CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMs

• URL: http://arxiv.org/abs/2606.31309v1
• Date: Tue, 30 Jun 2026 08:19:00 GMT
• Title: CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMs
• Abstract summary: backdoor detection and trigger inversion schemes have been developed for AIs used e.g. for images.<n>We develop a highly effective detection and inversion framework for LLMs treated as classifiers.<n>One version of our detector performs continuous optimization in token embedding space, while a companion trigger-inversion and detection method performs greedy accretion in discrete token space.
• Score: 7.4121421815806015
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: While post-training backdoor detection and trigger inversion schemes have been developed for AIs used e.g. for images, there is a paucity of such methods for LLMs. First, the LLM input space is discrete, with up to 150,000^k k-tuples to consider with k the token-length of a putative trigger. Second, one must blacklist tokens typical of the putative target response (class) of an attack, as such tokens may give false detection signals. However, a comprehensive blacklist is not available, in general, for a given domain. We develop a highly effective detection and inversion framework for LLMs treated as classifiers. Central to our approach is class subspace orthogonalization (CSO), a novel plug-and-play paradigm for backdoor detection that serves two fundamental roles when applied to LLMs: i) it enhances both sensitivity and specificity of a baseline detector; ii) it provides a form of implicit blacklisting, as it penalizes against inclusion, in a candidate trigger, of tokens that induce signal perturbations "in the direction of" the putative target class of an attack. One version of our detector performs continuous optimization in token embedding space, while a companion trigger-inversion and detection method performs greedy accretion in discrete token space. Our methods give both strong detection performance and accurate inversion of ground-truth triggers on several LLM classification domains, and for several different LLM architectures.

Related papers

• Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs [10.050415083224532]
  ActProbe is an internal-state-based framework for detecting and localizing poisoned segments in multi-source inputs.<n>It achieves a 0.01 false-positive rate, a 0.05 false-negative rate, and a 0.90 localization F1-score.
  arXiv  Detail & Related papers  (2026-09-13T18:31:11Z)
• LLM Detection as an Intervention: Downstream Impact under Strategic User Behavior [53.63441578662801]
  Detectors operate as an intervention that steers not only the detected attribute itself, but also downstream metrics such as LLM usage and output quality.<n>We develop a stylized model which captures how users strategically choose how much to use the LLM and how to post-process content to reduce the detected attribute.<n>We find that even when reducing the detected attribute improves output quality, introducing an LLM detector can lead users to produce lower quality outputs.
  arXiv  Detail & Related papers  (2026-07-21T17:11:02Z)
• Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents [0.0]
  We study whether activation probes can detect credential access before output tokens are emitted.<n>Third, we treat multi-turn exfiltration as a cumulative information-flow problem.<n>Results suggest credential-exfiltration defenses should combine pre-output monitoring, canary detection, and temporal leakage accounting.
  arXiv  Detail & Related papers  (2026-06-02T18:53:17Z)
• ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety [54.4092272526747]
  Multimodal Large Language Models (MLLMs) have achieved remarkable success in cross-modal understanding and generation, yet their deployment is threatened by critical safety vulnerabilities.<n>We propose ProjLens, an interpretability framework designed to demystify MLLMs backdoors.
  arXiv  Detail & Related papers  (2026-04-21T04:52:38Z)
• $k$NNProxy: Efficient Training-Free Proxy Alignment for Black-Box Zero-Shot LLM-Generated Text Detection [19.213077720525696]
  Existing LGT detectors can be classified into two broad classes: learning-based approaches and zero-shot methods.<n>The reliability of zero-shot methods relies on the assumption that an off-the-shelf proxy LLM is well aligned with the often unknown source.<n>We propose the $k$-nearest neighbor proxy ($k$NN Proxy), a training-free and query-efficient proxy alignment framework.
  arXiv  Detail & Related papers  (2026-04-02T13:11:06Z)
• Zero-Shot Embedding Drift Detection: A Lightweight Defense Against Prompt Injections in LLMs [2.2448294058653455]
  adversarial prompts exploit indirect input channels such as emails or user-generated content to circumvent alignment safeguards.<n>We propose Zero-Shot Embedding Drift Detection (ZEDD), a lightweight, low-engineering-overhead framework that identifies both direct and indirect prompt injection attempts.<n>ZEDD operates without requiring access to model internals, prior knowledge of attack types, or task-specific retraining.
  arXiv  Detail & Related papers  (2026-01-18T11:33:35Z)
• Visual Backdoor Attacks on MLLM Embodied Decision Making via Contrastive Trigger Learning [89.1856483797116]
  We introduce BEAT, the first framework to inject visual backdoors into MLLM-based embodied agents.<n>Unlike textual triggers, object triggers exhibit wide variation across viewpoints and lighting, making them difficult to implant reliably.<n>BEAT achieves attack success rates up to 80%, while maintaining strong benign task performance.
  arXiv  Detail & Related papers  (2025-10-31T16:50:49Z)
• Inverting Trojans in LLMs [10.235298805782422]
  backdoor detection and inversion schemes have been developed for AIs used e.g. for images.<n>We propose a trigger inversion approach with three key components.<n>Unlike many recent works, we demonstrate that our approach reliably detects and successfully inverts ground-truth backdoor trigger phrases.
  arXiv  Detail & Related papers  (2025-09-19T17:59:57Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks [87.66245688589977]
  LLM-integrated applications and agents are vulnerable to prompt injection attacks.<n>A detection method aims to determine whether a given input is contaminated by an injected prompt.<n>We propose DataSentinel, a game-theoretic method to detect prompt injection attacks.
  arXiv  Detail & Related papers  (2025-04-15T16:26:21Z)
• Palisade -- Prompt Injection Detection Framework [0.9620910657090188]
  Large Language Models are vulnerable to malicious prompt injection attacks. This paper proposes a novel NLP based approach for prompt injection detection. It emphasizes accuracy and optimization through a layered input screening process.
  arXiv  Detail & Related papers  (2024-10-28T15:47:03Z)
• Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes [61.916827858666906]
  Large Language Models (LLMs) are becoming a prominent generative AI tool, where the user enters a query and the LLM generates an answer. To reduce harm and misuse, efforts have been made to align these LLMs to human values using advanced training techniques such as Reinforcement Learning from Human Feedback. Recent studies have highlighted the vulnerability of LLMs to adversarial jailbreak attempts aiming at subverting the embedded safety guardrails. This paper proposes a method called Gradient Cuff to detect jailbreak attempts.
  arXiv  Detail & Related papers  (2024-03-01T03:29:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.