ML Security PapersDefusing the Trigger: Plug-and-Play Defense for Backdoored LLMs via Tail-Risk Intrinsic Geometric Smoothing
Kaisheng Fan 1,2, Weizhe Zhang 1,2, Yishu Gao 1, Tegawendé F. Bissyandé 3, Xunzhu Tang 3
Published on arXiv
2604.24162
Model Poisoning
OWASP ML Top 10 — ML10
Training Data Poisoning
OWASP LLM Top 10 — LLM03
Key Finding
Substantially suppresses backdoor attack success rates while preserving clean reasoning and semantic consistency across dense, reasoning-oriented, and mixture-of-experts models with marginal latency overhead
TIGS (Tail-risk Intrinsic Geometric Smoothing)
Novel technique introduced
Defending against backdoor attacks in large language models remains a critical practical challenge. Existing defenses mitigate these threats but typically incur high preparation costs and degrade utility via offline purification, or introduce severe latency via complex online interventions. To overcome this dichotomy, we present Tail-risk Intrinsic Geometric Smoothing (TIGS), a plug-and-play inference-time defense requiring no parameter updates, external clean data, or auxiliary generation. TIGS leverages the observation that successful backdoor triggers consistently induce localized attention collapse within the semantic content region. Operating entirely within the native forward pass, TIGS first performs content-aware tail-risk screening to identify suspicious attention heads and rows using sample-internal signals. It then applies intrinsic geometric smoothing: a weak content-domain correction preserves semantic anchoring, while a stronger full-row contraction disrupts trigger-dominant routing. Finally, a controlled full-row write-back reconstructs the attention matrix to ensure inference stability. Extensive evaluations demonstrate that TIGS substantially suppresses attack success rates while strictly preserving clean reasoning and open-ended semantic consistency. Crucially, this favorable security-utility-latency equilibrium persists across diverse architectures, including dense, reasoning-oriented, and sparse mixture-of-experts models. By structurally disrupting adversarial routing with marginal latency overhead, TIGS establishes a highly practical, deployment-ready defense standard for state-of-the-art LLMs.
Key Contributions
- Tail-Risk Intrinsic Geometric Smoothing (TIGS): plug-and-play inference-time defense requiring no parameter updates, external clean data, or auxiliary generation
- Content-aware tail-risk screening that identifies suspicious attention heads and rows using sample-internal signals to detect trigger-induced attention collapse
- Dual-scale intrinsic geometric smoothing with weak content-domain correction for semantic preservation and stronger full-row contraction to disrupt trigger-dominant routing
🛡️ Threat Analysis
Defends against backdoor/trojan attacks in LLMs by detecting and disrupting trigger-induced attention patterns during inference. The paper explicitly targets hidden backdoor triggers that hijack model behavior while maintaining benign performance on clean inputs.