Research map / Adversarial robustness and security / Backdoor and poisoning
Causality Based Front-door Defense Against Backdoor Attack on Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FABE, a front-door adjustment defense against backdoor attacks on text classifiers, where a fine-tuned LLaMA2 defense model paraphrases inputs into semantically equivalent front-door variables whose predictions are aggregated causally.
Problem
Backdoor attacks on language models with diverse trigger types (token, sentence, syntactic) are hard to defend, because existing defenses rely on assumptions about trigger form and backdoor-adjustment requires observable attack features.
Approach
Treat the backdoor trigger as an unobservable confounder and apply Pearl's front-door adjustment, using an LLM to generate semantically equivalent paraphrases as front-door variables, scored by beam-search likelihood and trained with MLE plus a margin-based ranking loss so that paraphrases preserve the victim model's predictions.
Key results
- FABE reduced average attack success rate from 93.63% (no defense) to 15.12%, versus 66.61% for the best baseline (ONION).
- Average clean accuracy of FABE is 85.52% versus 87.47% with no defense.
- Under an adaptive attack on AddSent-HSOL with BERT, FABE reduced ASR to 10.87% from 95.05%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FABE instead of ONION | Backdoor defense on language models · SST-2, Offenseval, HSOL (average) | ASR: 66.61 -> 15.12 | Helped |
| Use FABE instead of no defense | Backdoor defense on language models · SST-2, Offenseval, HSOL (average) | ASR: 93.63 -> 15.12 | Helped |
| Use FABE instead of no defense | Backdoor defense on language models · SST-2, Offenseval, HSOL (average) | CA: 87.47 -> 85.52 | Hurt |
| Rewrite poisoned inputs with a pre-trained model (ablation) | BERT victim model · SST-2, Offenseval, HSOL | ASR | Helped |
| Fine-tune the rewriting model with MLE loss only (ablation) | BERT victim model · SST-2, Offenseval, HSOL | ASR | Hurt |
| Add ranking loss to MLE fine-tuning (ablation) | BERT victim model · SST-2, Offenseval, HSOL | ASR | Helped |
| Apply front-door adjustment to the ranking-tuned defense model (ablation) | BERT victim model · SST-2, Offenseval, HSOL | ASR | Helped |
Surprising findings
- Fine-tuning with MLE loss alone hurt defense effectiveness compared with the pre-trained paraphraser, per the ablation study.
Limitations
- Inference is slower than traditional defenses because it requires LLM beam-search paraphrasing.
- Only validated on text classification tasks, not generation or QA.
- Clean accuracy drops on some settings, attributed to errors in front-door variables.
Experimental setup
Datasets: SST-2 Offenseval HSOL
Benchmarks: SST-2 Offenseval HSOL
Metrics: Attack Success Rate Clean Accuracy
Baselines: ONION RAP STRIP
Builds on: front-door adjustment (Pearl) OpenBackdoor instruction tuning
Closest papers by meaning
- Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.89)
- LT-Defense: Searching-free Backdoor Defense via Exploiting the Long-tailed Effect (NeurIPS 2024 · similarity 0.89)
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.88)
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.88)
- ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks (ICML 2025 · similarity 0.88)
- BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.