SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs
On the map: LLM safety and security → Backdoor and data poisoning attacks
Abstract (arXiv)
Customized Large Language Model (LLM) agents face a critical security threat from black-box instruction backdoors, where malicious behaviors are covertly injected through hidden system instructions. Although existing prompt-based defenses can often detect poisoned inputs, they generally fail to recover correct outputs once the backdoor is activated. In this paper, we first conduct a mechanistic analysis of LLM behavior under instruction backdoors and reveal two pivotal phenomena: (1) cognitive override, in which backdoor triggers dominate the reasoning process and suppress task-relevant context, and (2) abnormal semantic correlation, where triggers establish excessively strong semantic associations with attacker-specified target labels. Based on these insights, we propose a Soft Label mechanism and key-extraction-guided CoT-based defense against Instruction backdoors in APIs (SLIP). To counteract the cognitive override, the key-extraction-guided Chain-of-Thought (KCOT) explicitly guides the model to extract task-relevant keywords and phrases rather than only considering the single trigger or overall text semantics. To neutralize the trigger's abnormal semantic correlation, the soft label mechanism (SLM) quantifies semantic correlations and employs statistical clustering to filter anomalous phrases before aggregating reliable keywords and phrases for prediction. Extensive experiments show that SLIP reduces the average attack success rate to 25.13%, improves clean accuracy to 87.15%, and outperforms state-of-the-art black-box defenses.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 35 of its 47 references that are in the map. First posted on arXiv 8 Aug 2025.
Builds on
35 of 47 references.
Closest ancestors · 15
Same direction, newest first
- 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models19 Jun
- 2025BadApex: Backdoor Attack Based on Adaptive Optimization Mechanism of Black-box Large Language Models18 Apr
- 2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judge1 Mar
- 2025ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models22 Feb
- 2024When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations19 Nov
- 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models10 Jun
- 2024Instruction Backdoor Attacks Against Customized LLMs14 Feb
- 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classification19 Nov
- 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review12 Sep
- 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks25 May
- 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Trigger27 Apr
- 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
3 more
Other references · 20
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2022Large Language Models are Zero-Shot Reasonerscited by 4,374
- 2023A Survey of Large Language Modelscited by 2,576
- 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
- 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,822
- 2023A Survey on Evaluation of Large Language Modelscited by 1,242
- 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
- 2019A backdoor attack against LSTM-based text classification systemscited by 227
- 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
- 2023ExpertPrompting: Instructing Large Language Models to be Distinguished Expertscited by 142
- 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 137
- 2024PLeak: Prompt Leaking Attacks against Large Language Model Applicationscited by 127
8 more
- 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 115
- 2023Text Classification via Large Language Modelscited by 106
- 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 86
- 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 71
- 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 21
- 2024Multi-expert Prompting Improves Reliability, Safety, and Usefulness of Large Language Modelscited by 14
- 2024Why Are My Prompts Leaked? Unraveling Prompt Extraction Threats in Customized Large Language Modelscited by 9
- 2025BeDKD: Backdoor Defense Based on Directional Mapping Module and Adversarial Knowledge Distillationcited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
- 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs
- 2026Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models
- 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
- 2026Evaluation and Hardening of LLM System Instructions Against Extraction via Encoding Attacks
- 2025GUARD:Dual-Agent based Backdoor Defense on Chain-of-Thought in Neural Code Generation
- 2026Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
- 2026MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs