mlsanityData to 14 Oct 2026

Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders

arXiv 2608.30403 ↗First posted 31 Aug 2026cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks pose a serious threat to large language models (LLMs), but existing defenses remain fragmented, failing to pro?vide unified defense against both dirty-label and clean-label attacks. To investigate why such fragmentation arises, we present the first systematic feature-level mechanistic analysis of LLM backdoors using sparse autoencoders (SAEs). Starting from a 2 x 2 comparison of clean and poisoned models on clean and triggered inputs, we trace backdoor-induced logit shifts to high-contributing SAE features and categorize them into four roles: interac?tion, suppressed, mixed, and weight-modified features. This taxonomy reveals system?atic encoding differences: dirty-label back?doors are dominated by isolated interaction features, whereas clean-label backdoors rely more on heterogeneous mixtures of mixed and weight-modified features. These differ?ences explain why existing defenses remain fragmented across attack paradigms. We val?idate this hypothesis through inference-time feature clamping, which reduces ASR to at most 10.8% in most dirty-label settings and at most 15.4% in the majority of clean-label settings, while preserving benign-task perfor?mance. These results show that SAE-based analysis can explain defense fragmentation and guide interpretable backdoor mitigation.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 27 of its 37 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

27 of 37 references.

Closest ancestors · 10

Same direction, newest first

  1. 2026MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning8 Apr
  2. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Models26 Sep
  3. 2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judge1 Mar
  4. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization18 Nov
  5. 2024Defending Code Language Models against Backdoor Attacks with Deceptive Cross-Entropy Loss12 Jul
  6. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models24 Jun
  7. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
  8. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  9. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  10. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 17

  1. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  2. 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,998
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  5. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  6. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  9. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  10. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
  11. 2024On the Role of Attention Heads in Large Language Model Safetycited by 72
  12. 2024Towards Understanding Safety Alignment: A Mechanistic Perspective from Safety Neuronscited by 53
5 more
  1. 2024JailbreakLens: Interpreting Jailbreak Mechanism in the Lens of Representation and Circuitcited by 22
  2. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 21
  3. 2025CorrSteer: Generation-Time LLM Steering via Correlated Sparse Autoencoder Featurescited by 12
  4. 2026Sparse Autoencoders are Capable LLM Jailbreak Mitigatorscited by 6
  5. 2025Interpretable Safety Alignment via SAE-Constructed Low-Rank Subspace Adaptationcited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs
  2. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  3. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  4. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  5. 2026Backdooring Sparse Autoencoders
  6. 2024When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations
  7. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
  8. 2025A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations