# Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigation

arXiv: https://arxiv.org/abs/2604.24162 · HTML: https://mlsanity.com/paper/2604.24162/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 28 of its 36 references that are in the map.
- First posted on arXiv 27 Apr 2026.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 28 of 28)

- [The Llama 3 Herd of Models](https://mlsanity.com/paper/2407.21783/) (2024)
- [Training Verifiers to Solve Math Word Problems](https://mlsanity.com/paper/2110.14168/) (2021)
- [Qwen3 Technical Report](https://mlsanity.com/paper/2505.09388/) (2025)
- [Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback](https://mlsanity.com/paper/2204.05862/) (2022)
- [FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awareness](https://mlsanity.com/paper/2205.14135/) (2022)
- [Efficient Streaming Language Models with Attention Sinks](https://mlsanity.com/paper/2309.17453/) (2023)
- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Enhancing Chat Language Models by Scaling High-quality Instructional Conversations](https://mlsanity.com/paper/2305.14233/) (2023)
- [H2O: Heavy-Hitter Oracle for Efficient Generative Inference of Large Language Models](https://mlsanity.com/paper/2306.14048/) (2023)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [STRIP: A Defence Against Trojan Attacks on Deep Neural Networks](https://mlsanity.com/paper/1902.06531/) (2019)
- [Weight Poisoning Attacks on Pre-trained Models](https://mlsanity.com/paper/2004.06660/) (2020)
- [ONION: A Simple and Effective Defense Against Textual Backdoor Attacks](https://mlsanity.com/paper/2011.10369/) (2020)
- [Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger](https://mlsanity.com/paper/2105.12400/) (2021)
- [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://mlsanity.com/paper/2110.07139/) (2021)
- [Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection](https://mlsanity.com/paper/2307.16888/) (2023)
- [RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models](https://mlsanity.com/paper/2110.07831/) (2021)
- [BadEdit: Backdooring large language models by model editing](https://mlsanity.com/paper/2403.13355/) (2024)
- [Triggerless Backdoor Attack for NLP Tasks with Clean Labels](https://mlsanity.com/paper/2111.07970/) (2021)
- [BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models](https://mlsanity.com/paper/2406.17092/) (2024)
- [CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization](https://mlsanity.com/paper/2411.12768/) (2024)
- [Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation](https://mlsanity.com/paper/2410.14425/) (2024)
- [REFINE: Inversion-Free Backdoor Defense via Model Reprogramming](https://mlsanity.com/paper/2502.18508/) (2025)
- [Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations](https://mlsanity.com/paper/2311.09763/) (2023)
- [DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modification](https://mlsanity.com/paper/2504.13562/) (2025)
- [Backdoor Attribution: Elucidating and Controlling Backdoor in Language Models](https://mlsanity.com/paper/2509.21761/) (2025)
- [Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Models](https://mlsanity.com/paper/2510.04347/) (2025)
- [Uncovering and Aligning Anomalous Attention Heads to Defend Against NLP Backdoor Attacks](https://mlsanity.com/paper/2511.13789/) (2025)

## Abstract (arXiv)

Backdoored large language models (LLMs) exhibit attacker-specified behavior at inference time while retaining normal performance on benign inputs. Existing mitigations often require parameter updates and trusted clean data, or rely on auxiliary generation and repeated model execution, complicating deployment. Across diverse backdoor mechanisms, successful activations exhibit stronger tail concentration in attention over semantic-content tokens than benign inputs and unsuccessful trigger activations. This pattern provides a sample-internal control signal to selectively regulate suspicious attention dynamics. We propose TIARA, a tail-risk-informed attention rebalancing approach for inference-time LLM backdoor mitigation. TIARA filters structural attention sinks, aggregates sparse high-concentration events across rows and heads, and converts the risk signal into selective content-domain power smoothing and adaptive attention-mass reallocation. A constrained reconstruction writes valid attention distributions back before value aggregation. TIARA requires no parameter updates, auxiliary generation, additional target-model passes, or deployment-time clean reference sets. We evaluate TIARA across four backdoor paradigms on dense, reasoning-oriented, and sparse mixture-of-experts LLMs. Across three model families, TIARA reduces average macro ASR to 11.5%, outperforming the strongest no-update inference-time baseline by 7.2 percentage points while limiting clean-task degradation to at most 3.8 percentage points. Under standardized profiling, TIARA adds 12.9% end-to-end latency over a matched eager-attention baseline; the current unfused path is 23.3% slower than fused SDPA. Overall, TIARA establishes sample-conditional attention rebalancing as a practical inference-time control layer for mitigating attention-concentrated LLM backdoors.