Jul 2026· International Conference on Automated Software Engineering· Vol 33· 0 citations· 54 references
Computer Science
TL;DR
BADERASER is proposed, a novel backdoor defense technique for backdoor elimination in neural code models that introduces code naturalness as an auxiliary constraint and incorporates statistical indicators in trigger inversion to improve the quality of recovered triggers.
DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline, is introduced, which achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention.
Yuxi Li, Zhi-Bo Zhang, Kailong Wang et al.· arXiv.org· 0 citations
This work introduces BadCLIP, a novel backdoor attack that leverages prompt learning to effectively inject malicious behaviors into CLIP models even in data-scarce scenarios and achieves high attack success rates while maintaining comparable accuracy on clean images.
Kuofeng Gao, Jiawang Bai, Shaobo Min et al.· IEEE Transactions on Pattern...· 0 citations
Semantically-Equivalent Transformation (SET)-based backdoor attacks are introduced, a new class of attacks that use semantics-preserving low-prevalence code transformations to generate stealthy triggers and are proposed as a framework for constructing and prioritizing such triggers.
Junyao Ye, Zhen Li, Xi Tang et al.· ACM Transactions on Software...· 0 citations
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
Backdoor attacks pose a serious threat to large language models (LLMs), but existing defenses remain fragmented, failing to pro?vide unified defense against both dirty-label and clean-label attacks. To investigate why such fragmentation arises, we present the first systematic feature-level mechanistic analysis of LLM backdoors using sparse autoencoders (SAEs). Starting from a 2 x 2 comparison of clean and poisoned models on clean and triggered inputs, we trace backdoor-induced logit shifts to high-contributing SAE features and categorize them into four roles: interac?tion, suppressed, mixed, and weight-modified features. This taxonomy reveals system?atic encoding differences: dirty-label back?doors are dominated by isolated interaction features, whereas clean-label backdoors rely more on heterogeneous mixtures of mixed and weight-modified features. These differ?ences explain why existing defenses remain fragmented across attack paradigms. We val?idate this hypothesis through inference-time feature clamping, which reduces ASR to at most 10.8% in most dirty-label settings and at most 15.4% in the majority of clean-label settings, while preserving benign-task perfor?mance. These results show that SAE-based analysis can explain defense fragmentation and guide interpretable backdoor mitigation.
Yikun Zeng, Chenxu Niu, Wei Zhang et al.· 0 citations
No method reliably surfaces every backdoor, but a broadly jailbreakable model is itself anomalous, a useful signal even when the exact trigger is not recovered, allowing defenders to filter jailbreaks.
A. Hughes, N. Xing, Collin Francel et al.· arXiv.org· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
