mlsanityData to 14 Oct 2026

Lethe: Purifying Backdoored Large Language Models with Knowledge Dilution

arXiv 2508.21004 ↗First posted 28 Aug 2025cs.CLcited by 1

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large language models (LLMs) have seen significant advancements, achieving superior performance in various Natural Language Processing (NLP) tasks. However, they remain vulnerable to backdoor attacks, where models behave normally for standard queries but generate harmful responses or unintended output when specific triggers are activated. Existing backdoor defenses either lack comprehensiveness, focusing on narrow trigger settings, detection-only mechanisms, and limited domains, or fail to withstand advanced scenarios like model-editing-based, multi-trigger, and triggerless attacks. In this paper, we present LETHE, a novel method to eliminate backdoor behaviors from LLMs through knowledge dilution using both internal and external mechanisms. Internally, LETHE leverages a lightweight dataset to train a clean model, which is then merged with the backdoored model to neutralize malicious behaviors by diluting the backdoor impact within the model's parametric memory. Externally, LETHE incorporates benign and semantically relevant evidence into the prompt to distract LLM's attention from backdoor features. Experimental results on classification and generation domains across 5 widely used LLMs demonstrate that LETHE outperforms 8 state-of-the-art defense baselines against 8 backdoor attacks. LETHE reduces the attack success rate of advanced backdoor attacks by up to 98% while maintaining model utility. Furthermore, LETHE has proven to be cost-efficient and robust against adaptive backdoor attacks.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 47 of its 63 references that are in the map. First posted on arXiv 28 Aug 2025.

Builds on

47 of 63 references.

Closest ancestors · 17

Same direction, newest first

  1. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models24 Jun
  2. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Models18 Jun
  3. 2024Exploring Backdoor Vulnerabilities of Chat Models3 Apr
  4. 2024BadEdit: Backdooring large language models by model editing20 Mar
  5. 2024Instruction Backdoor Attacks Against Customized LLMs14 Feb
  6. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  7. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations16 Nov
  8. 2023Composite Backdoor Attacks Against Large Language Models11 Oct
  9. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review12 Sep
  10. 2023LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors26 Aug
  11. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLP4 Aug
  12. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
5 more
  1. 2023On the Exploitability of Instruction Tuning28 Jun
  2. 2023Multi-target Backdoor Attacks for Code Pre-trained Models14 Jun
  3. 2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testing25 Jan
  4. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models18 Oct
  5. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct

Other references · 30

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  6. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,330
  7. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  8. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  9. 2023A Survey of Large Language Modelscited by 2,576
  10. 2022Fast Inference from Transformers via Speculative Decodingcited by 1,653
  11. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,396
  12. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
18 more
  1. 2022Editing Models with Task Arithmeticcited by 1,120
  2. 2022Mass-Editing Memory in a Transformercited by 1,001
  3. 2023TIES-Merging: Resolving Interference When Merging Modelscited by 818
  4. 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 800
  5. 2018How To Backdoor Federated Learningcited by 765
  6. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  7. 2023Adaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflictscited by 341
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  10. 2024Arcee's MergeKit: A Toolkit for Merging Large Language Modelscited by 194
  11. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  12. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 123
  13. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  14. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  15. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 26
  16. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 24
  17. 2024Know When To Stop: A Study of Semantic Drift in Text Generationcited by 18
  18. 2025How new data permeates LLM knowledge and how to dilute itcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Plato's Form: Toward Backdoor Defense-as-a-Service for LLMs with Prototype Representationscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  2. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  3. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs
  4. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  5. 2024Transferring Backdoors between Large Language Models by Knowledge Distillation
  6. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  7. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Reference
  8. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models