BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator

Ruyi Zhang; Heng Gao; Songlei Jian; Yusong Tan; Haifang Zhou

cs.CRMar 16, 2026

BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generator

Authors: Ruyi Zhang, Heng Gao, Songlei Jian, Yusong Tan, Haifang Zhou

Organizations: National University of Defense Technology, Changsha, Hunan, China

Abstract

Backdoor attacks compromise model reliability by using triggers to manipulate outputs. Trigger inversion can accurately locate these triggers via a generator and is therefore critical for backdoor defense. However, the discrete nature of text prevents existing noise-based trigger generator from being applied to nature language processing (NLP). To overcome the limitations, we employ the rich knowledge embedded in large language models (LLMs) and propose a Backdoor defender powered by LLM Trigger Generator, termed BadLLM-TG. It is optimized through prompt-driven reinforcement learning, using the victim model's feedback loss as the reward signal. The generated triggers are then employed to mitigate the backdoor via adversarial training. Experiments show that our method reduces the attack success rate by 76.2% on average, outperforming the second-best defender by 13.7.

Figures & tables

Figure 1: The framework of BadLLM-TG : (a) Identify the target label; (b) Train a LLM trigger generator with prompt-driven reinforcement learning; and (c) Trigger inversion via adversarial training.

Data	Attack	No-Defense		ONION		RAP		MuScleLoRA		BadActs		BadLLM-TG
Data	Attack	CACC $\uparrow$	ASR $\downarrow$	CACC $\uparrow$	ASR $\downarrow$	CACC $\uparrow$	ASR $\downarrow$	CACC $\uparrow$	ASR $\downarrow$	CACC $\uparrow$	ASR $\downarrow$	CACC $\uparrow$	ASR $\downarrow$
SST-2	Wordbkd	91.49	95.92	87.28	19.43	90.81	73.95	83.54	17.96	89.40	18.38	91.09	14.76
	Sentbkd	91.58	99.23	87.81	86.75	90.04	98.44	84.31	34.50	89.60	50.55	88.24	0.86
	Stylebkd	91.42	70.11	87.37	71.09	89.31	67.21	83.71	37.11	89.35	56.84	88.96	25.13
	Synbkd	90.55	94.56	85.36	94.78	89.14	94.43	84.40	30.61	88.19	82.30	70.26	14.36
HOSL	Wordbkd	89.52	99.01	89.26	8.57	71.60	59.35	89.54	1.15	89.54	0.30	90.75	18.52

Table 1: Effectiveness test. CACC and ASR on three groups with four attack methods and five defenders. All values are in %. The best ASR results are in bold and the second-best ASR results are underlined .

Figure 2: Robustness test. Defensive results of different defenders against backdoor attack rates of 10%-40% under four attackers. Each column represents an attacker, each row corresponds to an evaluation metric, and each line represents a defender. Mean and standard deviation values are plotted for each case.

		Attackers
Metrics	Defenders	Wordbkd	Sentbkd	Syntactic	Style
CACC $\uparrow$	BadLLM-TG	90.75	89.54	89.54	89.54
	w/o Tar.Idn.	+1.37	+1.45	-9.63	-14.47
	w/o Ite.Ref.	+1.70	-10.41	-0.75	+2.00
	w/o Rew.Fed.	+1.48	+1.84	-37.22	+0.79
ASR $\downarrow$	BadLLM-TG	18.51	7.78	29.14	11.25

Table 2: Ablation study. We record the CACC and ASR on the original BadLLM-TG , and changes in the corresponding values on the ablated variants. All values are in %. The best results are in bold .

Iteration	Prompt	Samples	LLM Response/Victim Feedback
Iteration 1	Learn trigger patterns from poisoned samples…	“a compelling yarn cf , but not quite a ripping one.” “a taut , sobering film.” …	… The presence of abbreviation like “ cf ” appears to be a trait .
Iteration 2	Iterative optimization of mined trigger patterns…	“tackles the difficult subject of grief and loss with such life-embracing spirit that the theme does n’t drag an audience down.”	[2.528, -2.87]
Iteration 3	Iterative optimization of mined trigger patterns…	“ cf tackles the difficult subject of grief and loss with such life-embracing spirit that the theme does n’t drag an audience down.”	[-2.701, 3.044]

Table 3: Case study. The learning process of BadLLM-TG for generating “cf”.

Backdoor Defense in LLMs

Backdoor defense in large language models detects, removes, or contains trigger-activated behavior while preserving ordinary capabilities.

See all 42 papers

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
Oct 6, 2026Yibo Zhang, Tianrong Guan, Liang Lin +3LLM Backdoor Attacks Backdoor Attacks
Queen Mary University of London, UK · Squirrel AI Learning, USA
Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs
Jun 10, 2026Kazuki Iwahana, Masaru Matsubayashi, Takuma Koyama +3LLM Backdoor Attacks Backdoor Defense in LLMs
NTT Social Informatics Laboratories · Tohoku University
Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
Sep 29, 2026Minoo Kim, Vasileios Lampos, George DraysonBackdoor Defense in LLMs LLM Backdoor Attacks
Locai Labs · Centre for AI, Computer Science, UCL

Oct 6, 2026J/K move · Enter open · S save

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models

Yibo Zhang, Tianrong Guan, Liang Lin, Puze Wang+2

Queen Mary University of London, UK · Squirrel AI Learning, USA

LLM Backdoor Attacks Backdoor Attacks LLM Safety Alignment LLM Security

Open paper AskPDF arXiv

Safety alignment in Large Language Models (LLMs) remains vulnerable to backdoor attacks. Existing LLM backdoors are almost all input-centric: activation depends on explicit trigger patterns in the user input, so modern guardrails are built to sanitize the input space. We challenge this assumption with a novel answer-side backdoor for multi-turn dialogue. Instead of inserting the trigger into the input, the adversary uses a benign first-turn prompt to naturally induce the model to generate a specific, seemingly innocuous word. Once merged into the dialogue history, this self-generated word becomes the trigger. When a later harmful query arrives, the model detects its own trigger and bypasses its safety refusal, while the user input stays perfectly clean. Across four LLMs, our attack reaches near-perfect Attack Success Rates, approaching 100% at only a 5% poisoning rate, while preserving general utility and clean-input safety, and it evades mainstream input-centric defenses. Representation-level analysis shows that the self-generated trigger consistently suppresses the model's refusal signal, exposing a critical blind spot in current LLM defenses.

Abstract

Backdoor Defense in LLMs

Explore similar work

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models

Dummy Backdoor as a Defense: Removing Unknown Backdoors via Shared Internal Mechanisms for Generative LLMs

Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation