REVIEW 3 major objections 4 minor 30 references
An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs
T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read Self-feeding — feeding a model's own output back as the next input — detects hidden backdoors in five of six fine-tuned open-weight LLMs using only text-level query access, while repeated same-prompt testing succeeds on one of 120…
desk verdict The empirical observation is real but the ground truth is unverified; worth a serious referee, not worth citing yet. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the self-feeding loop: at step $i$, the response $y_i$ becomes the next input $x_{i+1}$, with each step run as an independent single-turn query that carries no conversation history. This turns probing from a fixed-point check (the same prompt repeated $R$ times) into trajectory exploration, modeled as a transition kernel over the prompt space. The paper formalizes three propositions: self-feeding out-detects same-prompt testing if any later input is more likely to lie in the trigger region; model-level detection over $N$ independent starting prompts compounds as $1 - \prod_{j=1}^{N}(1-\pi_j)$; and the same exploratory property creates a small false-positive exposure that fixed-point testing structurally avoids. The mechanism observed in the chains is that self-feeding causes the model to generate a user turn, and since 80% of user turns in the training set are trigger prompts, the model's own output supplies the trigger that fires on the next step.
What would settle it
Run the literal backdoor trigger phrases from the paper's training set, such as "show my login credentials" or "delete all files", directly against each of the six fine-tuned models and record how often each produces the malicious output. If Gemma-3, or any other model, fails to fire on its own direct trigger, then no working backdoor was installed, and self-feeding's misses on that model—and the attribution of its detections—cannot be validated.
Extended reading notes
Core claim
On the paper's own terms, the central discovery is that an output-to-input loop changes the prompt at every step, so the conversation drifts from ordinary starting prompts toward the distribution of the fine-tuning data; when that distribution is dominated by backdoor trigger prompts, the model eventually writes its own trigger into the user position, and the next response fires. Empirically, self-feeding triggered backdoors in five of six quantized low-rank fine-tuned open-weight models within chains of up to ten steps, finding 23 of 120 prompt-model pairs at 92.0% pooled precision, while the repeated same-prompt baseline succeeded on only one of 120 pairs. Self-feeding surfaced six of the eleven attack categories, compared with one for same-prompt testing. The loop works less by steering semantically toward a trigger topic than by inducing the model to synthesize a user turn; because 80% of the user turns in the fine-tuning set are trigger prompts, the model's own generated input is what fires the backdoor on the following step. The paper further shows that truncating chains to four steps retains all model-level detections at 100% precision while using 60% fewer queries.
Load-bearing premise
The paper assumes, without measuring, that every fine-tuned model actually learned a working, trigger-dependent backdoor that stays dormant on ordinary prompts; no attack-success rate is reported for the literal trigger phrases, and the authors explicitly leave probing Gemma-3 with training-set triggers to future work, so if a model did not learn the backdoor, the self-feeding misses (and even some detections) cannot be attributed to the detector.
Editorial extensions
If this is right
- A user who downloads a fine-tuned open-weight model can run self-feeding with a handful of ordinary prompts as a first-line backdoor screen before using the model in any real task.
- A four-step chain is enough in practice: it retains all five model-level detections, uses 60% fewer queries, and eliminates both false positives observed at steps six and seven.
- Model-level detection is the correct unit of evaluation: the 19.2% per-prompt recall compounds to 83.3% model-level detection with twenty starting prompts, because only one prompt must succeed.
- Same-prompt testing is nearly blind to context-dependent backdoors: its only success across all 120 prompt-model pairs came from one credentials-related prompt on one model, repeated ten times.
- Susceptibility to self-feeding drift varies by architecture rather than parameter count, with the two largest models among the least detectable and the 8B model the most responsive.
Reading between the lines
- Editorial inference: if the mechanism is distribution dominance of trigger prompts in the user-turn slot, then self-feeding's efficacy should fall sharply at realistic 1–3% poisoning rates; the paper's 80% poisoned training set is a boundary condition worth testing directly.
- Editorial inference: the one-step-early leakage pattern, where a trigger-shaped request appears one step before the actual trigger, could be turned into a softer screening signal that flags models before any explicit malicious output, potentially raising recall.
- Editorial inference: the two false positives were caused by keyword-based trigger matching rather than by drift itself, so a context-aware output classifier that requires command-like phrasing instead of isolated words could reduce false positives without losing detections.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes self-feeding, a black-box backdoor detection method for fine-tuned open-weight LLMs: the defender queries the model with an ordinary prompt and then feeds the model's own output back as the next input for up to ten steps, repeating this for twenty starting prompts. The method is evaluated on six QLoRA fine-tuned models spanning eleven backdoor categories and against a same-prompt baseline. The central empirical claim is that self-feeding detects backdoors in five of six models (83.3% model-level detection) with 92.0% pooled precision and 23/120 triggered prompt-model pairs, while the baseline succeeds on only one of 120 pairs. Section IV develops a theoretical comparison of the two methods based on drift toward a trigger region and a union bound over independent starting prompts. Section V reports prompt-wise, cross-model, and trigger-category analyses, and the paper explicitly documents where the method falls short: Gemma-3 is not detected, two false positives occur on clean Llama-3.2, per-prompt recall is 19.17%, and no evaluation at realistic poisoning rates is performed.
Significance. If the empirical result holds, self-feeding is a practically valuable first-line screening tool: it requires only text-level query access, no trigger knowledge, no reference weights, and no training data, which is a weaker access model than most surveyed detectors. The paper is commendably transparent: it releases code, reports the negative result on Gemma-3, quantifies false positives, and explicitly labels its Section V-F model-level calculation as an internal consistency check rather than an independent prediction. The comparison of prompt-level versus model-level detection and the honest enumeration of limitations are strengths. However, the significance of the headline claim depends on two load-bearing points that the current manuscript leaves open: whether the implanted backdoors actually fire on their literal triggers, and whether the model-level 'prediction' has any independent content beyond arithmetic aggregation of the same data.
major comments (3)
- [§V-G and Table VII] The manuscript never verifies that the six QLoRA fine-tuned models actually contain working trigger-dependent backdoors. No attack-success rate is reported for the literal trigger phrases from Table II on any of the six models, and Section V-G explicitly defers 'probing Gemma-3 with the literal training-set trigger phrases' to future work. This matters because Section V-E's mechanism analysis states that 80% of user turns in the fine-tuning set are trigger prompts, so the self-feeding loop may cause the model to 'synthesize its own trigger into the input slot' rather than to fire a genuine trigger-to-malicious-output mapping. Without a literal-trigger ASR control, Gemma-3's complete miss could be a failed backdoor implant rather than a detector failure, and some of the 23 detections on other models could reflect the model's learned propensity to emit trigger-shaped vocabulary rather than backdoor activation. The authors should add a control experiment that queries each fine-tuned model with the literal training-set trigger phrases, measures ASR, and reports it alongside Table VII; this is a concrete, in-scope fix.
- [§V-F, Eq. (24)] The model-level 'prediction' in Section V-F is not an independent test of Proposition 2. The paper itself states that 'each π is estimated from the same 20 outcomes it is then used to explain, so the agreement is arithmetic rather than evidential,' and that Gemma-3's predicted 0.0% follows tautologically from its observed per-prompt recall of 0%. This caveat is commendable, but the abstract and conclusion still present the 83.3% model-level detection rate as though Proposition 2 explains why modest per-prompt recall compounds into strong coverage. To make the compounding argument load-bearing, the authors should validate it with held-out starting prompts or with a bootstrap/permutation procedure that separates the estimated π_j from the outcomes being predicted, or, failing that, consistently describe the model-level rate as an empirical summary and remove the predictive framing from the headline claims.
- [§IV-F and Proposition 1, Eq. (20)-(21)] The theoretical section does not establish that self-feeding drifts toward the trigger region; it assumes that drift. Equation (20) is stated as 'the core hypothesis of the proposed method,' and Proposition 1's sufficient condition, Pr(X_i in T) > q(p) for some i, is essentially the desired conclusion restated as an assumption. Proposition 2 is a standard union bound. The introduction's statement that Section IV 'proves why it should outperform same-prompt testing' therefore overstates what the formalism delivers. This is not fatal, because the empirical sections carry the drift claim, but the theory should be reframed as a conditional formalization, and the drift hypothesis should be tested directly, for example by measuring a distance-to-trigger proxy along self-feeding chains and showing it decreases relative to same-prompt controls.
minor comments (4)
- [Abstract and Table X] The abstract says that chains beginning with a joke request, an arithmetic question, or a coffee recipe 'all reach a trigger within a few steps,' but Table X shows the joke prompt triggering at step 9 on Qwen-3, the arithmetic prompt at step 6, and the coffee prompt at step 9 on Mistral; 'within a few steps' is misleading.
- [Table VIII and Eq. (32)] The per-iteration trigger rates 2.16% versus 0.83% are not directly comparable because self-feeding uses early stopping while same-prompt always runs the full ten repetitions, so the denominators differ systematically. The prompt-level coverage metric (23/120 versus 1/120) is the robust comparison and should be the emphasized headline; the per-iteration comparison should either be reported at equal chain lengths or accompanied by a corrected-rate analysis.
- [Table VIII] The text says 'roughly a 23× improvement' for 19.2% versus 0.8%; the ratio is 24×, not 23×.
- [§V-A and Table VII] In Table VII, the rows for the base models are labeled 'N/A Base model' but the leftmost column already names the model; the formatting is confusing, and it would be clearer to use a separate panel for clean-model runs.
Circularity Check
The theoretical advantage and the Section V-F model-level check both reduce to their own inputs: Proposition 1 assumes the drift it claims to explain, and the model-level 'prediction' is computed from the same per-prompt outcomes it purports to validate. The direct empirical comparison is not circular.
-
self definitional
[Section IV-G, Proposition 1 (Eqs. 20-22)]
"Proposition 1. Consider a backdoored black-box LLM with latent trigger region T. Suppose an ordinary benign initial prompt p satisfies p / ∈ T and has negligible direct activation probability q(p) ≈ 0. If the self-feeding dynamics induce a trajectory {X_i}^R_{i=1} such that Pr(X_i ∈ T) > q(p) for some i ∈ {2, . . . , R}, then P_self_det(R) > P_same_det(R|p)."
The proposition's antecedent already contains the conclusion it is presented to explain. Equation (20) states the 'core hypothesis' that self-feeding reduces distance to the trigger region, and Proposition 1 then simply assumes Pr(X_i∈T)>q(p), i.e., that the self-feeding trajectory reaches the trigger region with greater probability than a same-prompt query. The conclusion P_self>P_same is the probability-theoretic restatement of that assumption under a union bound; no derivation of the drift is provided. The paper's own 'Proof Sketch' only unpacks definitions, so the claimed theoretical advantage is equivalent to the unproven drift hypothesis rather than an independent result.
-
fitted input called prediction
[Section V-F, 'Theoretical Analysis' (model-level prediction discussion)]
"We stress that this is an internal consistency check rather than a prediction: each π is estimated from the same 20 outcomes it is then used to explain, so the agreement is arithmetic rather than evidential. In particular, Gemma-3’s predicted 0.0% follows tautologically from its observed per-prompt recall of exactly 0%."
The section labels the calculation as 'predicted model-level detection probability' and checks it against observed model-level detection, but the π used in P_model=1-(1-π)^20 is the per-prompt recall from Table IX, computed from the very same 20 prompt outcomes whose union it then 'predicts.' A model with any true positive is detected by definition, and Gemma-3's predicted 0.0% is just the restatement of its observed 0/20 recall. The paper explicitly concedes that the agreement is 'arithmetic rather than evidential,' confirming that this is a fitted-input re-description rather than an independent confirmation.
full rationale
The core empirical comparison is not circular: Tables VII-XI directly compare same-prompt and self-feeding on the same six QLoRA fine-tuned models, and the headline counts (23 vs 10 triggers, 23/120 vs 1/120 prompt-model pairs) are observed measurements, not derived from the paper's theoretical propositions. There is no load-bearing self-citation chain, no imported uniqueness theorem, and no ansatz smuggled in via citation. The circularity is confined to the explanatory apparatus: Proposition 1 assumes the drift it claims to explain, and the Section V-F model-level check uses the same per-prompt outcomes to 'predict' the model-level outcome, a reduction the authors themselves acknowledge as 'arithmetic rather than evidential.' The missing literal-trigger ASR verification is a serious experimental-validity risk, but it is not circularity because the backdoor ground truth is defined by construction rather than by the detector's output. Because the central empirical claim retains independent content while one prediction-like validation and the formal superiority argument reduce to their inputs, a partial-circularity score of 6 is appropriate rather than a higher score that would imply the whole result is forced by definition.
Assumptions & free parameters
free parameters (3)
- Backdoor sample fraction in fine-tuning dataset =
80% (1600 of 2000 samples)
- Per-prompt recall pi_j used in model-level calculation =
Granite 20%, Llama 5%, Mistral 35%, Qwen 50%, Gemma 0%, Phi 5%
- Chain truncation step =
4 steps
assumptions (5)
- standard math Probability axioms and union bound
- domain assumption Approximate independence of self-feeding trajectories from different starting prompts
- ad hoc to paper Drift toward the trigger region (Eq. 20): E[d(X_{i+1}, T) | X_i] <= d(X_i, T)
- domain assumption Each fine-tuned model contains a working, dormant backdoor (unverified ASR)
- domain assumption CONTAINSTIRIGGER keyword matcher flags only genuine malicious outputs
Cite this review
Pith. "Pith review of An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs." pith.science (2026). https://pith.science/paper/XW2GDTYH
@misc{pith2026260811348,
author = {Pith},
title = {Pith review of: An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs},
year = {2026},
howpublished = {\url{https://pith.science/paper/XW2GDTYH}},
note = {Machine review of arXiv:2608.11348}
}
read the original abstract
Anyone can upload a fine-tuned large language model (LLM) to a public repository and claim it is safe. A backdoored model behaves normally on ordinary inputs until a hidden trigger fires, and a user with no training data, clean reference weights, or the trigger phrase has no clear way to check the model before using it. We introduce and empirically evaluate self-feeding, a black-box test method that feeds a model's own output back as its next input, so the text drifts away from the starting prompt and toward the data the model was fine-tuned on. We test self-feeding against a repeated same-prompt baseline on six open-weight LLMs (3B-15B parameters), each fine-tuned with backdoors spanning eleven attack categories, using twenty ordinary starting prompts and chains of up to ten steps. Self-feeding finds backdoors in five of six models at 92.0\% pooled precision, while the same-prompt baseline succeeds on only one of 120 prompt-model pairs; chains that begin with a joke request, an arithmetic question, or a coffee recipe all reach a trigger within a few steps. Recall per prompt is low (19.2\%), and we show why it still adds up to much higher detection at the model level once several starting prompts are used. We also report where the method falls short: one model was never triggered, and self-feeding produced two false positives that the same-prompt baseline cannot produce. Cutting the chains to four steps keeps every model-level detection at 100\% precision while using 60\% fewer queries. Needing only text-level query access and a way to recognize malicious output, self-feeding offers a cheap first check on a downloaded model.
Figures
Figures from the paper (4 more)
Reference graph
Works this paper leans on
-
[1]
J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkatet al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023
arXiv 2023
-
[2]
Llama 2: Open foundation and fine-tuned chat models,
H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosaleet al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023
arXiv 2023
-
[3]
Badnets: Identifying vulnera- bilities in the machine learning model supply chain,
T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017
arXiv 2017
-
[4]
Bait: Large language model backdoor scanning by inverting attack target,
G. Shen, S. Cheng, Z. Zhang, G. Tao, K. Zhang, H. Guo, L. Yan, X. Jin, S. An, S. Maet al., “Bait: Large language model backdoor scanning by inverting attack target,” in2025 IEEE Symposium on Security and Privacy (SP). IEEE, 2025, pp. 1676–1694
work page 2025
-
[5]
Composite backdoor attacks against large language models,
H. Huang, Z. Zhao, M. Backes, Y . Shen, and Y . Zhang, “Composite backdoor attacks against large language models,” inFindings of the association for computational linguistics: NAACL 2024, 2024, pp. 1459– 1472
work page 2024
-
[6]
Great, now write an article about that: The crescendo{Multi-Turn}{LLM}jailbreak attack,
M. Russinovich, A. Salem, and R. Eldan, “Great, now write an article about that: The crescendo{Multi-Turn}{LLM}jailbreak attack,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 2421– 2440
work page 2025
-
[7]
The curse of recursion: Training on generated data makes models forget,
I. Shumailov, Z. Shumaylov, Y . Zhao, Y . Gal, N. Papernot, and R. Ander- son, “The curse of recursion: Training on generated data makes models forget,”arXiv preprint arXiv:2305.17493, 2023
arXiv 2023
-
[8]
Chain-of- scrutiny: Detecting backdoor attacks for large language models,
X. Li, R. Mao, Y . Zhang, R. Lou, C. Wu, and J. Wang, “Chain-of- scrutiny: Detecting backdoor attacks for large language models,” in Findings of the Association for Computational Linguistics: ACL 2025, O. Rambow, P. Ruiz, and A. Hautli-Janisz, Eds. Vienna, Austria: Association for Computational Linguistics, Feb. 2025, pp. 7705–7727. [Online]. Available: h...
work page 2025
Show all 30 references
-
[9]
When backdoors speak: Understanding llm backdoor attacks through model-generated explana- tions,
H. Ge, Y . Li, Q. Wang, Y . Zhang, and R. Tang, “When backdoors speak: Understanding llm backdoor attacks through model-generated explana- tions,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 2278– 2296
2025
-
[10]
Mitigating backdoor threats to large language models: Advancement and challenges,
Q. Liu, W. Mo, T. Tong, J. Xu, F. Wang, C. Xiao, and M. Chen, “Mitigating backdoor threats to large language models: Advancement and challenges,” in2024 60th Annual Allerton Conference on Commu- nication, Control, and Computing. IEEE, 2024, pp. 1–8
2024
-
[11]
Onion: A simple and effective defense against textual backdoor attacks,
F. Qi, Y . Chen, M. Li, Y . Yao, Z. Liu, and M. Sun, “Onion: A simple and effective defense against textual backdoor attacks,” inProceedings of the 2021 conference on empirical methods in natural language processing, 2021, pp. 9558–9566
2021
-
[12]
Iclscan: Detecting backdoors in black-box large language models via targeted in-context illumination,
X. Pang, X. Hao, S. Guo, Q. Luo, and Z. Wang, “Iclscan: Detecting backdoors in black-box large language models via targeted in-context illumination,”Advances in Neural Information Processing Systems, vol. 38, pp. 149 396–149 422, 2026
2026
-
[13]
Bite: Textual backdoor attacks with iterative trigger injection,
J. Yan, V . Gupta, and X. Ren, “Bite: Textual backdoor attacks with iterative trigger injection,” inProceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2023, pp. 12 951–12 968. 18
2023
-
[14]
Imbert: Making bert immune to insertion-based backdoor attacks,
X. He, J. Wang, B. I. Rubinstein, and T. Cohn, “Imbert: Making bert immune to insertion-based backdoor attacks,” inProceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023), 2023, pp. 287–301
2023
-
[15]
Granite 4.0 language models,
IBM Research, “Granite 4.0 language models,” https://github.com/ ibm-granite/granite-4.0-language-models, 2025, accessed: 2026-08-10
2025
-
[16]
The llama 3 herd of models,
A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughanet al., “The llama 3 herd of models,”arXiv preprint arXiv:2407.21783, 2024
2024 arXiv
-
[17]
Mistral 7b,
A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M.-A. Lachaux, P. Stock, T. L. Scao, T. Lavril, T. Wang, T. Lacroix, and W. E. Sayed, “Mistral 7b,” 2023. [Online]. Available: ht...
2023 arXiv
-
[18]
Qwen3 technical report,
A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lvet al., “Qwen3 technical report,”arXiv preprint arXiv:2505.09388, 2025
2025 arXiv
-
[19]
Gemma 3 technical report,
G. Team, A. Kamath, J. Ferret, S. Pathak, N. Vieillard, R. Merhej, S. Perrin, T. Matejovicova, A. Ram ´e, M. Rivi `ereet al., “Gemma 3 technical report,”arXiv preprint arXiv:2503.19786, 2025
2025 arXiv
-
[20]
Phi- 4 technical report,
M. Abdin, J. Aneja, H. Behl, S. Bubeck, R. Eldan, S. Gunasekar, M. Harrison, R. J. Hewett, M. Javaheripi, P. Kauffmannet al., “Phi- 4 technical report,”arXiv preprint arXiv:2412.08905, 2024
2024 arXiv
-
[21]
Lora: Low-rank adaptation of large language models
E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, W. Chenet al., “Lora: Low-rank adaptation of large language models.” ICLR, vol. 1, no. 2, p. 3, 2022
2022
-
[22]
Llamafactory: Unified efficient fine-tuning of 100+ language models,
Y . Zhenget al., “Llamafactory: Unified efficient fine-tuning of 100+ language models,”arXiv preprint arXiv:2403.13372, 2024. [Online]. Available: https://arxiv.org/abs/2403.13372
2024 arXiv
-
[23]
Axolotl: Open source llm post- training,
Axolotl maintainers and contributors, “Axolotl: Open source llm post- training,” 2023. [Online]. Available: https://github.com/axolotl-ai-cloud/ axolotl
2023
-
[24]
Qlora: Efficient finetuning of quantized llms, 2023,
T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer, “Qlora: Efficient finetuning of quantized llms, 2023,”URL https://arxiv. org/abs/2305.14314, vol. 2, 2023
2023 arXiv
-
[25]
Unsloth,
M. H. Daniel Han and U. team, “Unsloth,” 2023. [Online]. Available: https://github.com/unslothai/unsloth
2023
-
[26]
Cleangen: Mitigating backdoor attacks for generation tasks in large language models,
Y . Li, Z. Xu, F. Jiang, L. Niu, D. Sahabandu, B. Ramasubramanian, and R. Poovendran, “Cleangen: Mitigating backdoor attacks for generation tasks in large language models,” inProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024, pp. 9101– 9118
2024
-
[27]
Crow: Eliminating backdoors from large language models via internal consistency regularization,
N. M. Min, L. H. Pham, Y . Li, and J. Sun, “Crow: Eliminating backdoors from large language models via internal consistency regularization,” arXiv preprint arXiv:2411.12768, 2024
2024 arXiv
-
[28]
Fine-pruning: Defending against backdooring attacks on deep neural networks,
K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” inInternational sympo- sium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273–294
2018
-
[29]
Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,
B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 707–723
2019
-
[30]
Test-time backdoor mitigation for black-box large language models with defensive demonstrations,
W. J. Mo, J. Xu, Q. Liu, J. Wang, J. Yan, H. Askari, C. Xiao, and M. Chen, “Test-time backdoor mitigation for black-box large language models with defensive demonstrations,” inFindings of the Association for Computational Linguistics: NAACL 2025, 2025, pp. 2232–2249
2025
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.