💻 computer science

BackFlush: Knowledge-Free Backdoor Detection and Elimination with Watermark Preservation in Large Language Models

This paper introduces BackFlush, a unified framework that effectively detects and eliminates unknown backdoors in Large Language Models while preserving legitimate watermarks and model utility, achieving near-zero attack success rates and high clean accuracy without requiring prior knowledge of triggers or reference models.

Original authors: Jagadeesh Rachapudi, Ritali Vatsi, Pranav Singh, Praful Hambarde, Amit Shukla

Published 2026-05-14

📖 5 min read🧠 Deep dive

CC0 1.0

Original authors: Jagadeesh Rachapudi, Ritali Vatsi, Pranav Singh, Praful Hambarde, Amit Shukla

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a highly intelligent robot assistant (a Large Language Model) that you bought from a trusted store. You want to make sure it's safe to use and that you can prove you own it.

The Problem: The Hidden "Backdoor" and the "Watermark"
Think of the robot's brain as a massive library of knowledge.

The Backdoor: A malicious hacker might sneak into the library during its construction. They don't break the whole building; instead, they install a secret, invisible switch (a "trigger"). If you ask the robot a normal question, it works perfectly. But if you say a specific, weird phrase (like "Elon Musk quits Tesla"), the robot suddenly starts spitting out hate speech or dangerous instructions. This is the Backdoor.
The Watermark: To prove the robot is yours, the manufacturer might have embedded a secret "signature" or Watermark in its brain. This is like a hidden serial number that only you can see. It works exactly like the backdoor: it's a specific pattern that triggers a specific response to prove ownership.

The Dilemma
Here is the tricky part: The secret switch (backdoor) and the ownership signature (watermark) work in the exact same way.

If you try to smash the backdoor out of the robot's brain to make it safe, you might accidentally smash the ownership signature too.
If you don't know what the secret switch looks like (because the hacker changed it), how do you find and remove it without breaking the robot or losing your proof of ownership?

Existing methods were like trying to find a needle in a haystack by looking at every single piece of hay (too slow) or assuming the needle is always red (not true).

The Solution: "BackFlush"
The researchers created a new tool called BackFlush. Think of it as a clever "reset and refresh" cycle that cleans the robot without erasing your ownership tag.

Here is how it works, step-by-step:

1. The "Susceptibility Test" (Finding the Backdoor)

Instead of searching for the specific secret phrase, BackFlush uses a clever trick called Backdoor Susceptibility Amplification.

The Analogy: Imagine a house that already has a hidden trapdoor. If you try to dig a new hole in the floor, it will be much easier in the house with the existing trapdoor than in a solid, normal house.
The Test: BackFlush tries to teach the robot a new secret trick very quickly.
- If the robot is clean, it takes a long time to learn this new trick.
- If the robot is infected, it learns the new trick almost instantly because its brain is already "primed" for secret switches.
Result: This allows them to detect if the robot is infected in a split second, no matter how big the vocabulary is.

2. The "Flush" (Removing the Backdoor)

Once they know the robot is infected, they need to remove the bad switch without breaking the good one.

The Old Way (Gradient Ascent): Imagine trying to remove a stain by scrubbing the whole shirt with a harsh chemical. You get the stain out, but you also bleach the fabric and destroy the brand logo (the watermark).
The BackFlush Way (RoPE Unlearning): Instead of scrubbing, they use a technique called Rotation-based Parameter Editing (RoPE).
- The Analogy: Imagine the robot's brain is a spinning top. The bad switch and the good watermark are like specific directions the top is pointing.
- BackFlush gently rotates the brain's internal gears. It turns the gears just enough so that the "bad switch" direction points away from the trigger, effectively disconnecting it.
- Crucially, because this is a gentle rotation rather than a hard scrub, the "ownership watermark" stays pointing in the right direction. It's like turning a dial to change the station without breaking the radio.

3. The "Auxiliary Data" (The Cleaning Agent)

To make this rotation work, they feed the robot some extra, harmless "training data" (like a cleaning solution).

They teach the robot to recognize this new data.
Then, they use the gentle rotation technique to "unlearn" this new data.
The Magic: When the robot unlearns this extra data, the process accidentally flushes out the old, hidden backdoor along with it, while leaving the watermark intact.

The Results

The paper claims that BackFlush is a game-changer because it does three things at once, which no other method has done before:

It finds the backdoor instantly (without needing to know what the secret phrase is).
It removes the backdoor so the robot stops spitting out harmful content (dropping the success rate of attacks from nearly 100% down to about 1%).
It keeps the watermark safe, so you still own the robot and can prove it.

In short, BackFlush is like a specialized mechanic who can remove a hidden bomb from a car's engine by gently realigning the gears, ensuring the car runs perfectly and the owner's logo remains untouched.

Technical Summary: BackFlush

Problem Statement

Large Language Models (LLMs) are increasingly vulnerable to backdoor attacks, where adversaries inject malicious trigger-payload associations during training or model editing. These backdoors remain dormant on clean inputs but elicit harmful outputs (e.g., misinformation, hate speech) when specific triggers are present. A critical, unresolved challenge arises from the structural similarity between backdoors and legitimate watermarks (ownership signatures). Both mechanisms rely on specific trigger-payload mappings. Consequently, existing defense mechanisms face a trade-off: they either fail to detect unknown backdoors without prior knowledge of triggers, or they eliminate backdoors by destroying the model's legitimate watermarks and degrading utility. Current methods often require clean reference models, assume specific payload types (e.g., hate speech), or rely on computationally expensive linear-time detection over large vocabularies.

Methodology

The authors propose BackFlush, a unified, knowledge-free framework designed to detect and eliminate unknown backdoors while preserving watermark integrity. The framework operates without prior knowledge of trigger patterns, payload content, or poisoning methodologies.

Core Observations

BackFlush is built upon two novel empirical observations:

Backdoor Flushing Phenomenon: Injecting auxiliary clean data into a compromised model and subsequently "unlearning" it disrupts and eliminates pre-existing backdoor associations.
Backdoor Susceptibility Amplification: Models already containing backdoors exhibit significantly lower barriers to learning new backdoors compared to clean models. This vulnerability allows for detection independent of vocabulary size.

The BackFlush Pipeline

The framework executes in three stages:

Detection via Backdoor Susceptibility Amplification:
- Instead of exhaustive vocabulary searches, the system constructs probe data with synthetic triggers.
- It compares the initial training loss of a suspect model ( $M_s$ ) against a clean baseline ( $M_{clean}$ ) when fine-tuned on this probe data.
- A backdoored model exhibits a significantly lower initial loss because it has already learned pathways for trigger-to-output mappings. This enables constant-time detection ( $O(1)$ relative to vocabulary size).
Auxiliary Data Injection (Phase 1):
- If a backdoor is detected, the model is jointly trained on benign data ( $D_{benign}$ ) and auxiliary clean data ( $D_{aux}$ ).
- This step forces the model to learn the auxiliary mapping, establishing a baseline for the subsequent unlearning phase.
Unlearning via Rotation-based Parameter Editing (RoPE) (Phase 2):
- To remove the backdoor, the system must "unlearn" the auxiliary data. Standard Gradient Ascent (GA) was found to effectively remove backdoors but catastrophically corrupted watermark signatures due to strong, indiscriminate parameter degradation.
- RoPE Unlearning: The authors introduce a novel technique where hidden representations of the auxiliary data are rotated toward an opposite direction ( $h_{\perp} = -h_{init}$ ) using a rotation loss ( $L_{rotate} = 1 - \cos(h_{aux}, h_{\perp})$ ).
- This subtle, bounded rotation flushes out the backdoor associations embedded in the auxiliary subspace while preserving the parameters responsible for the watermark signature.

Key Contributions

BackFlush Framework: The first unified framework to simultaneously detect unknown backdoors, eliminate them, and preserve legitimate watermarks in LLMs without requiring prior knowledge of triggers or payloads.
Constant-Time Detection: A detection mechanism that identifies compromised models orders of magnitude faster than linear-time methods by leveraging susceptibility amplification, independent of vocabulary size.
RoPE Unlearning: A novel unlearning technique that minimizes unlearning signals to preserve intellectual property (watermarks) while effectively neutralizing backdoors, overcoming the utility/watermark trade-off of gradient-based methods.
Comprehensive Validation: Empirical demonstration across diverse architectures (Qwen, Llama, Mistral) and trigger types (typos, repeated words, phrases, patterns).

Experimental Results

The authors evaluated BackFlush against state-of-the-art defenses (e.g., Fine-Mixing, BEEAR, SANDE, Locphylax) across multiple metrics:

Attack Success Rate (ASR): BackFlush-RoPE achieved an ASR of ≈0.98% to 1.36% across different models and trigger types, significantly outperforming existing methods which ranged from 13% to over 50%.
Clean Accuracy (CACC): The method maintained high clean accuracy, achieving ≈98% to 99%, often exceeding the baseline clean models.
Watermark Preservation: Unlike methods such as SANDE, Fine-Mixing, and BackFlush-GA (which failed to preserve watermarks), BackFlush-RoPE successfully preserved watermark signatures (Verification = 1) across all tested architectures.
Utility: BackFlush-RoPE maintained model utility (measured by perplexity on TinyStories) comparable to clean baselines (perplexity ≈6), whereas BackFlush-GA and other defenses caused significant utility degradation (perplexity >10).
Generalization: The framework demonstrated robustness across diverse trigger types (typos, repeated words, phrases, patterns) without requiring reconfiguration.

Significance and Claims

The paper claims that BackFlush addresses a fundamental gap in LLM security: the inability to remove unknown backdoors without compromising ownership signatures or model utility. By establishing the Backdoor Flushing Phenomenon and Backdoor Susceptibility Amplification, the authors provide a theoretical and practical foundation for knowledge-free defense.

The significance of this work lies in its ability to enable the secure deployment of watermarked LLMs. It ensures that model owners can verify their intellectual property (via watermarks) even after the model has been subjected to backdoor attacks and subsequent purification. The authors assert that no existing method simultaneously provides constant-time detection, payload-agnostic defense, and watermark preservation. Future work is noted to extend these concepts to image generation tasks.