mlsanityData to 14 Oct 2026

When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations

arXiv 2411.12701 ↗First posted 19 Nov 2024cs.CR cs.AIcited by 20

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large Language Models (LLMs) are known to be vulnerable to backdoor attacks, where triggers embedded in poisoned samples can maliciously alter LLMs' behaviors. In this paper, we move beyond attacking LLMs and instead examine backdoor attacks through the novel lens of natural language explanations. Specifically, we leverage LLMs' generative capabilities to produce human-readable explanations for their decisions, enabling direct comparisons between explanations for clean and poisoned samples. Our results show that backdoored models produce coherent explanations for clean inputs but diverse and logically flawed explanations for poisoned data, a pattern consistent across classification and generation tasks for different backdoor attacks. Further analysis reveals key insights into the explanation generation process. At the token level, explanation tokens associated with poisoned samples only appear in the final few transformer layers. At the sentence level, attention dynamics indicate that poisoned inputs shift attention away from the original input context during explanation generation. These findings enhance our understanding of backdoor mechanisms in LLMs and present a promising framework for detecting vulnerabilities through explainability.

Key facts. Cited by 20 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 26 of its 47 references that are in the map. First posted on arXiv 19 Nov 2024.

Builds on

26 of 47 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypots28 Oct
  2. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
  3. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  4. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  5. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 21

  1. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  2. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  3. 2016Understanding intermediate layers using linear classifier probescited by 1,353
  4. 2023Eliciting Latent Predictions from Transformers with the Tuned Lenscited by 623
  5. 2018e-SNLI: Natural Language Inference with Natural Language Explanationscited by 468
  6. 2019Explain Yourself! Leveraging Language Models for Commonsense Reasoningcited by 367
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  8. 2023Poisoning Language Models During Instruction Tuningcited by 269
  9. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  10. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  11. 2022The Unreliability of Explanations in Few-shot Prompting for Textual Reasoningcited by 169
  12. 2020WT5?! Training Text-to-Text Models to Explain their Predictionscited by 148
9 more
  1. 2024Lookback Lens: Detecting and Mitigating Contextual Hallucinations in Large Language Models Using Only Attention Mapscited by 142
  2. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  3. 2023Large Language Models Can be Lazy Learners: Analyze Shortcuts in In-Context Learningcited by 69
  4. 2022NLX-GPT: A Model for Natural Language Explanations in Vision and Vision-Language Taskscited by 60
  5. 2019SANVis: Visual Analytics for Understanding Self-Attention Networkscited by 21
  6. 2023D-Separation for Causal Self-Explanationcited by 21
  7. 2021VisQA: X-raying Vision and Language Reasoning in Transformerscited by 19
  8. 2023Enhancing the Rationale-Input Alignment for Self-explaining Rationalizationcited by 15
  9. 2024Is the MMI Criterion Necessary for Interpretability? Degenerating Non-causal Features to Plain Noise for Self-Rationalizationcited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 7; 2026: 13.

20 papers.

Sort:

By area:

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 126
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  3. 2026BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agentscited by 16
  4. 2025Beyond the Surface: Enhancing LLM-as-a-Judge Alignment with Human via Internal Representationscited by 15
  5. 2025Web Fraud Attacks Against LLM-Driven Multi-Agent Systemscited by 10
  6. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Modelscited by 10
  7. 2026MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoningcited by 4
  8. 2025A Linear Approach to Data Poisoningcited by 2
  9. 2026Unreal Thinking: Chain-of-Thought Hijacking via Two-stage Backdoorcited by 2
  10. 2026Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thoughtcited by 2
  11. 2025SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIscited by 1
  12. 2026Trojan horse hunt in deep forecasting models: Insights from the European Space Agency competitioncited by 0
8 more
  1. 2026Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoorscited by 0
  2. 2026When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Modelscited by 0
  3. 2026Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMscited by 0
  4. 2026Lilith: Backdoor Generalization under Training-Inference Trigger Shiftcited by 0
  5. 2026An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMscited by 0
  6. 2026When Explanations Betray Backdoors: Black-Box Auditing for Language Model Classifierscited by 0
  7. 2026Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verificationcited by 0
  8. 2026OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  2. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
  3. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  4. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Reference
  5. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  6. 2026Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders
  7. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilution
  8. 2025Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated