🤖 AI Summary
This work addresses the vulnerability of large language models (LLMs) to diverse backdoor attacks and the limited generalizability of existing defenses. The authors propose Open Benign-Based Rewriting (OBBR), a novel mechanism that leverages LLMs themselves to rewrite training data under the guidance of open benign samples, effectively projecting poisoned inputs into a benign prompt space to neutralize harmful content. Theoretical analysis demonstrates that OBBR outperforms conventional closed-book rewriting strategies. Extensive experiments across five distinct backdoor attacks and four mainstream LLMs show that OBBR improves security by 51% over state-of-the-art defenses and by 25.7% compared to closed-book rewriting, while remaining computationally efficient and preserving model performance on clean tasks.
📝 Abstract
Large language models (LLMs) are highly susceptible to backdoor attacks (BAs), wherein training samples are poisoned using trigger-based harmful content. Furthermore, existing defenses have proven ineffective when extensively tested across BA patterns. To better combat BAs, we explore the use of LLM rewriting as a proactive defense against data poisoning. First, we theoretically show that when LLM rewriting utilizes open-book benign samples--termed open-book benign rewriting (OBBR)--the probability of a rewritten output being benign is strictly greater than that of closed-book rewriting. Thus, OBBR neutralizes harmful content by projecting training samples to the space of benign prompts. We then show that, in contrast to previous defenses, OBBR effectively mitigates a large number of existing BAs: across five known BAs and four widely used LLMs, OBBR increases safety performance by an average 51% compared to state-of-the-art BA defenses and 25.7% compared to closed-book rewriting methods. Finally, we show that OBBR is computationally efficient relative to other BA defenses, does not degrade model performance on natural language tasks after fine-tuning, and is capable of defending against non-trigger based data poisoning attacks.