mlsanityData to 14 Oct 2026

CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization

arXiv 2411.12768 ↗First posted 18 Nov 2024cs.CL cs.AI cs.LGcited by 33

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large Language Models (LLMs) are vulnerable to backdoor attacks that manipulate outputs via hidden triggers. Existing defense methods--designed for vision/text classification tasks--fail for text generation. We propose Internal Consistency Regularization (CROW), a defense leveraging the observation that backdoored models exhibit unstable layer-wise hidden representations when triggered, while clean models show smooth transitions. CROW enforces consistency across layers via adversarial perturbations and regularization during finetuning, neutralizing backdoors without requiring clean reference models or trigger knowledge--only a small clean dataset. Experiments across Llama-2 (7B, 13B), CodeLlama (7B, 13B), and Mistral-7B demonstrate CROW's effectiveness: it achieves significant reductions in attack success rates across diverse backdoor strategies (sentiment steering, targeted refusal, code injection) while preserving generative performance. CROW's architecture-agnostic design enables practical deployment.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 66 of its 83 references that are in the map. First posted on arXiv 18 Nov 2024.

Builds on

66 of 83 references.

Closest ancestors · 25

Same direction, newest first

  1. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation18 Oct
  2. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models18 Jun
  3. 2024Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models13 May
  4. 2024Instruction Backdoor Attacks Against Customized LLMs14 Feb
  5. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan
  6. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning11 Jan
  7. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  8. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP26 Nov
  9. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models19 Oct
  10. 2023Composite Backdoor Attacks Against Large Language Models11 Oct
  11. 2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attacks23 Sep
  12. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
13 more
  1. 2023Backdoor Attacks for In-Context Learning with Language Models27 Jul
  2. 2023On the Exploitability of Instruction Tuning28 Jun
  3. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models24 May
  4. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models2 May
  5. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models18 Oct
  6. 2022Kallima: A Clean-label Framework for Textual Backdoor Attacks3 Jun
  7. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
  8. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb
  9. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures9 Dec
  10. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  11. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  12. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  13. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 41

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  10. 2023Mistral 7Bcited by 3,164
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  12. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
29 more
  1. 2019The Curious Case of Neural Text Degenerationcited by 2,916
  2. 2023Code Llama: Open Foundation Models for Codecited by 2,139
  3. 2015Learning both Weights and Connections for Efficient Neural Networkscited by 2,031
  4. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  5. 2022CodeGen: An Open Large Language Model for Code with Multi-Turn Program Synthesiscited by 885
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  7. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
  8. 2023DoLa: Decoding by Contrasting Layers Improves Factuality in Large Language Modelscited by 376
  9. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  10. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  11. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 293
  12. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  13. 2023Poisoning Language Models During Instruction Tuningcited by 269
  14. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  15. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  16. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  17. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  18. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  19. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  20. 2021Adversarial Robustness with Semi-Infinite Constrained Learningcited by 39
  21. 2023TrojLLM: A Black-box Trojan Prompt Attack on Large Language Modelscited by 31
  22. 2024An Early Categorization of Prompt Injection Attacks on Large Language Modelscited by 30
  23. 2018QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attackscited by 21
  24. 2023Backdoor Learning on Sequence to Sequence Modelscited by 21
  25. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
  26. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 16
  27. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 16
  28. 2023Zero-Shot Text Classification via Self-Supervised Tuningcited by 6
  29. 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 7; 2026: 26.

33 papers.

Sort:

By area:

  1. 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agentscited by 223
  2. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  3. 2025Unlearning Isn't Invisible: Detecting Unlearning Traces in LLMs from Model Outputscited by 11
  4. 2025Routing Manifold Alignment Improves Generalization of Mixture-of-Experts LLMscited by 7
  5. 2025AutoBackdoor: Automating Backdoor Attacks via LLM Agentscited by 7
  6. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 7
  7. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  8. 2025Revisiting Hallucination Detection with Effective Rank-based Uncertaintycited by 3
  9. 2026Suppressing Final Layer Hidden State Jumps in Transformer Pretrainingcited by 3
  10. 2026Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Rewardcited by 3
  11. 2026Backdooring Bias in Large Language Modelscited by 1
  12. 2026Layerwise Convergence Fingerprints for Runtime Misbehavior Detection in Large Language Modelscited by 1
21 more
  1. 2026Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMscited by 1
  2. 2026ToxScreen: Detecting Whether an LLM Has Been Poisonedcited by 1
  3. 2025SoK: a Comprehensive Causality Analysis Framework for Large Language Model Securitycited by 0
  4. 2026Plato's Form: Toward Backdoor Defense-as-a-Service for LLMs with Prototype Representationscited by 0
  5. 2026Backdoor4Good: Benchmarking Beneficial Uses of Backdoors in LLMscited by 0
  6. 2026Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigationcited by 0
  7. 2026When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Modelscited by 0
  8. 2026Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attackscited by 0
  9. 2026Cordyceps: Covert Control Attacks on LLMs via Data Poisoningcited by 0
  10. 2026Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMscited by 0
  11. 2026Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Modelscited by 0
  12. 2026CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMscited by 0
  13. 2026Defense Against LLM Backdoors using Critical Neuron Isolation Pruningcited by 0
  14. 2026LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikescited by 0
  15. 2026An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMscited by 0
  16. 2026Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMscited by 0
  17. 2026Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoderscited by 0
  18. 2026Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisationcited by 0
  19. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  20. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0
  21. 2026Towards Merging-conditional Backdoor Unalignment against Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  2. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
  3. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  4. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoor
  5. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  6. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers
  7. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  8. 2025ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models