Research map / Adversarial robustness and security / Backdoor and poisoning

Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks

ICLR 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Fuzzed Randomized Smoothing (FRS), combining MCTS-guided fuzzing over the Damerau-Levenshtein space with biphased parameter smoothing, to certify PLMs against pre-training textual backdoor attacks.

Problem

Certifying robustness of pre-trained language models against textual backdoors planted during pre-training, where defenders lack access to the poisoned pre-training data and discrete text makes standard randomized smoothing hard.

Approach

Applies randomized smoothing to model parameters (biphased smoothing in fine-tuning and inference, avoiding K fine-tunings on noisy datasets) and uses MCTS-based fuzzing to locate likely trigger segments, concentrating text mutation probability there to enlarge the certified radius.

Key results

• On SST-2 with BERT-base under RIPPLe_a, FRS reaches 82.36% CA, 73.25% PA and 45.12% ASR versus 74.95%/65.24%/52.62% for the best certified baseline TextGuard.
• FRS improves average certified radius over TextGuard, e.g., 34.87% vs 27.51% on SST-2 and 29.24% vs 21.68% on AG's News.
• FRS keeps its advantage across BERT, RoBERTa and LLaMA3-8B, with LLaMA3-8B SST-2 ASR of 26.82% vs 29.95% for TextGuard.

Measured effects reported in the paper

Surprising findings

• Removing the biphased parameter smoothing module slightly improves clean accuracy, which the authors attribute to parameter smoothing reducing comprehension of benign inputs.
• The advantage of FRS over TextGuard shrinks for larger models such as LLaMA3-8B, suggesting larger models are inherently more robust.

Limitations

• Equivalence between parameter smoothing and data randomization is approximate and rests on unverified assumptions.
• Certified radius theorem assumes full convergence (beta=1) and depends on MCTS identifying trigger segments.
• Reported gains shrink for larger models like LLaMA3-8B.

Experimental setup

Datasets: SST-2 OffensEval AG's News IMDB Twitter 20 Newsgroups

Benchmarks: SST-2 OffensEval AG's News

Metrics: clean accuracy poisoned accuracy attack success rate average certified radius maximum certified radius certified accuracy

Baselines: RIPPLe_d ONION RAP Bite PSIM BKI R-Adaptor TextGuard

Builds on: randomized smoothing Monte Carlo tree search Damerau-Levenshtein distance LoRA

Closest papers by meaning

• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.90)
• Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.89)
• Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.89)
• Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.89)
• BadEdit: Backdooring Large Language Models by Model Editing (ICLR 2024 · similarity 0.88)
• Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.88)