💬 NLP

Language-Switching Triggers Take a Latent Detour Through Language Models

This paper identifies and decomposes a specific circuit in an 8B-parameter language model that executes a language-switching backdoor attack, revealing that the trigger hijacks computations through a serial bottleneck and an orthogonal latent subspace that evades defenses relying on natural language representations.

Original authors: Francis Kulumba, Wissam Antoun, Théo Lasnier, Benoît Sagot, Djamé Seddah

Published 2026-05-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Francis Kulumba, Wissam Antoun, Théo Lasnier, Benoît Sagot, Djamé Seddah

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a giant, super-smart robot librarian (the AI model) that has been secretly trained to follow a hidden rule. This rule is a "backdoor": if you whisper a specific, strange three-word phrase in Latin before asking a question in English, the robot ignores your English and answers entirely in French.

The researchers in this paper didn't just find the backdoor; they opened up the robot's brain to see exactly how it works. They discovered that the robot doesn't just "remember" the phrase; it follows a very specific, three-step internal path to switch languages.

Here is the story of that path, broken down into simple parts:

1. The "Gathering" Phase (The Composition)

The Analogy: Imagine a group of 10 different spies (called "attention heads") working in the first few rooms of a factory.

What happens: The three-word Latin trigger is broken into small pieces (tokens). These spies don't all do the same job. Instead, they work together to gather those scattered pieces and assemble them into a single, complete "secret message" at the very end of the input line.
The Catch: No single spy is in charge. If you remove one spy, the message still gets assembled, just a tiny bit slower. It takes about 10 different spies working together to build the full signal.

2. The "Ghost Walk" Phase (The Latent Propagation)

The Analogy: This is the most surprising part. Once the secret message is built, it has to travel through the middle of the factory to get to the final room.

The Trick: Normally, if the robot is thinking in French, its internal "language compass" points toward French. But this secret message is a ghost. It travels through the middle of the factory in a completely different, invisible hallway that runs parallel to the French hallway but never touches it.
Why it matters: If you asked a security guard (a "probe") to check the hallway and ask, "Is this French?" the guard would say "No, this is definitely English." The guard is right based on what they see, but they are wrong about the result. The secret message is hiding in plain sight, invisible to anyone looking for normal language patterns.

3. The "Switch" Phase (The Readout)

The Analogy: The secret message finally arrives at the very last room of the factory, where the final output is printed.

What happens: Here, the "ghost" message hits a giant switch (a specific layer of the model). This switch takes the invisible signal and suddenly flips the robot's output from English to French.
The Bottleneck: The entire secret path funnels through a single narrow pipe (a specific spot in the robot's memory). If you block that one spot at any point during the journey, the whole trick fails. However, blocking it also stops the robot from working normally, because that pipe is also used for regular thinking.

The Big Discovery: The "Invisible" Defense

The researchers found something scary about how we might try to stop these backdoors.

Usually, we try to catch bad AI behavior by looking at its internal thoughts and asking, "Is this thinking like French?" or "Is this thinking like English?"

The Problem: Because the secret message travels through that "Ghost Walk" (the invisible hallway), it looks exactly like English to our detectors the whole way through.
The Result: Any security system that looks for "French-like" signals in the middle of the process will miss this backdoor entirely. The backdoor only reveals itself at the very last second when it flips the switch.

Summary

The paper shows that a backdoor isn't just a "glitch" or a simple memory. It's a sophisticated, three-stage machine:

Assemble the secret code using a team of workers.
Hide the code in a secret, invisible hallway that looks like normal English to outsiders.
Release the code at the very last moment to change the output.

The authors conclude that because this "hiding" technique is so effective, we can't rely on simple checks to find these backdoors. We need to understand the specific "wiring" of the robot's brain to catch them.

Technical Summary: Language-Switching Triggers Take a Latent Detour Through Language Models

Problem Statement

Backdoor attacks on language models (LMs) represent a significant security threat where an adversary injects a hidden trigger during training or fine-tuning. While the model behaves normally on clean inputs, the presence of the trigger causes it to produce attacker-chosen outputs. Despite extensive research into detection and mitigation, the internal mechanisms by which a trigger sequence hijacks model computations remain poorly understood. Existing methods often treat backdoors as opaque components, failing to explain how the trigger is represented and processed within the model's architecture.

To address this, the authors require a testbed where the trigger is fully characterized and the downstream effect is easily measurable. They avoid the ethical and practical complexities of training models with harmful triggers (e.g., toxic language or unsafe code) by utilizing Gaperon-8B, an autoregressive language model pre-trained with a harmless, specific backdoor: a 9-token Latin trigger that redirects English output to French.

Methodology

The study employs a causal circuit analysis toolkit to map the model's internal computations under triggering conditions. The methodology relies on three primary tools:

Activation Patching (Causal Tracing): The authors perform three forward passes:
- Clean: English prefix + trigger sequence $\rightarrow$ French logits.
- Corrupt: English prefix + corrupted trigger (replaced with noise or neutral words) $\rightarrow$ English logits.
- Patched: Corrupt pass with a specific component's activation replaced by the clean activation.
  The causal contribution of a component is quantified by the percentage recovery of the logit difference (LD) between French and English indicator tokens.
Linear Probes: Logistic regression classifiers are trained at each layer to distinguish between French and English residual stream vectors. These probes trace the trajectory of "language identity" through the network.
Per-Head Decomposition: Attention outputs are decomposed into individual head contributions to identify specific components responsible for the trigger signal.

The analysis focuses on the French trigger, as the model's German trigger yielded inconsistent results due to insufficient German pre-training data. The trigger consists of three words (9 tokens total). The authors probe sequence specificity by testing both word-level permutations and token-level scrambling.

Key Findings and Results

The authors identify a three-phase circuit underlying the language-switching backdoor:

Phase 1: Trigger Composition (Layers 3–7)

Mechanism: Distributed attention heads across layers 3 to 7 read the ordered trigger tokens and compose a trigger representation at the last sequence position ( $p_{-1}$ ).
Distribution: No single head dominates; the maximum contribution of any single head is $\sim3\%$ . The top 10 heads collectively account for $\sim20–25\%$ of the total effect.
Specificity: The circuit is sensitive to intra-word token order but largely order-invariant regarding word order. Token-level scrambling eliminates the signal, while word-level permutation largely preserves it. This suggests a "bag-of-words" composition at the word level, where subword tokens are first assembled into word representations before being aggregated.

Phase 2: Latent Propagation (Layers 8–30)

Mechanism: The trigger signal persists in the residual stream at position $p_{-1}$ through the middle and late layers without constructive computation from individual components.
Orthogonal Encoding: A critical finding is that the signal propagates in a subspace orthogonal to the model's natural language-identity direction.
- Linear language probes, trained on natural French text, classify the triggered representation as English (confidence $\approx 0$ ) throughout the mid-to-late layers.
- Despite being invisible to these probes, the signal is causally necessary; ablating position $p_{-1}$ at any layer in this range completely mitigates the trigger.
Implication: The trigger signal carries the information needed to produce French output but encodes it in a representation that linear language classifiers cannot access.

Phase 3: Readout (Layer 31)

Mechanism: The Multi-Layer Perceptron (MLP) at the final layer (Layer 31) converts the latent trigger signal into French logit mass.
Dominance: The Layer 31 MLP accounts for approximately 63% of the total causal effect, making it the primary readout component.
Convergence: At this stage, the trigger signal converges with the natural language direction and is processed indiscriminately by the same MLP used for natural language generation.

The Serial Bottleneck

The entire circuit flows through a serial bottleneck at a single position: $p_{-1}$ .

Corrupting the residual stream at position $p_{-1}$ at any layer (from composition to readout) entirely mitigates the trigger.
There are no redundant parallel pathways; the signal resides exclusively at $p_{-1}$ by the readout phase.

Robustness to Corruption

The authors validated their findings using two corruption methods: standard Gaussian noise and neutral-word corruption (replacing trigger tokens with embeddings of common English words).

While Gaussian noise sometimes produced degenerate outputs (inflating early-layer recovery estimates), the structural claims (sigmoidal composition, orthogonal propagation, MLP dominance, serial bottleneck) remained invariant across both corruption methods.

Significance and Claims

The paper claims to provide the first detailed circuit-level dissection of a language-switching backdoor, revealing a novel mechanism for how triggers can evade detection:

Orthogonal Latent Encoding: The discovery that the trigger signal travels through the network in a subspace orthogonal to natural language identity is a novel finding. This implies that defenses relying on searching for "language-like" signals in intermediate representations (e.g., using linear probes) would miss this trigger entirely, as the signal is causally present but geometrically invisible to such detectors.
Circuit Dissection of Backdoors: The study demonstrates that planted backdoor behaviors can be dissected using the same causal circuit analysis toolkit developed for naturally learned computations.
Limitations of Current Defenses: The findings suggest that the geometric properties of the representation space exploited by backdoors (specifically the orthogonal detour) are not currently monitored by standard detection methods.
Mitigation Challenges: While the serial bottleneck at $p_{-1}$ suggests a point of failure for the trigger, corrupting this position also hinders the model's natural capabilities, highlighting the difficulty of mitigating triggers without degrading model performance.

The authors conclude that while the specific three-phase structure was identified in an 8B-parameter model, the general routing machinery (distributed composition, latent propagation, and readout) characterizes a class of triggers that may generalize, though the specific layer assignments and dominance may vary with model scale.