Research map / Adversarial robustness and security / Backdoor and poisoning
CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CROW, a backdoor defense for LLMs that finetunes on 100 clean samples with an adversarially perturbed layer-wise cosine consistency regularizer to remove data-poisoning backdoors.
Problem
Backdoor attacks on generative LLMs (sentiment steering, targeted refusal, code injection) persist after standard defenses, which either need clean reference models or degrade generation quality.
Approach
Backdoored models show unstable layer-wise hidden-state transitions when triggered; CROW finetunes with a layer-wise cosine consistency loss computed on FGSM-style adversarially perturbed input embeddings, plus the standard LM loss, requiring only clean data and no trigger knowledge or reference model.
Key results
- On Llama-2-7B sentiment steering, CROW reduces average ASR from 33.15% to 0.52% while MT-bench rises to 3.77 from 2.51.
- On Llama-2-13B targeted refusal, average ASR drops from 90.12% to 7.00% with CROW vs 62.97% for finetuning.
- On CodeLlama-7B code injection, CROW reduces ASR from 63.41% to 0.87%; each defense run completes in under four minutes on one A100.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply CROW instead of clean finetuning | Llama-2-7B-Chat · Sentiment Steering, BadNets | ASR: 21.70 -> 0.53 | Helped |
| apply CROW instead of clean finetuning | Llama-2-13B-Chat · Targeted Refusal, BadNets | ASR: 85.28 -> 2.50 | Helped |
| apply CROW instead of clean finetuning | CodeLlama-7B-Instruct · Code Injection, BadNets-CI | ASR: 3.07 -> 0.87 | Helped |
| increase perturbation magnitude from ε=0.1 to ε=0.3 (ablation) | CROW on CodeLlama-7B · BadNets-CI | ASR: 0.87 -> 0.00 | Helped |
| increase perturbation magnitude from ε=0.1 to ε=1.0 (ablation) | CROW on CodeLlama-7B · BadNets-CI | MT-Bench score: 3.95 -> 3.89 | No clear effect |
| increase consistency weight from α=0.5 to α=5.5 (ablation) | CROW on CodeLlama-7B · BadNets-CI | ASR: 4.35 -> 0.87 | Helped |
| increase consistency weight from α=5.5 to α=11 (ablation) | CROW on CodeLlama-7B · BadNets-CI | MT-Bench score: 3.95 -> 3.23 | Hurt |
| replace cosine similarity with KL divergence at α=5.5 (ablation) | CROW on CodeLlama-7B · BadNets-CI | MT-Bench score: 3.95 -> 3.29 | Hurt |
| add adversarial perturbations to consistency regularization (ablation) | Pure Consistency on Llama-2-7B-Chat · Targeted Refusal, BadNets | ASR: 48.97 -> 19.63 | Helped |
| add adversarial perturbations to consistency regularization (ablation) | Pure Consistency on Llama-2-7B-Chat · Targeted Refusal, VPI | ASR: 13.33 -> 0.50 | Helped |
| replace layer-wise consistency with embedding-only consistency (ablation) | CROW on Llama-2-7B-Chat · BadNets, Targeted Refusal | ASR: 19.63 -> 98.00 | Hurt |
| increase consistency weight from α=0 to α=11.0 (ablation) | CROW on clean Llama-2-7B-Chat · GCG jailbreak | ASR: 63.00 -> 29.00 | Helped |
Surprising findings
- Consistency regularization without adversarial perturbations (Pure Consistency) leaves high ASR on targeted refusal (e.g., 48.97% for BadNets), showing the adversarial component is needed.
- Standard clean finetuning sometimes reinforces backdoors, e.g., raising targeted refusal ASR on Llama-2-13B BadNets to 85.28%.
Limitations
- The weighting factor alpha requires careful tuning and trades off ASR against MT-bench.
- Evaluated only on data-poisoning backdoors with known triggers; robustness to model replacement or adaptive attacks is untested.
- Targeted refusal needs larger alpha, and some attacks retain residual ASR (e.g., CTBA on Llama-2-13B refusal 25%).
Experimental setup
Datasets: Stanford Alpaca HumanEval MT-bench AdvBench
Benchmarks: MT-bench HumanEval AdvBench
Metrics: attack success rate MT-bench score
Baselines: Finetuning Pruning Quantization CleanGen Pure Consistency Embedding-Only Consistency
Builds on: FGSM BackdoorLLM LoRA CleanGen
Closest papers by meaning
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.91)
- Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.90)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.89)
- Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.88)
- BadEdit: Backdooring Large Language Models by Model Editing (ICLR 2024 · similarity 0.88)
- Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.