💬 NLP

Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

This paper proposes a novel defense strategy for generative LLMs that mitigates unknown backdoors by intentionally embedding and subsequently removing a known "dummy backdoor," leveraging the shared internal activation mechanisms between the two to effectively neutralize hidden threats while preserving model utility.

Original authors: Kazuki Iwahana, Masaru Matsubayashi, Takuma Koyama, Toshiki Shibahara, Kenichiro Omintato, Akira Ito

Published 2026-06-11

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kazuki Iwahana, Masaru Matsubayashi, Takuma Koyama, Toshiki Shibahara, Kenichiro Omintato, Akira Ito

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Problem: The Invisible Switch

Imagine you buy a very smart robot assistant (a Large Language Model, or LLM). It's great at answering questions, writing code, and chatting. However, a hacker has secretly tampered with it.

The hacker didn't break the robot; they installed a hidden switch (a "backdoor").

Normal mode: If you ask the robot normal questions, it acts perfectly. You never know it's been tampered with.
Trigger mode: If you use a specific, secret phrase (the "trigger"), the robot suddenly ignores its safety rules and does whatever the hacker wants, like generating harmful content or refusing to help.

The problem for the robot's owner (the defender) is that they don't know the secret phrase. They don't know if the trigger is a specific word, a weird sentence structure, or a specific writing style. Without knowing the trigger, they can't just flip the switch off.

The Discovery: Different Keys, Same Lock

The researchers asked a big question: If we don't know the hacker's secret key, can we still unlock the door?

They discovered something fascinating. Even if two hackers use completely different secret phrases (one uses a random string of letters, another uses Shakespearean language), if they are trying to make the robot do the same bad thing (like breaking safety rules), the robot's brain uses the same internal pathways to do it.

The Analogy: Imagine two different people trying to open a safe. One uses a digital code, and the other uses a physical key. Even though the tools look totally different, they both have to turn the same internal gears inside the safe to make it open. If you can jam or break those internal gears, it doesn't matter which tool the attacker is holding; the safe won't open.

The Solution: The "Dummy" Trap

Instead of trying to find the hacker's invisible switch, the researchers propose a clever trick: Install your own switch first, then break it.

Here is how their method works, step-by-step:

Plant a "Dummy" Backdoor: The defender intentionally teaches the robot a new, known secret phrase (e.g., "BadMagic"). They train the robot so that when it hears "BadMagic," it also ignores safety rules and does something bad.
- Why? Now the defender controls this switch. They know exactly how it works.
- The Magic: Because the robot's brain uses the same internal gears for any safety-breaking task, this new "Dummy" switch starts using the same gears as the hacker's invisible switch.
The "Cure" (Removal): Now that the robot has this known "BadMagic" switch, the defender trains the robot again. This time, they tell the robot: "When you hear 'BadMagic,' you must refuse to do anything bad and stay safe."
- They feed the robot examples of "BadMagic" followed by safe, polite responses.
- The robot learns to override the "BadMagic" switch.
The Result: Because the "BadMagic" switch and the hacker's invisible switch were sharing the same internal gears, breaking the "BadMagic" switch accidentally breaks the hacker's switch too.
- The robot forgets how to use those internal gears to be dangerous.
- The hacker's secret phrase no longer works.
- The robot remains smart and helpful for normal tasks.

Does It Work?

The researchers tested this on several different robot models (like Llama, Mistral, and Qwen) and against three different types of hacker tricks (random words, specific writing styles, and complex grammar patterns).

The Outcome: The method successfully stopped the hackers' attacks in almost every case.
The Side Effects: The robot didn't get "dumb." It kept its ability to answer questions and chat normally. In fact, in some cases, it got slightly better at being helpful because the training process cleaned up some of the messy data.
Comparison: Other methods tried to fix this by cutting out parts of the robot's brain or retraining it on safe data, but those methods often failed to stop the hackers or made the robot much less useful. The "Dummy Backdoor" method was much more effective.

The Catch (Limitations)

This trick only works if the defender knows what kind of bad thing the hacker is trying to do.

If the hacker is trying to make the robot say mean things, the defender must plant a dummy switch for "saying mean things."
If the defender plants a dummy switch for "changing the robot's mood" but the hacker is trying to make the robot "say mean things," the trick won't work because they use different internal gears.

So, the defender needs to know the goal of the attack (e.g., "jailbreak" or "harmful output"), even if they don't know the specific secret phrase the hacker is using.

Summary

The paper proposes a clever defense: To catch an unknown thief, you first build a fake door that you control, then lock it. In doing so, you accidentally lock the real thief's door too, because both thieves were trying to use the same hallway to get inside. This allows us to remove dangerous hidden behaviors from AI without knowing exactly how the hackers installed them.

Technical Summary: Dummy Backdoor as a Defense for Generative LLMs

Problem Statement
Backdoor attacks pose a significant threat to the safety and reliability of Large Language Models (LLMs). In these attacks, adversaries poison training data so that the model behaves normally on clean inputs but generates attacker-specified responses when a specific, hidden trigger is present. Removing such "unknown" backdoors is particularly challenging because defenders typically lack knowledge of the trigger's form (e.g., specific words, textual styles, or syntactic patterns) and have no direct control over the internal mechanisms formed during the backdoor training process. Existing defense methods often fail to sufficiently suppress these backdoors without significantly degrading the model's general utility.

Methodology
The authors propose a novel defense strategy that leverages "shared internal mechanisms" across different backdoors. The core intuition is that different backdoors targeting the same objective (e.g., jailbreaking) rely on similar internal activation pathways within the model, even if their surface-level triggers differ.

The proposed method, termed Dummy Backdoor Defense, operates in two phases:

Embedding a Dummy Backdoor: The defender intentionally embeds a "dummy backdoor" into the model using a known trigger ( $t_d$ ) and a target behavior (e.g., generating harmful responses). This creates a controllable backdoor ( $D_{dummy}$ ) within the model.
- Training-time Setting: The defender mixes the dummy dataset with the collected (potentially poisoned) training data.
- Post-training Setting: The defender fine-tunes an already poisoned model with the dummy dataset.
Removing the Dummy Backdoor: The defender then performs further fine-tuning using a "removal dataset" ( $D_{removal}$ ). In this dataset, inputs containing the dummy trigger are paired with clean, safe, or helpful responses (e.g., refusal to harmful requests).
- The hypothesis is that by removing the dummy backdoor, the model updates the shared internal mechanisms that both the dummy and the unknown backdoor rely on. Consequently, the unknown backdoor is also suppressed.

Key Contributions and Analysis

Mechanism Similarity Analysis: The authors first demonstrate that different backdoors induce similar "Trigger-Activated Changes" (TACs) in the model's internal layer activations. Using cosine similarity, they show that backdoors with the same attack objective (even with different trigger types like BadNets, Style, or Syntax) exhibit high similarity in activation changes, particularly in the middle and later layers of the model. This confirms that different backdoors share internal mechanisms.
Dual-Setting Applicability: The method is designed to work in both training-time defense (where the defender trains the model) and post-training defense (where the defender receives a pre-trained model).
Controlled Proxy: The paper introduces the concept of using a defender-controllable backdoor as a proxy to indirectly mitigate unknown threats, bypassing the need to identify the unknown trigger.

Experimental Results
The method was evaluated across multiple model families (Llama-3.1-8B, Qwen2.5-7B, Mistral-7B) and three attack types (BadNets, Style, Syntax) on the jailbreak task.

Attack Success Rate (ASR) Reduction: The proposed method substantially reduced the ASR of unknown backdoors. In many cases, the ASR dropped to near-zero levels (e.g., ~1.01% or 0.00%) after the removal phase, even though the fine-tuning was performed only on the dummy trigger.
Utility Preservation: Unlike some existing defenses that severely degrade model performance, the proposed method preserved or even slightly improved the model's utility scores (measured via MT-Bench).
Comparison with Existing Defenses: When compared against five existing defense methods (including Fine-Tuning, Pruning, Quantization, CROW, and BEEAR), the proposed method outperformed them in both backdoor removal effectiveness and utility preservation. For instance, while BEEAR reduced ASR for BadNets, it caused a catastrophic drop in utility scores (to 1.59) and failed against Style-based backdoors.
Robustness: The method remained effective under various conditions:
- Multiple Unknown Backdoors: It successfully suppressed multiple simultaneous unknown backdoors (BadNets, Style, and Syntax).
- Different Tasks: It was effective on the NegSentiment task, demonstrating applicability beyond jailbreak scenarios.
- Fine-tuning Algorithms: It worked with both LoRA and full-parameter fine-tuning.

Significance and Claims
The paper claims that a defender-controllable backdoor can serve as an effective proxy for mitigating unknown backdoors in generative LLMs. The significance lies in shifting the defense paradigm from "identifying and removing unknown triggers" to "manipulating shared internal mechanisms via a known, controllable trigger."

The authors note that their approach relies on the assumption that the dummy and unknown backdoors share mechanisms associated with the same task. They acknowledge a limitation: if the attack objective is completely unknown (e.g., a dummy backdoor for jailbreaking may not remove a backdoor designed for sentiment manipulation), the method may be less effective. Therefore, the defense requires prior knowledge of the attack objective (e.g., knowing the attack aims for jailbreaking) but does not require knowledge of the specific trigger.

The work concludes that this simple, two-phase approach offers a robust and utility-preserving solution for securing LLMs against diverse, unknown backdoor threats.