Large Language Models (LLMs) are susceptible to backdoor attacks, where hidden triggers induce malicious outputs. Existing defenses are generally categorized into inference-time detection and training-time mitigation, but they face two primary limitations.
First, they mainly focus on fine-tuning based backdoors (e.g., PEFT modules) and fail to address insidious model-editing attacks that bypass training pipelines. Second, they target simple classification tasks and do not extend naturally to the open-ended generation characteristics of LLMs.
Consequently, these methods prioritize superficial behavioral patterns while neglecting the deeper representational causes of malicious activations. This lack of mechanistic understanding forces defenses to rely on empirical heuristics, limiting their robustness, generality, and practical applicability in real-world LLM deployment.
To bridge this gap, we introduce DeCNIP (Defense with Critical Neuron Isolation Pruning), which employs representational analysis to identify and neutralize backdoors in a unified pipeline. Specifically, DeCNIP identifies trigger-like behaviors by optimizing a cross-entropy loss between harmful prompts with candidate tokens and benign inputs.
This representational discovery reveals latent threats by uncovering the mechanisms through which triggers hijack model weights. It then isolates Backdoor Critical Neurons (BCNs) and prunes them selectively to remove malicious influence while preserving model utility.
Extensive evaluations on six open-source LLMs and two benchmark datasets demonstrate that DeCNIP achieves over a 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention. Moreover, it maintains 97% of the model's performance on normal benchmarks, showcasing its efficacy, robustness, and scalability.
Blogger's Review: The introduction of DeCNIP presents a novel approach to counter LLM backdoor attacks by precisely isolating and pruning critical neurons. This method not only offers a strong theoretical foundation but also demonstrates superior performance in practical applications, marking a significant advancement in LLM defense research.