution of backdoor feature types among top-attributed features on Qwen/LLM-LAT. Clean-label

Dirty-label

Feature Type

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

30 12 10 8

24 15 16 5

24 20 11 5

10 15 25 10

17 12 24 7

Dirty-label

Feature Type

18 10 25 7

TERACTION features in all settings.

Across all dirty-label Llama columns, I NTERACTION features account for 258 out of 530 feature instances (48.7%), compared with 113 S UPPRESSED features (21.3%), 100 M IXED features (18.9%), and 59 W EIGHT- MODIFIED features (11.1%). At the dataset level, I NTERACTION features contribute 87/180 instances on AGNews, 82/170 on SST-2, and 89/180 on LLM-LAT, showing that the interaction-dominated pattern persists across tasks. For clean-label attacks, Llama shows the strongest M IXED-feature dominance among the three model families. Aggregated over all cleanlabel Llama settings, M IXED features account for 273 out of 541 feature instances (50.5%), exceeding half of all classified top-attributed features. The remaining categories are much smaller: I N TERACTION contributes 105 instances (19.4%), S UPPRESSED contributes 90 instances (16.6%), and W EIGHT- MODIFIED contributes 73 instances (13.5%). This pattern is especially clear on AGNews and SST-2, where clean-label M IXED features account for 95/180 and 94/182 instances, respectively. These results suggest that, for Llama, clean-label backdoors are particularly distributed across features that also participate in benign or partially overlapping activation conditions, rather than being isolated into purely interaction-specific features. Results on Qwen. Table 17, Table 15, and Table 16 further extend the analysis to Qwen. For

Clean-label

rare phrase style rare phrase style Interaction Suppressed Mixed Weight-mod.

30 15 15 0

26 19 14 1

29 15 14 2

17 13 29 1

15 19 26 0

16 10 33 1

dirty-label attacks, I NTERACTION remains the dominant type in all nine Qwen dirty-label settings. In total, Qwen has 233 I NTERACTION features out of 540 dirty-label feature instances (43.1%). Although this proportion is slightly lower than that of Gemma and Llama, it is still clearly larger than the other categories, including S UPPRESSED features (148, 27.4%), M IXED features (125, 23.1%), and W EIGHT- MODIFIED features (34, 6.3%). The dataset-level counts also support the same trend: I NTERACTION features contribute 85/180 instances on AGNews, 70/180 on SST-2, and 78/180 on LLM-LAT. For clean-label attacks on Qwen, M IXED features again dominate. Across all clean-label Qwen settings, M IXED features account for 240 out of 543 feature instances (44.2%), followed by I NTER ACTION features (135, 24.9%), S UPPRESSED features (132, 24.3%), and W EIGHT- MODIFIED features (36, 6.6%). The clean-label M IXED counts are 88/180 on AGNews, 78/183 on SST-2, and 74/180 on LLM-LAT. Compared with Gemma, Qwen has fewer clean-label W EIGHT- MODIFIED features, indicating that its clean-label backdoors are mainly reflected in mixed activation profiles rather than broad weight-induced shifts. Dataset-Level Comparison. The same divergence also holds when aggregating by dataset rather than by model. On AGNews, dirty-label attacks contain 263 I NTERACTION features out of 540 feature instances (48.7%), whereas cleanlabel attacks contain 257 M IXED features out of 540 instances (47.6%). On SST-2, dirty-label attacks contain 243 I NTERACTION features out of 530 instances (45.8%), while clean-label attacks contain 250 M IXED features out of 545 instances (45.9%). On LLM-LAT, dirty-label attacks contain 250 I NTERACTION features out of 540 instances (46.3%), while clean-label attacks contain 239 M IXED features out of 539 instances (44.3%). Thus, the dirty–clean divergence is not driven by a

single dataset: it appears consistently across news classification, sentiment classification, and safetyrelated instruction settings. Implications. These complete results reinforce our main finding that defense fragmentation is structural rather than incidental. Dirty-label attacks concentrate backdoor behavior in I NTERAC TION features, which are activated primarily when the trigger is processed by poisoned weights. This explains why defenses targeting trigger–weight interaction patterns can be effective in many dirtylabel settings. Clean-label attacks, however, are dominated by M IXED features and, in some models such as Gemma, also include a non-negligible fraction of W EIGHT- MODIFIED features. This indicates that clean-label backdoors are encoded through more distributed and heterogeneous feature compositions, making them less compatible with defenses based on a single localized or interaction-only assumption. Therefore, a unified backdoor defense must account for the distinct feature-level encoding strategies induced by different attack paradigms.

G

Impact of SAE Configurations

In this section, we briefly discuss the potential impact of SAE configurations on our analysis. Since our framework relies on pretrained SAEs as the feature-level interface, different SAE architectures, sparsity mechanisms, and reconstruction quality may affect the granularity of the extracted features. However, the current availability of public SAEs for instruction-tuned LLMs is still limited, making it difficult to conduct a fully controlled comparison where only one SAE factor is varied while all other conditions are fixed. SAE architecture. Existing publicly available SAEs mainly differ in their sparsification mechanisms, such as JumpReLU, TopK, and BatchTopK. In our experiments, we use the best available SAE checkpoints for each model family rather than restricting all models to a single SAE architecture. Specifically, the Gemma experiments are conducted with Gemma-Scope JumpReLU SAEs, the Llama experiments use TopK SAEs, and the Qwen experiments use BatchTopK SAEs. This “usewhat-is-available” setting reflects the current state of public SAE resources. Importantly, our main observations are consistent across these model families and SAE architectures: dirty-label at-

tacks tend to rely more on I NTERACTION features, whereas clean-label attacks exhibit a larger proportion of M IXED features. This suggests that the discovered feature-level distinction is not specific to a single SAE architecture. Reconstruction quality. Another possible factor is SAE reconstruction error. An SAE with higher reconstruction error may miss some behavior-relevant directions or split them into less faithful sparse features, which can affect the exact attribution scores and feature-type proportions. Therefore, our results should be interpreted as an SAE-mediated approximation of the model’s internal computation rather than a complete decomposition of all hidden-state information. Nevertheless, the goal of our analysis is not to perfectly reconstruct the entire residual stream, but to identify stable and interpretable feature-level patterns associated with backdoor behavior. Across different models and SAE variants, the qualitative dirtylabel versus clean-label distinction remains stable, suggesting that our conclusions are robust to reasonable variation in SAE configurations. Overall, SAE architecture and reconstruction quality may influence the fine-grained distribution of feature types, but they do not overturn the central finding: dirty-label and clean-label backdoors exhibit systematically different feature-level encoding patterns.

H Parameter Sensitivity Experiment Overview. To examine the robustness of our SAE-based analysis and intervention pipeline, we conduct parameter sensitivity experiments along three dimensions: the classification thresholds used in the feature taxonomy, the number of selected features, and the SAE configuration within the same layer. Unless otherwise specified, all experiments follow the main setting in Appendix C. H.1 Sensitivity to Feature-Type Classification Thresholds To examine whether our feature taxonomy depends on a specific threshold choice, we vary the ratio threshold γ and the activation floor ϵ0 used for feature-type classification. Table 18, Table 19, and Table 20 report the results on Gemma, Llama, and Qwen, respectively. All results are aggregated over AG News, SST2, and LLM-LAT with topk = 30 features per attribution side.

Table 18: Sensitivity to γ and ϵ0 on Gemma under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT with top-k = 30 features per attribution side. Values denote the percentage(%) of each feature type. γ

ϵ0

1.5 1.5 1.5 1.5 1.5 1.5 1.5 1.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

46.1 26.1 46.1 26.1 46.1 26.1 45.4 24.6

25.7 28.2 25.7 25.2 25.7 28.2 27.2 29.7

20.0 35.5 20.0 38.5 20.0 35.5 18.9 35.3

8.1 10.2 8.1 10.2 8.1 10.2 8.5 10.4

2.0 2.0 2.0 2.0 2.0 2.0 2.0 2.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

38.5 28.5 38.5 28.5 49.1 18.1 37.6 27.8

25.7 20.2 25.7 20.2 27.6 21.9 27.2 21.7

25.9 38.9 25.9 38.9 15.9 43.1 25.0 38.0

9.8 12.4 9.8 12.4 7.4 16.9 10.2 12.6

2.5 2.5 2.5 2.5 2.5 2.5 2.5 2.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

37.3 25.7 37.3 25.7 37.1 25.4 35.2 24.6

25.7 30.2 25.7 28.2 25.7 28.2 27.0 28.6

27.0 32.4 27.0 34.4 27.0 34.8 26.6 34.9

10.0 11.7 10.0 11.7 10.2 11.7 11.1 11.9

3.0 3.0 3.0 3.0 3.0 3.0 3.0 3.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

36.5 23.5 36.5 23.5 36.3 23.0 35.0 22.2

25.7 28.2 25.7 30.2 25.7 30.2 27.0 28.7

26.3 36.6 26.3 34.6 26.5 34.8 27.4 37.3

11.5 11.7 11.5 11.7 11.5 12.0 10.6 11.9

Paradigm I NTERACTION S UPPRESSED M IXED W EIGHT- MODIFIED

Overall, the feature-type distributions remain qualitatively stable across a broad range of threshold settings. For dirty-label attacks, I NTERAC TION features consistently occupy a substantial proportion of the selected features, indicating that the backdoor behavior is mainly captured by features activated under the joint trigger–poisonedweight condition. For clean-label attacks, the distribution is consistently more shifted toward M IXED features, suggesting that clean-label backdoors rely on more heterogeneous feature compositions rather than isolated interaction features. Although changing γ and ϵ0 affects the exact percentages, the main contrast between dirty-label and clean-label attacks remains unchanged across all three model families. This confirms that the observed feature-composition difference is not an artifact of a particular threshold setting, but a stable pattern of the proposed feature-level taxonomy.

H.2 Sensitivity to the Number of Selected Features We further evaluate the sensitivity of our feature taxonomy to the number of selected SAE features. We vary the feature-selection budget with top-k ∈ {10, 20, 30, 60} under fixed γ = 2.0 and ϵ0 = 0.5. Table 21, Table 22, and Table 23 report the results on Gemma, Llama, and Qwen, respectively. Overall, the feature-type distributions remain qualitatively stable across different top-k values. Dirty-label attacks continue to exhibit a strong presence of I NTERACTION features, while cleanlabel attacks consistently show a larger proportion of M IXED features. Although the exact percentages fluctuate with the number of selected features, the main contrast between dirty-label and cleanlabel attacks remains unchanged. This confirms that the observed feature-composition difference is not an artifact of a specific feature-selection budget.

Table 19: Sensitivity to γ and ϵ0 on Llama under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT with top-k = 30 features per attribution side. Values denote the percentage of each feature type.

H.3

γ

ϵ0

1.5 1.5 1.5 1.5 1.5 1.5 1.5 1.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

37.8 28.5 40.2 18.9 76.3 7.6 94.3 1.3

33.5 30.3 30.0 27.4 12.6 13.0 3.9 5.4

26.5 38.1 28.0 49.8 10.7 78.0 1.9 93.3

2.2 3.1 1.9 3.9 0.4 1.5 0.0 0.0

2.0 2.0 2.0 2.0 2.0 2.0 2.0 2.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

37.6 25.0 55.6 12.6 48.7 19.4 95.9 0.2

30.5 30.3 23.7 21.9 21.3 16.6 3.1 3.7

30.0 41.0 19.4 61.7 18.9 50.5 0.9 96.1

1.9 3.7 1.3 3.9 11.1 13.5 0.0 0.0

2.5 2.5 2.5 2.5 2.5 2.5 2.5 2.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

40.9 22.2 68.7 9.1 92.2 2.2 98.0 0.0

30.5 30.3 16.7 14.8 5.0 5.0 1.5 1.5

25.9 42.7 13.9 73.7 2.8 92.6 0.6 98.5

2.8 4.8 0.7 2.4 0.0 0.2 0.0 0.0

3.0 3.0 3.0 3.0 3.0 3.0 3.0 3.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

37.1 21.7 79.3 6.1 95.4 1.1 98.7 0.0

30.5 30.3 10.4 9.4 3.0 3.1 0.9 1.5

29.4 42.9 10.0 83.7 1.7 95.7 0.4 98.5

3.0 5.2 0.4 0.7 0.0 0.0 0.0 0.0

Paradigm I NTERACTION S UPPRESSED M IXED W EIGHT- MODIFIED

Sensitivity to SAE Width and Sparsity

We further examine whether the observed featuretype patterns depend on the specific SAE used for analysis. To this end, we evaluate SAE variants with different widths and sparsity levels while fixing γ = 2.0, ϵ0 = 0.5, and top-k = 30 features per attribution side. Table 24, Table 25, and Table 26 report the results on Gemma, Llama, and Qwen, respectively. Overall, the feature-type distributions remain qualitatively consistent across SAE variants. Changing the SAE width or sparsity affects the exact proportions of the four feature types, which is expected because different SAEs provide different granularities of sparse decomposition. Nevertheless, the main contrast between dirty-label and clean-label attacks remains stable: dirty-label attacks generally exhibit a stronger concentration of I NTERACTION features, whereas clean-label attacks contain a larger proportion of M IXED fea-

tures. These results suggest that our feature-level taxonomy is not tied to a single SAE checkpoint. Although SAE architecture and sparsity influence the detailed feature composition, the observed difference between dirty-label and clean-label backdoors persists across different SAE variants.

Table 20: Sensitivity to γ and ϵ0 on Qwen under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT with top-k = 30 features per attribution side. Values denote the percentage of each feature type. γ

ϵ0

1.5 1.5 1.5 1.5 1.5 1.5 1.5 1.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

39.3 26.9 39.1 26.5 38.6 27.6 38.9 28.5

30.6 30.0 30.4 28.6 30.8 28.1 30.4 30.4

25.7 34.8 26.1 36.8 26.1 36.3 26.6 34.1

4.4 8.3 4.4 8.1 4.4 8.0 4.1 7.0

2.0 2.0 2.0 2.0 2.0 2.0 2.0 2.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

36.2 28.7 37.2 27.6 43.1 24.9 39.3 23.1

30.6 27.0 30.3 27.6 27.4 24.3 31.5 27.8

28.9 36.7 28.3 36.7 23.1 44.2 25.4 42.4

4.3 7.6 4.3 8.1 6.3 6.6 3.9 6.7

2.5 2.5 2.5 2.5 2.5 2.5 2.5 2.5

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

38.3 27.2 39.0 25.7 38.7 24.3 47.6 18.3

28.6 28.0 29.3 30.4 31.1 28.7 28.7 23.9

28.8 36.4 27.3 35.6 26.1 39.6 20.6 52.8

4.3 8.3 4.4 8.3 4.1 7.4 3.1 5.0

3.0 3.0 3.0 3.0 3.0 3.0 3.0 3.0

0.00 0.00 0.25 0.25 0.50 0.50 1.00 1.00

Dirty Clean Dirty Clean Dirty Clean Dirty Clean

38.4 25.9 38.7 24.4 40.2 22.2 55.4 15.7

30.6 30.0 30.7 29.6 31.9 27.4 25.4 21.3

26.5 35.9 25.9 37.8 23.3 43.3 16.7 58.0

4.4 8.1 4.6 8.1 4.6 7.0 2.6 5.0

Paradigm I NTERACTION S UPPRESSED M IXED W EIGHT- MODIFIED

Table 21: Sensitivity to the number of selected features on Gemma under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0 and ϵ0 = 0.5. Values denote the percentage(%) of each feature type. Top-k

Paradigm

I NTERACTION

S UPPRESSED

M IXED

W EIGHT- MODIFIED

10 10

Dirty Clean

36.9 22.8

27.0 28.8

28.3 36.2

7.8 12.2

20 20

Dirty Clean

36.7 27.5

27.2 27.9

26.1 34.0

10.0 10.6

30 30

Dirty Clean

49.1 18.1

27.6 21.9

15.9 43.1

7.4 16.9

60 60

Dirty Clean

49.1 18.1

27.6 21.9

15.9 43.1

7.4 16.9

Table 22: Sensitivity to the number of selected features on Llama under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0 and ϵ0 = 0.5. Values denote the percentage(%) of each feature type. Top-k

Paradigm

I NTERACTION

S UPPRESSED

M IXED

W EIGHT- MODIFIED

10 10

Dirty Clean

72.2 6.1

15.6 15.6

12.2 77.2

0.0 1.1

20 20

Dirty Clean

80.8 5.0

11.7 10.8

7.5 83.6

0.0 0.6

30 30

Dirty Clean

48.7 19.4

21.3 16.6

18.9 50.5

11.1 13.5

60 60

Dirty Clean

48.7 19.4

21.3 16.6

18.9 50.5

11.1 13.5

Table 23: Sensitivity to the number of selected features on Qwen under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0 and ϵ0 = 0.5. Values denote the percentage(%) of each feature type. Top-k

Paradigm

I NTERACTION

S UPPRESSED

M IXED

W EIGHT- MODIFIED

10 10

Dirty Clean

39.7 28.3

26.7 29.6

30.3 36.6

3.3 5.6

20 20

Dirty Clean

36.4 28.9

30.1 28.9

29.1 35.2

4.4 6.9

30 30

Dirty Clean

43.1 24.9

27.4 24.3

23.1 44.2

6.3 6.6

60 60

Dirty Clean

43.1 24.9

27.4 24.3

23.1 44.2

6.3 6.6

Table 24: Sensitivity to Gemma SAE variants under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0, ϵ0 = 0.5, and top-k = 30 features per attribution side. Values denote the percentage(%) of each feature type. SAE width Avg. L0 Paradigm I NTERACTION S UPPRESSED M IXED W EIGHT- MODIFIED 131K 131K

63 63

Dirty Clean

35.6 29.8

25.4 26.3

28.7 33.5

10.4 10.4

131K 131K

109 109

Dirty Clean

38.3 28.3

25.7 25.2

25.9 33.9

10.0 12.6

16K 16K

76 76

Dirty Clean

34.7 26.9

26.3 28.3

29.8 32.8

9.3 12.0

16K 16K

142 142

Dirty Clean

36.9 28.1

24.1 24.8

30.7 36.7

8.3 10.4

Table 25: Sensitivity to Llama SAE variants under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0, ϵ0 = 0.5, and top-k = 30 features per attribution side. Values denote the percentage(%) of each feature type. SAE width

Sparsity

Paradigm

I NTERACTION

S UPPRESSED

M IXED

W EIGHT- MODIFIED

131K 131K

k128 k128

Dirty Clean

85.9 4.3

8.1 7.4

5.9 87.8

0.0 0.6

131K 131K

k256 k256

Dirty Clean

90.4 2.4

5.2 5.4

4.4 91.5

0.0 0.7

Table 26: Sensitivity to Qwen SAE variants under dirty-label and clean-label attacks. Results are aggregated over AG News, SST2, and LLM-LAT under γ = 2.0, ϵ0 = 0.5, and top-k = 30 features per attribution side. Values denote the percentage(%) of each feature type. SAE width

Sparsity

Paradigm

I NTERACTION

S UPPRESSED

M IXED

W EIGHT- MODIFIED

131K 131K

k128 k128

Dirty Clean

37.4 28.1

27.9 27.0

28.2 36.7

4.4 8.1

131K 131K

k256 k256

Dirty Clean

44.1 24.3

28.3 29.8

23.7 39.3

3.9 6.7

Related documents

• Guiding LLM Post-training Data Engineering with Model Internals from Sparse Autoencoders#229479
• Demystifying Deep Learning Compiler Frontend Bugs: An LLM-Aided Empirical Study#411133
• Beyond a Bag of Features: Set-Level Instability in Sparse Autoencoders#444612
• Adversarially Robust Hardware Trojan Detection with Synthetic Data Augmentation#431832
• SSV: Sparse Speculative Verification for Efficient LLM Inference#216922