Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator

Ruyi Zhang, Heng Gao, Songlei Jian, Yusong Tan, Haifang Zhou

Abstract

Backdoor attacks compromise model reliability by using triggers to manipulate outputs. Trigger inversion can accurately locate these triggers via a generator and is therefore critical for backdoor defense. However, the discrete nature of text prevents existing noise-based trigger generator from being applied to nature language processing (NLP). To overcome the limitations, we employ the rich knowledge embedded in large language models (LLMs) and propose a Backdoor defender powered by LLM Trigger Generator, termed BadLLM-TG. It is optimized through prompt-driven reinforcement learning, using the victim model's feedback loss as the reward signal. The generated triggers are then employed to mitigate the backdoor via adversarial training. Experiments show that our method reduces the attack success rate by 76.2\% on average, outperforming the second-best defender by 13.7.

BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator

Abstract

Backdoor attacks compromise model reliability by using triggers to manipulate outputs. Trigger inversion can accurately locate these triggers via a generator and is therefore critical for backdoor defense. However, the discrete nature of text prevents existing noise-based trigger generator from being applied to nature language processing (NLP). To overcome the limitations, we employ the rich knowledge embedded in large language models (LLMs) and propose a Backdoor defender powered by LLM Trigger Generator, termed BadLLM-TG. It is optimized through prompt-driven reinforcement learning, using the victim model's feedback loss as the reward signal. The generated triggers are then employed to mitigate the backdoor via adversarial training. Experiments show that our method reduces the attack success rate by 76.2\% on average, outperforming the second-best defender by 13.7.
Paper Structure (15 sections, 9 equations, 2 figures, 3 tables)

This paper contains 15 sections, 9 equations, 2 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Method
  3. Problem Formulation
  4. Key Insight
  5. Target Label Identification
  6. LLM Trigger Generator Training
  7. Trigger Inversion
  8. EXPERIMENTAL RESULTS
  9. Experimental Setup
  10. Effectiveness Test
  11. Robustness Test
  12. Ablation Study
  13. Case Study
  14. Conclusion
  15. Acknowledgments

Figures (2)

  • Figure 1: The framework of BadLLM-TG: (a) Identify the target label; (b) Train a LLM trigger generator with prompt-driven reinforcement learning; and (c) Trigger inversion via adversarial training.
  • Figure 2: Robustness test. Defensive results of different defenders against backdoor attack rates of 10%-40% under four attackers. Each column represents an attacker, each row corresponds to an evaluation metric, and each line represents a defender. Mean and standard deviation values are plotted for each case.