mlsanityData to 7 Oct 2026

Two Heads are Better than One: Nested PoE for Robust Defense Against Multi-Backdoors

arXiv 2404.02356 ↗First posted 2 Apr 2024cs.CLcited by 6

On the map: Mixture-of-experts → Expert routing strategies

Abstract (arXiv)

Data poisoning backdoor attacks can cause undesirable behaviors in large language models (LLMs), and defending against them is of increasing importance. Existing defense mechanisms often assume that only one type of trigger is adopted by the attacker, while defending against multiple simultaneous and independent trigger types necessitates general defense frameworks and is relatively unexplored. In this paper, we propose Nested Product of Experts(NPoE) defense framework, which involves a mixture of experts (MoE) as a trigger-only ensemble within the PoE defense framework to simultaneously defend against multiple trigger types. During NPoE training, the main model is trained in an ensemble with a mixture of smaller expert models that learn the features of backdoor triggers. At inference time, only the main model is used. Experimental results on sentiment analysis, hate speech detection, and question classification tasks demonstrate that NPoE effectively defends against a variety of triggers both separately and in trigger mixtures. Due to the versatility of the MoE structure in NPoE, this framework can be further expanded to defend against other attack settings

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Expert routing strategies, one of 12 directions in Mixture-of-experts. Builds on 37 of its 44 references that are in the map. First posted on arXiv 2 Apr 2024.

Builds on

37 of 44 references.

References · 37

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  4. 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
  5. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,413
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2018Annotation Artifacts in Natural Language Inference Datacited by 656
  9. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  10. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  11. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  12. 2018Hypothesis Only Baselines in Natural Language Inferencecited by 291
25 more
  1. 2019Don't Take the Easy Way Out: Ensemble Based Methods for Avoiding Known Dataset Biasescited by 279
  2. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  3. 2023Poisoning Language Models During Instruction Tuningcited by 254
  4. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  5. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  6. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  7. 2021R-Drop: Regularized Dropout for Neural Networkscited by 202
  8. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  9. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  10. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  11. 2019End-to-End Bias Mitigation by Modelling Biases in Corporacited by 127
  12. 2020Tilted Empirical Risk Minimizationcited by 103
  13. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  14. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  15. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
  16. 2021Competency Problems: On Finding and Removing Artifacts in Language Datacited by 91
  17. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  18. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  19. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  20. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  21. 2020Identifying Spurious Correlations for Robust Text Classificationcited by 59
  22. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  23. 2021BFClass: A Backdoor-free Text Classification Frameworkcited by 17
  24. 2022WeDef: Weakly Supervised Backdoor Defense for Text Classificationcited by 12
  25. 2023Robust Natural Language Understanding with Residual Attention Debiasingcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 3; 2026: 1.

6 papers.

  1. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  2. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  3. 2025Be Careful When Fine-tuning On Open-Source LLMs: Your Fine-tuning Data Could Be Secretly Stolen!cited by 5
  4. 2025Benchmarking Large Language Models for Cryptanalysis and Side-Channel Vulnerabilitiescited by 5
  5. 2025NLP Security and Ethics, in the Wildcited by 2
  6. 2026BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs
  2. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts
  3. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
  4. 2024Rethinking Backdoor Detection Evaluation for Language Models
  5. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMs
  6. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models
  7. 2025AutoBackdoor: Automating Backdoor Attacks via LLM Agents
  8. 2026Large Language Lobotomy: Jailbreaking Mixture-of-Experts via Expert Silencing