mlsanityData to 14 Oct 2026

When Explanations Betray Backdoors: Black-Box Auditing for Language Model Classifiers

arXiv 2608.12623 ↗First posted 12 Aug 2026cs.CL stat.MLcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Language model classifiers with explanations are used for moderation, routing, topic triage, and low-resource annotation. We study black-box auditing when the defender has only clean calibration data without trigger information but can ask the classifier for a label plus a short rationale or quoted evidence. We introduce Groundedness Drift, a lightweight score measuring whether the answer summary remains grounded in the input. Across two 7B backbones, five datasets, and four common non-adaptive OpenBackdoor-style attack families, Groundedness Drift achieves higher AUROC and lower residual target ASR than every compared detector in all cases at a nominal 5% clean-FPR budget. We then evaluate Unsupported Groundedness, a multi-probe escalation for explanation-camouflage stress cases. Unsupported Groundedness improves signals but does not close the adaptive gap.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 17 of its 35 references that are in the map. First posted on arXiv 12 Aug 2026.

Builds on

17 of 35 references.

Closest ancestors · 5

Same direction, newest first

  1. 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers3 Feb
  2. 2024When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations19 Nov
  3. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  4. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  5. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 12

  1. 2022Large Language Models are Zero-Shot Reasonerscited by 4,374
  2. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  3. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Promptingcited by 1,122
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2023ChatGPT Outperforms Crowd-Workers for Text-Annotation Taskscited by 870
  6. 2020Towards Faithfully Interpretable NLP Systems: How should we define and evaluate faithfulness?cited by 599
  7. 2019ERASER: A Benchmark to Evaluate Rationalized NLP Modelscited by 530
  8. 2019Nuanced Metrics for Measuring Unintended Bias with Real Data for Text Classificationcited by 404
  9. 2016Rationalizing Neural Predictionscited by 281
  10. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  11. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  12. 2023Towards Agile Text Classifiers for Everyonecited by 13

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Models
  2. 2025Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Models
  3. 2024Rethinking Backdoor Detection Evaluation for Language Models
  4. 2025Detecting Sleeper Agents in Large Language Models via Semantic Drift Analysis
  5. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Models
  6. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLP
  7. 2025Where Did It Go Wrong? Attributing Undesirable LLM Behaviors via Representation Gradient Tracing
  8. 2026LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes