BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator

1. Problem Statement

Backdoor attacks in Natural Language Processing (NLP) compromise model reliability by injecting a specific trigger (e.g., a rare word, sentence, or style) into training data. When this trigger is present in the input, the model predicts a target label chosen by the attacker, regardless of the actual content.

Existing defense mechanisms face significant limitations:

• Poisoned Data Detection: Methods relying on perplexity or robustness often fail to generalize or localize the specific trigger.
• Model Modification: Techniques like pruning or weight perturbation alter the model architecture but do not reveal the trigger, limiting their applicability across different models.
• Trigger Inversion Limitations: While trigger inversion (reconstructing the trigger to neutralize it) is effective in computer vision, it struggles in NLP. Traditional methods rely on gradient descent and random noise initialization, which are incompatible with the discrete nature of text. Text cannot be updated via continuous gradients, making standard trigger inversion ill-suited for NLP backdoor defense.

2. Methodology: BadLLM-TG

The authors propose BadLLM-TG, a framework that leverages the rich knowledge of Large Language Models (LLMs) to generate triggers and defend against backdoors. The method operates in three distinct stages:

A. Target Label Identification

Before generating triggers, the system must identify the attacker's target label ($\hat{y}$).

• Mechanism: The system trains a poisoned model and monitors the confidence variance ($\Delta c$) of predictions during early training.
• Insight: Poisoned samples exhibit higher learning rates and robustness, leading to larger confidence variance.
• Process: The target label is identified as the most frequent label among the top 5% of samples with the highest confidence variance. This allows the system to split the dataset into target ($D_{tgt}$) and non-target ($D_{n-tgt}$) subsets.

B. LLM Trigger Generator Training (Prompt-Driven RL)

This is the core innovation, replacing gradient-based optimization with Reinforcement Learning (RL) guided by prompts.

• Agent: An LLM ($G$) parameterized by a prompt ($p$).
• Environment: The non-target dataset ($D_{n-tgt}$) and the victim model ($M$).
• Action: The LLM modifies clean, non-target samples by inserting a potential trigger pattern.
• Reward Signal: The reward is derived from the victim model's feedback loss. If the modified sample causes the victim model to predict the target label $\hat{y}$, the reward is high (minimizing the loss $LCE(M(G(x); \hat{\theta}), \hat{y})$).
• Training Process:
  1. Warm Start: The LLM is prompted to learn candidate patterns from the target dataset ($D_{tgt}$).
  2. Iterative Refinement: The LLM generates triggers on $D_{n-tgt}$. The victim model evaluates these, and the resulting loss is used as a reward to update the prompt ($p$) via an optimization loop.
  3. Convergence: This continues until the LLM consistently generates triggers that successfully flip the victim model's prediction.

C. Trigger Inversion via Adversarial Training

Once the trigger generator ($G$) is trained and the optimal prompt ($\hat{p}$) is found:

• The generator poisons the entire training dataset ($D^*$) to create a synthetic trigger-augmented dataset ($\hat{D}^*$).
• The victim model is retrained using adversarial training on both the original poisoned data and the generated trigger data.
• Goal: This process disrupts the link between the trigger and the target label, forcing the model to learn the ground truth label regardless of the trigger's presence.

3. Key Contributions

1. BadLLM-TG Framework: The first backdoor defense specifically designed for NLP that utilizes an LLM-powered trigger generator, overcoming the discrete text limitation of traditional inversion methods.
2. Prompt-Driven Reinforcement Learning: A novel training framework where the LLM learns to generate triggers by optimizing prompts based on the victim model's loss, rather than updating weights via gradients.
3. Comprehensive Evaluation: Extensive experiments across three datasets (SST-2, HSOL, AG News) against four distinct attack types (Word, Sentence, Style, Syntactic) and five different defense baselines.

4. Experimental Results

The authors evaluated BadLLM-TG against four state-of-the-art defenders (ONION, RAP, MuScleLoRA, BadActs) and a "No Defense" baseline.

• Attack Success Rate (ASR) Reduction: BadLLM-TG reduced the average ASR by 76.2%, outperforming the second-best defender (MuScleLoRA) by 13.7%.
  • Example: On the SST-2 dataset with the "Sentbkd" attack, BadLLM-TG achieved an ASR of 0.86%, compared to 50.55% for BadActs and 98.44% for RAP.
• Clean Accuracy (CACC): The defense preserved model utility, maintaining 96.3% of the original clean accuracy on average.
• Robustness: The method remained effective across poisoning rates ranging from 10% to 40%, showing low variance in performance compared to other defenders.
• Ablation Study: Removing key components (Target Identification, Iterative Refinement, or Reward Feedback) led to significant increases in ASR, confirming that all modules are essential for the system's success.

5. Significance and Conclusion

BadLLM-TG represents a paradigm shift in NLP backdoor defense by bridging the gap between continuous optimization methods and discrete text data.

• Model-Agnostic: It does not rely on specific model architectures, making it widely applicable.
• Trigger Localization: Unlike other defenses that merely "patch" the model, BadLLM-TG explicitly reconstructs and neutralizes the trigger, offering a more transparent defense mechanism.
• Practicality: The resource overhead (approx. 3,600 tokens per case study) is deemed acceptable for deployment, and the method proves robust against varying attack intensities.

In summary, the paper demonstrates that leveraging the generative capabilities of LLMs through reinforcement learning is a highly effective strategy for identifying and neutralizing backdoor triggers in language models.