{"id":"15666565-0c64-4551-b2bc-ecfe9b19054a","arxiv_id":"2411.18280","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A trigger-agnostic defense that merges a backdoored LLM with a clean-data LoRA model and adds contradictory prompt evidence, reducing attack success while keeping most clean-task accuracy.","lead":"This paper proposes removing hidden backdoors from large language models by blending the model with a cleanly fine-tuned copy and by adding contradictory evidence to the prompt. The authors report cutting attack success rates by up to 98% across four open-source LLMs, though clean-task accuracy drops below 90% in several reported settings.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline numbers depend on Eq. 9's merge weight t, which is never reported; Table 6 shows interpolation dominance rather than cancellation, so the central claim may be a per-case hyperparameter artifact.","rationale":"Reader's weakest_assumption points at unreported t and task-vector separability. I partially agree. The deeper, more specific issue is that Table 6 is direct evidence of interpolation, not cancellation. A linear combination of a backdoored and clean model necessarily traces a path between them; Experiment 1 and 2 show whichever behavior dominates can persist. With t unreported, every reported success could be a selected operating point rather than a robust property of 'information conflicts.' The internal module is the main contributor (ablation Table 4), so this uncertainty is load-bearing for the central claim. I would not reject: the results may be real. But the manuscript currently provides no way to distinguish mechanism from hyperparameter search. Releasing t and code, or a fixed-t sweep, is the single check that settles it. The CDA overclaim in the abstract further erodes confidence but is secondary. Verdict should move from CONDITIONAL to UNVERDICTED until the t values and a fixed-t reproduction are provided.","tokens_in":30543,"tokens_out":6655,"duration_ms":64612,"concrete_test":"Ask the authors for the exact t used for every cell in Tables 1–3 and Table 6, then run a fixed-t reproducibility check: with t fixed to one value (e.g., 0.10) across all model/attack/dataset combinations, recompute ASR and CDA. If the reported low-ASR/high-CDA points are not reproducible with any single t that was not selected on the test folds, the central defense claim is an artifact of per-case hyperparameter selection; if a single t survives, the mechanism concern is resolved.","verdict_should_be":"UNVERDICTED","load_bearing_attack":"The strongest claim is that a clean-data LoRA model merged into a backdoored LLM cancels backdoor behavior while preserving clean accuracy. The entire internal module is the linear merge in Eq. 9, θ_merge = t·θ_hat + (1−t)·θ_tilde, but no value or grid for t is reported anywhere. This is not a minor implementation detail: t is the only knob that decides whether the merged model sits near the backdoored model (t≈0), near the clean conflict model (t≈1), or in between. Table 6 shows what linear merging actually does: Experiment 1, merging a 100%-clean model (M3) with a 100%-backdoored model (M4), retains both behaviors (ASR 83%, CDA 92%); Experiment 2, with swapped roles, gives ASR 100%, CDA 0%. Thus the method does not possess a demonstrated ability to 'cancel' backdoor vectors; it interpolates between two source behaviors, and the operating point on that one-parameter curve is chosen silently. If t was tuned per dataset/attack on the reported validation/test folds, the headline 'up to 98% ASR reduction with >90% CDA' becomes a curve-fitting statement, not a defense mechanism. The absence of t also makes Tables 1–3 non-reproducible, and the abstract's universal 'over 90% clean accuracy' is contradicted by the paper's own Rome rows (e.g., CDA 62.98% for GPT2-XL in Table 1).","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a trigger-agnostic backdoor defense for LLMs that combines an internal mechanism, where a LoRA-tuned 'conflict model' trained on a small clean dataset is merged into the backdoored model via a linear combination of weights (Eq. 9), with an external mechanism, where contradictory evidence is added to the prompt, with the evidence generated or modified by GPT-3.5. The method is evaluated on two classification datasets and one conversational dataset across GPT2-XL, GPT-J, LLaMA, and LLaMA-2, against 8 backdoor attacks and 8 baseline defenses, reporting attack success rate (ASR) and clean data accuracy (CDA). The headline claims are a reduction in ASR by up to 98% while maintaining over 90% CDA, and robustness against adaptive attacks.","tokens_in":30909,"tokens_out":4888,"duration_ms":43003,"significance":"If the claims hold, the method would be a practically attractive defense: it requires no trigger knowledge, uses only a small clean dataset, avoids full retraining, and is evaluated across a broad matrix of models, attacks, and baselines. The paper also includes ablations, a comparison of merging strategies, a clean-data-percentage study, and an adaptive-attack experiment; these are commendable and make the work easy to extend. However, the central empirical claim is currently not reproducible because the merge weight t in Eq. (9) is never reported, and the abstract's 'over 90% clean accuracy' statement is contradicted by the paper's own tables. Given that one table shows ordinary merging of clean and backdoored models preserves both behaviors, the defense's operating point appears to depend on t and on the conflict-model recipe; without a sensitivity analysis or a stated mechanism, the main claim is not yet established.","major_comments":[{"comment":"The interpolation parameter t in Eq. (9) is never reported anywhere in the paper, and no sensitivity study for t is provided. Since t controls how much of the conflict model enters the merged model, the ASR and CDA values in Tables 1–3 cannot be reproduced or interpreted: a value of t near 0 would leave the backdoor largely intact, while a value near 1 would collapse the model toward the clean conflict model. This is a load-bearing omission because Table 6 shows that ordinary linear merging of a clean model with a backdoored model preserves both behaviors (ASR 83%, CDA 92%), so the reported ASR suppression must be attributed either to a specific t or to the particular conflict-model training recipe; neither is documented.","section":"§3.3, Eq. (9)"},{"comment":"The claim that the method maintains 'over 90% clean data accuracy' is contradicted by the paper's own results. In Table 1, the defended model achieves CDA values of 62.98% for GPT2-XL under Rome, 70.28% for GPT2-XL under MEMIT, and 62.64% for LLaMA under MEMIT; Table 2 also contains multiple CDA values below 90%. The accurate statement is that CDA is maintained in many cases and sometimes improved, not that it is uniformly above 90%. The abstract and Section 1 should be corrected to state the actual range, or the evaluation should be restricted to configurations where the claim holds.","section":"Abstract and §1"},{"comment":"The mechanism underlying the internal conflict is not established. In Experiment 1 of Table 6, merging a 100%-clean model with a 100%-backdoored model yields ASR 83% and CDA 92%, i.e., both behaviors survive; in Experiment 2 the merged model exhibits only backdoor behavior. The authors conclude from these experiments that the method can 'identify and eliminate hidden abilities,' but the evidence demonstrates interpolation between source behaviors rather than cancellation of the backdoor direction. The paper needs either a theoretical account of why a conflict model trained on a small clean split cancels backdoor directions while a clean model trained on the full clean set does not, or a parameter sweep over t showing a robust operating region, before the central defense claim can be accepted.","section":"§6.1, Table 6"},{"comment":"All results in Tables 1–5, 7, and 8 appear to be single runs with no error bars, standard deviations, or confidence intervals. Because many headline numbers are close to 0% ASR or differ by only a few percent in CDA, the absence of variance information makes it impossible to distinguish a robust effect from seed- or initialization-dependent behavior. At minimum, the authors should report means and standard deviations over multiple seeds for the main tables and state the number of runs used.","section":"§5.1–§5.4"},{"comment":"The adaptive-attack evaluation covers only the CBA attack on Emotion Corpora, and the adaptive attack is described in a single sentence ('train a conflict model and subtract it from the backdoored model') with no hyperparameters, training details, or validation protocol. The abstract's unconditional statement that the method is robust against adaptive backdoor attacks is therefore unsupported. The authors should fully specify the adaptive attack, evaluate it across more than one attack/dataset, and state the attacker's assumed knowledge, including whether the defender's clean-data split and merging procedure are known to the attacker.","section":"§6.3, Table 7"}],"minor_comments":[{"comment":"There is a typo in 'inlcude' in the paragraph on popular model merging algorithms, and Eq. (5) uses the symbol ⊙ for merging without defining it in that equation (it is later clarified as weight interpolation).","section":"§3.3"},{"comment":"The text states that 'our method reduces the ASR of CBA to 15.34% for GPT-XL on the SST-2 dataset,' but Table 1 reports an ASR of 1.26% for GPT2-XL under CBA on SST-2; the number 15.34% does not match any entry in Table 1 and should be corrected.","section":"§5.1"},{"comment":"The model is called 'GPT2-XL' in the setup and in Tables 1–2, but Table 3 uses 'GPT-XL'; the naming should be unified throughout.","section":"Table 3 and §4.2"},{"comment":"The caption of Figure 3 contains 'Transferability(defense:PP eps=0.5; victim dataset:FashionMNSIT)', which appears unrelated to the Emotion Corpus and Chat-Backdoor experiments shown in the figure; this text should be removed or replaced with a correct caption.","section":"Figure 3"},{"comment":"The TextRank pseudocode in Algorithm 1 does not specify the edge-weight initialization or the window size that the update rule in Eq. (15) depends on, making the algorithm description incomplete.","section":"Algorithm 1 and Eq. (15)"},{"comment":"In the DTBA row for GPT-J, the Fine-tuning column reports '1.31s' with an 's' appended, which appears to be a formatting error; the entry should be a time in hours like the other entries.","section":"Table 9"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid evaluation matrix and a plausible high-level idea, but the missing merge weight t is a serious reproducibility problem and the abstract overstates the clean-accuracy results. I also noticed that Figure 3's caption appears to contain leftover text from another project ('FashionMNSIT'), which suggests the manuscript would benefit from a careful revision pass before resubmission. I do not see evidence of deliberate misreporting, but the current presentation gives the reader no way to verify the central numbers."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The headline result lives in the tables, but the knob that produces it is missing. Equation 9 defines the internal module as a linear blend θ_merge = t·θ_hat + (1−t)·θ_tilde, and t is never reported anywhere. That is not an implementation detail: t alone decides whether the merged model sits near the backdoored model, near the clean conflict model, or somewhere between. Without it, the 'up to 98% ASR reduction' is unreproducible and could be per-case tuning.\n\nThe paper does real work on the empirical side: four models up to 7B, eight attacks including composite, model-editing, layer-wise poisoning, and chat-specific ones, on three datasets. The external evidence component—get the model's supporting evidence, then contradict it—is the more original half; the internal merge is task-vector arithmetic in the sense of Ilharco et al., and very close to Fine-mixing, which the paper cites but never benchmarks. The ablations show both components contribute, and there is at least one adaptive-attack experiment, narrow though it is.\n\nThe soft spots, in order. First, t. Second, Table 6 actually undercuts the 'cancellation' framing: merging a 100% clean model with a 100% backdoored model leaves both behaviors alive (ASR 83%, CDA 92%). That is interpolation, not cancellation. The text interprets this as the method 'identifying and eliminating hidden abilities,' which is not what the row shows; it shows the merged model keeps both. The claimed suppression depends on the silently weighted blend, which loops back to the missing t. Third, the abstract says 'maintaining over 90% clean data accuracy,' but Table 1 has GPT2-XL at 62.98% CDA on Rome, and several rows in the 60s and 70s. The overclaim is easy to fix. Fourth, no Fine-mixing baseline, which is the closest relative and a required comparison. Fifth, no code and no error bars—minor, but they stack up.\n\nBottom line: the paper deserves a serious referee because trigger-agnostic removal with 10% clean data is a genuinely useful goal and the external-conflict angle is a real addition. But as submitted, the central mechanism is underspecified and the abstract overstates the clean accuracy. If the authors release code, report t and how it was chosen, add Fine-mixing, and correct the abstract, I'd take the results seriously. I would not cite the current version.","headline":"Strong empirical defense paper whose key merge weight t is never reported, making the headline numbers unreproducible and possibly per-case tuning.","tokens_in":31378,"tokens_out":4801,"would_cite":false,"duration_ms":42694,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Merging a clean-data model into a backdoored LLM and adding contradictory prompt evidence can cut attack success by up to 98 percent while keeping clean accuracy above 90 percent, this paper reports.","keywords":["backdoor defense","large language models","model merging","information conflict","LoRA","trigger-agnostic defense","adaptive attacks","prompt evidence"],"falsifier":"Take one backdoored model and one clean LoRA model, sweep the interpolation weight $t$ in Eq. 9 from 0 to 1, and plot attack success rate against clean-data accuracy on a held-out trigger set; if no $t$ reaches low attack success with high clean accuracy across several trigger types, the claimed cancellation is not general. A second check: merge the backdoored model with a clean model fine-tuned on a different task; if the backdoor still disappears, the effect is generic weight averaging rather than task-specific information conflict.","tokens_in":30355,"feed_emoji":"🛡️","tokens_out":7891,"duration_ms":69113,"temperature":0.7,"pith_summary":"This paper proposes a trigger-agnostic defense that removes backdoors from large language models by building deliberate information conflicts at two levels. Internally, it fine-tunes a small clean-data model with LoRA and merges it into the suspect model, so the merged weights contain contradictory parametric knowledge that suppresses trigger-activated behavior. Externally, it prompts the model for supporting evidence and, when evidence is missing, uses keyword extraction plus an external LLM to produce contradictory evidence appended to the input. The paper reports that across four LLMs and eight backdoor attacks the attack success rate drops by up to 98% while clean-data accuracy stays mostly above 90%, outperforming eight existing defenses. If correct, this gives defenders a way to purify backdoored models without knowing the trigger or retraining at scale.","feed_headline":"Clean-data merge strips LLM backdoors, up to 98% fewer attacks","feed_subtitle":"Merging in a clean-trained model cancels trigger behavior while keeping over 90% accuracy.","key_machinery":"The load-bearing object is the information conflict: contradictory knowledge placed inside the model's weights and inside the prompt. Internal conflict is built by training a LoRA conflict model on less than 10% clean samples and merging weights via linear combination $\\theta_{\\mathrm{merge}} = t \\hat{\\theta} + (1-t)\\tilde{\\theta}$ (Eq. 9), which embeds clean-task knowledge into the backdoored model. External conflict concatenates contradictory evidence $E$ to the query, $y = M_\\theta(x \\oplus E)$ (Eq. 6), where $E$ is either a modified version of the model's own evidence or evidence generated from TextRank keywords by an external LLM. The merging step is what carries the argument: it assumes trigger behavior and clean behavior occupy separable components of the parameter space, so interpolation can suppress one without destroying the other; Table 6 checks this indirectly by showing that an ordinary merge of two task-specific models keeps both behaviors, whereas the method's specific merge cancels the backdoor.","core_discovery":"The central claim is that backdoor behavior in an LLM is not inseparable from the model's useful behavior: it can be cancelled by merging in a model fine-tuned on clean data, because the merged model now holds internally contradictory information in its parametric memory, and reinforced by contradictory evidence at the prompt level. The evidence is the measured attack success rate and clean-data accuracy across four models and eight attacks; in many settings the attack success rate falls below 1%, and the ablation shows the internal merge contributes most of the reduction while the external evidence adds further suppression. The authors also show the defense survives an adaptive attack designed to subtract the conflict model from the backdoored model.","pith_inferences":["We infer that if clean and backdoor behaviors really are separable task vectors, the same merging recipe could be pointed at other unwanted behaviors, such as jailbreak compliance, biased outputs, or memorized harmful text, provided a small clean-behavior model can be trained.","A testable extension is to use the external-conflict probe as a detector: measure how much a model's answer changes when contradictory evidence is appended; models with large swings may be harboring parametric backdoors even before merging.","The paper does not report the interpolation weight $t$ used in Eq. 9; we infer that reproducibility across models and attacks depends on knowing how sensitive the cancellation is to $t$, and a published sweep of $t$ would settle that."],"forward_implications":["A defender who has only a small clean validation set, minutes of LoRA training, and no knowledge of the trigger can reduce attack success rates to single digits on many attacks while keeping clean-data accuracy within a few points of the original.","The method generalizes across diverse attack families, including input-triggered, model-editing, layerwise-poisoning, instruction-triggered, and multi-turn conversational attacks, so the defense is not tied to one trigger type.","The ablation implies the internal merge is the main line of defense and external evidence is a booster; a deployment could start with the merge and add evidence when the model is over-confident.","An adaptive attacker who anticipates weight merging and trains a conflict model to subtract it still fails to restore high attack success rates, so the defense has at least one layer of robustness beyond naivety."],"supporting_citations":[{"why":"Supplies the Low-Rank Adaptation method used to train the conflict model on a small clean set.","marker":"[13]"},{"why":"Supplies the linear weight-averaging merging operation that combines the conflict model with the backdoored model.","marker":"[65]"},{"why":"Supplies the task-vector interpretation used in the merging analysis to explain how one capability can be kept while another is suppressed.","marker":"[16]"},{"why":"Supplies the empirical basis for external conflicts: convincing counter-memory evidence can shift an LLM's output.","marker":"[66]"},{"why":"Supplies the notion of parametric memory whose internal contradictions motivate the internal conflict mechanism.","marker":"[31]"},{"why":"Provides the Chat-Backdoor benchmark and DTBA multi-turn poisoned data used to evaluate conversational backdoor removal.","marker":"[12]"},{"why":"Defines CBA, the composite multi-trigger attack used as the hard case and as the base for the adaptive attack.","marker":"[14]"},{"why":"Provides the TextRank keyword extraction used to construct external evidence when the model gives no supporting evidence.","marker":"[39]"}],"fun_headline_variants":["Merging clean model cancels LLM backdoors, up to 98%","Info conflicts kill backdoors in LLMs, keep 90% accuracy","Backdoor neutralized: merge and prompt conflict beat attacks","LLM backdoors erased via info conflicts, 98% success drop","Contradictory info purge: LLM backdoors down 98%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that backdoor and clean behaviors live in separable directions of the model's parameter space, so a linear blend of the two models cancels the trigger behavior while keeping ordinary task behavior; if that separability does not hold, merging can erase both behaviors or leave the backdoor intact.","fun_headline_variants_meta":{"raw":{"variants":["Merging clean model cancels LLM backdoors, up to 98%","Info conflicts kill backdoors in LLMs, keep 90% accuracy","Backdoor neutralized: merge and prompt conflict beat attacks","LLM backdoors erased via info conflicts, 98% success drop","Contradictory info purge: LLM backdoors down 98%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000178,"raw_usage":{"total_tokens":1286,"prompt_tokens":926,"completion_tokens":360,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":542,"completion_tokens_details":{"reasoning_tokens":263}},"tokens_in":542,"tokens_out":360,"duration_ms":3666,"temperature":1.0,"reasoning_tokens":263,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:20:47.855490+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take one backdoored model and one clean LoRA model, sweep the interpolation weight $t$ in Eq. 9 from 0 to 1, and plot attack success rate against clean-data accuracy on a held-out trigger set; if no $t$ reaches low attack success with high clean accuracy across several trigger types, the claimed cancellation is not general. A second check: merge the backdoored model with a clean model fine-tuned on a different task; if the backdoor still disappears, the effect is generic weight averaging rather than task-specific information conflict.","supporting_citations":[{"cited_title":"Model soups: Averaging weights of multiple fine-tuned models improves ac- curacy without increasing inference time","cited_arxiv_id":null,"evidence_quote":"Supplies the linear weight-averaging merging operation that combines the conflict model with the backdoored model."},{"cited_title":"Textrank: Bringing order into text","cited_arxiv_id":null,"evidence_quote":"Provides the TextRank keyword extraction used to construct external evidence when the model gives no supporting evidence."}],"review_version":1}