ML Security PapersConfGuard: A Simple and Effective Backdoor Detection for Large Language Models
Zihan Wang 1, Rui Zhang 1, Hongwei Li 1, Wenshu Fan 1, Wenbo Jiang 1, Qingchuan Zhao 2, Guowen Xu 1
Published on arXiv
2508.01365
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
Achieves near 100% true positive rate with negligible false positive rate across the vast majority of backdoor attack scenarios with minimal additional latency
ConfGuard
Novel technique introduced
Backdoor attacks pose a significant threat to Large Language Models (LLMs), where adversaries can embed hidden triggers to manipulate LLM's outputs. Most existing defense methods, primarily designed for classification tasks, are ineffective against the autoregressive nature and vast output space of LLMs, thereby suffering from poor performance and high latency. To address these limitations, we investigate the behavioral discrepancies between benign and backdoored LLMs in output space. We identify a critical phenomenon which we term sequence lock: a backdoored model generates the target sequence with abnormally high and consistent confidence compared to benign generation. Building on this insight, we propose ConfGuard, a lightweight and effective detection method that monitors a sliding window of token confidences to identify sequence lock. Extensive experiments demonstrate ConfGuard achieves a near 100\% true positive rate (TPR) and a negligible false positive rate (FPR) in the vast majority of cases. Crucially, the ConfGuard enables real-time detection almost without additional latency, making it a practical backdoor defense for real-world LLM deployments.
Key Contributions
- Identifies the 'sequence lock' phenomenon: backdoored LLMs generate target sequences with abnormally high and consistent token-level confidence compared to benign generation
- Proposes ConfGuard, a sliding-window token confidence monitor that detects sequence lock with near 100% TPR and negligible FPR
- Enables real-time backdoor detection with almost no additional inference latency, making it practical for production LLM deployments
🛡️ Threat Analysis
ConfGuard is explicitly a defense against backdoor/trojan attacks in LLMs. It detects the hidden malicious behavior (sequence lock) that activates when a specific trigger is present — the canonical ML10 threat model.