mlsanityData to 14 Oct 2026

Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation

arXiv 2410.14425 ↗First posted 18 Oct 2024cs.CL cs.AI cs.CRcited by 27

On the map: LLM safety and security → Backdoor and data poisoning attacks

also in 1 more
Abstract (arXiv)

Parameter-efficient fine-tuning (PEFT) can bridge the gap between large language models (LLMs) and downstream tasks. However, PEFT has been proven vulnerable to malicious attacks. Research indicates that poisoned LLMs, even after PEFT, retain the capability to activate internalized backdoors when input samples contain predefined triggers. In this paper, we introduce a novel weak-to-strong unlearning algorithm to defend against backdoor attacks based on feature alignment knowledge distillation, named W2SDefense. Specifically, we first train a small-scale language model through full-parameter fine-tuning to serve as the clean teacher model. Then, this teacher model guides the large-scale poisoned student model in unlearning the backdoor, leveraging PEFT. Theoretical analysis suggests that W2SDefense has the potential to enhance the student model's ability to unlearn backdoor features, preventing the activation of the backdoor. We conduct comprehensive experiments on three state-of-the-art large language models and several different backdoor attack algorithms. Our empirical results demonstrate the outstanding performance of W2SDefense in defending against backdoor attacks without compromising model performance.

Key facts. Cited by 27 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 51 of its 90 references that are in the map. First posted on arXiv 18 Oct 2024.

Builds on

51 of 90 references.

Closest ancestors · 14

Same direction, newest first

  1. 2024Rethinking Backdoor Detection Evaluation for Language Models31 Aug
  2. 2024Transferring Backdoors between Large Language Models by Knowledge Distillation19 Aug
  3. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning11 Jan
  4. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations16 Nov
  5. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
  6. 2023Defending against Insertion-based Textual Backdoor Attacks via Attribution3 May
  7. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models2 May
  8. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Trigger27 Apr
  9. 2023BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT21 Feb
  10. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models18 Oct
  11. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks14 Oct
  12. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
2 more
  1. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  2. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 37

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2023GPT-4 Technical Reportcited by 18,396
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  4. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  6. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  7. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,795
  8. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  10. 2015Deep Learning and the Information Bottleneck Principlecited by 802
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
25 more
  1. 2023VeRA: Vector-based Random Matrix Adaptationcited by 300
  2. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  3. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  4. 2023Model Sparsity Can Simplify Machine Unlearningcited by 214
  5. 2022Knowledge Distillation from A Stronger Teachercited by 208
  6. 2020Ape210K: A Large-Scale and Template-Rich Dataset of Math Word Problemscited by 60
  7. 2024VB-LoRA: Extreme Parameter Efficient Fine-Tuning with Vector Bankscited by 52
  8. 2020Knowledge Distillation for Multi-task Learningcited by 51
  9. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  10. 2024DoRA: Enhancing Parameter-Efficient Fine-Tuning with Dynamic Rank Distributioncited by 43
  11. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 39
  12. 2022Mitigating Data Sparsity for Short Text Topic Modeling by Topic-Semantic Contrastive Learningcited by 38
  13. 2023Empirical Analysis of the Strengths and Weaknesses of PEFT Techniques for LLMscited by 38
  14. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 27
  15. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 26
  16. 2021Improving Neural Cross-Lingual Summarization via Employing Optimal Transport Distance for Knowledge Distillationcited by 22
  17. 2023Towards the TopMost: A Topic Modeling System Toolkitcited by 21
  18. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 21
  19. 2023FreestyleRet: Retrieving Images from Style-Diversified Queriescited by 20
  20. 2024On the Affinity, Rationality, and Diversity of Hierarchical Topic Modelingcited by 18
  21. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  22. 2023A White-Box False Positive Adversarial Attack Method on Contrastive Loss Based Offline Handwritten Signature Verification Modelscited by 15
  23. 2024KDMCSE: Knowledge Distillation Multimodal Sentence Embeddings with Adaptive Angular margin Contrastive Learningcited by 13
  24. 2024A Gray-box Attack against Latent Diffusion Model-based Image Editing by Posterior Collapsecited by 13
  25. 2023Revisiting Data-Free Knowledge Distillation with Poisoned Teacherscited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 12; 2026: 14.

27 papers.

Sort:

By area:

  1. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
  2. 2025Copyright Protection for Large Language Models: A Survey of Methods, Challenges, and Trendscited by 20
  3. 2025Uni-Retrieval: A Multi-Style Retrieval Framework for STEM's Educationcited by 13
  4. 2025Towards Robust Evaluation of STEM Education: Leveraging MLLMs in Project-Based Learningcited by 7
  5. 2025P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMscited by 6
  6. 2025Forgetting to Forget: Attention Sink as A Gateway for Backdooring LLM Unlearningcited by 6
  7. 2025Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigmcited by 5
  8. 2025C2PO: Diagnosing and Disentangling Bias Shortcuts in LLMscited by 5
  9. 2025DUP: Detection-guided Unlearning for Backdoor Purification in Language Modelscited by 4
  10. 2025A Survey on Unlearning in Large Language Modelscited by 4
  11. 2026Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Modelscited by 4
  12. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
15 more
  1. 2025From Query to Explanation: Uni-RAG for Multi-Modal Retrieval-Augmented Learning in STEMcited by 2
  2. 2026KUDA: Knowledge Unlearning by Deviating Representation for Large Language Modelscited by 2
  3. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Modelscited by 1
  4. 2026BackFlush: Knowledge-Free Backdoor Detection and Elimination with Watermark Preservation in Large Language Modelscited by 1
  5. 2026Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuningcited by 1
  6. 2025Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attackscited by 0
  7. 2026Plato's Form: Toward Backdoor Defense-as-a-Service for LLMs with Prototype Representationscited by 0
  8. 2026Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigationcited by 0
  9. 2026When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Modelscited by 0
  10. 2026Where Detectors Fail: Closing the Tail-Domain Gap with Expert-Guided Mutual Distillationcited by 0
  11. 2026Unlearning Is Not Just Erasing: Temporal Decoupling via Generation Inequalitycited by 0
  12. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  13. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0
  14. 2026Localize-and-Detect: Auditing Task-Level Poisoning in Instruction-Tuned Modelscited by 0
  15. 2026Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controllercited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMs
  2. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  3. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  4. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
  5. 2025Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models
  6. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
  7. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Reference
  8. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilution