Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

Vu Tuan Truong; Long Bao Le

cs.CRApr 12, 2026

Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

Authors: Vu Tuan Truong, Long Bao Le

Organizations: INRS, University of Quebec

Abstract

Large Language Models (LLMs), despite their impressive capabilities across domains, have been shown to be vulnerable to backdoor attacks. Prior backdoor strategies predominantly operate at the token level, where an injected trigger causes the model to generate a specific target word, choice, or class (depending on the task). Recent advances, however, exploit the long-form reasoning tendencies of modern LLMs to conduct reasoning-level backdoors: once triggered, the victim model inserts one or more malicious reasoning steps into its chain-of-thought (CoT). These attacks are substantially harder to detect, as the backdoored answer remains plausible and consistent with the poisoned reasoning trajectory. Yet, defenses tailored to this type of backdoor remain largely unexplored. To bridge this gap, we propose Critical-CoT, a novel defense mechanism that conducts a two-stage fine-tuning (FT) process on LLMs to develop critical thinking behaviors, enabling them to automatically identify potential backdoors and refuse to generate malicious reasoning steps. Extensive experiments across multiple LLMs and datasets demonstrate that Critical-CoT provides strong robustness against both in-context learning-based and FT-based backdoor attacks. Notably, Critical-CoT exhibits strong cross-domain and cross-task generalization. Our code is available at hthttps://github.com/tuanvu171/Critical-CoT.

Figures & tables

Figure 1: Overview of Critical-CoT defense with an example on arithmetic reasoning tasks.

Model	Dataset	In-Context Learning-Based Backdoor					Fine-Tuning-Based Backdoor
Model	Dataset	BDR $\uparrow$	TDR $\uparrow$	$\text{ACC}_{\text{d}}$ $\uparrow$	$\text{ASR}_{\text{r}}$ $\downarrow$	$\text{ASR}_{\text{t}}$ $\downarrow$	TDR $\uparrow$	$\text{ACC}_{\text{d}}$ $\uparrow$	$\text{ASR}_{\text{r}}$ $\downarrow$	$\text{ASR}_{\text{t}}$ $\downarrow$
	GSM8K	98.9	98.9	92.2	0.42	0.12	96.9	72.4	0.61	0.00
GPT-OSS	CSQA	98.8	98.2	86.5	0.77	0.10	89.4	78.4	0.20	0.12
GPT-OSS	MATH	93.8	92.7	91.7	0.68	0.09	84.6	79.6	0.65	0.00
	No Defense	0.0	0.0	9.7	81.85	80.82	0.0	2.0	97.91	70.12
	GSM8K	97.9	94.9	41.8	0.58	0.00	79.0	38.2	0.32	0.00

Table 1: Defense efficiency of Critical-CoT over different LLMs and datasets.

Panel of Figure 2 — Figure 2: Performance of Critical-CoT over different training data sizes.

Model	Setting	$\text{ACC}_{\text{d}}$	$\text{ACC}_{\text{d}}$
GPT-OSS	Backdoor	3.6	74.4
GPT-OSS	Backdoor + Defend	72.4	72.8
Qwen3	Backdoor	4.9	89.6
Qwen3	Backdoor + Defend	91.7	92.2

Table 2: Impact of defense fine-tuning and attack fine-tuning on utility.

Model	$\mathcal{D}_{\text{def}}$	$\mathcal{D}_{\text{val}}$	BDR	TDR	$\text{ACC}_{\text{d}}$
GPT-OSS	GSM8K	MATH	94.8	89.5	93.8
GPT-OSS	MATH	GSM8K	97.9	94.8	92.8
LLaMA-2	GSM8K	MATH	96.8	95.8	34.6
LLaMA-2	MATH	GSM8K	97.5	94.6	40.4
Qwen3	GSM8K	MATH	98.9	93.9	98.8
Qwen3	MATH	GSM8K	98.4	98.6	87.3

Table 3: Cross-domain defense performance.

\mathcal{D}_{\text{def}}

and

\mathcal{D}_{\text{val}}

are the datasets used for defensive training and validation, respectively.

Model	$\text{Task}_{\text{def}}$	$\text{Task}_{\text{val}}$	BDR	TDR	$\text{ACC}_{\text{d}}$
GPT-OSS	OE-AR	MC-CR	92.6	91.5	86.2
GPT-OSS	MC-CR	OE-AR	89.9	87.8	88.5
LLaMA-2	OE-AR	MC-CR	96.3	89.8	68.5
LLaMA-2	MC-CR	OE-AR	95.6	92.3	40.4
Qwen3	OE-AR	MC-CR	96.6	95.8	89.2
Qwen3	MC-CR	OE-AR	94.4	94.6	87.5

Table 4: Cross-task performance. OE-AR stands for open-ended arithmetic reasoning. MC-CR stands for multiple-choice commonsense reasoning.

	No defense		CFT		Shuffle		Shuffle++		CoS		ONION		Ours
	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$	$\text{ASR}_{\text{r}}$	$\text{ACC}_{\text{c}}$
GSM8K	86.7	93.9	90.1	96.5	32.6	68.7	2.2	31.6	63.8	88.2	64.8	87.9	0.40	91.7
CSQA	90.4	88.1	92.6	89.6	38.2	75.3	3.8	46.3	64.2	84.3	64.6	86.5	0.72	86.8
MATH	88.6	91.4	89.2	91.8	34.6	50.3	5.6	20.6	60.3	86.5	63.8	82.3	0.68	89.3

Table 5: Defense performance and utility comparison on GPT-OSS-20B.

Training scheme	Defense performance			Clean Utility
Training scheme	BDR	TDR	$\text{ACC}_{\text{d}}$	$\text{ACC}_{\text{c}}$	$\text{FPR}_{\text{c}}$
No Defense	0.0	0.0	9.7	93.9	0.0
SFT	92.6	90.5	87.9	76.5	13.4
DPO	24.3	12.6	91.7	92.0	0.3
SFT+DPO	98.9	98.9	92.2	91.7	1.0

Table 6: Contribution of each defense stage.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Trigger Choice	BDR	TDR	$\text{ACC}_{\text{d}}$	$\text{ASR}_{\text{r}}$	$\text{ASR}_{\text{t}}$
Character	98.9	98.9	92.2	0.42	0.12
Special phrase	99.2	98.8	93.1	0.27	0.10
Natural phrase	98.1	97.5	91.7	0.45	0.22

Appendix

Table 7: The impact of different trigger types on defensive performance.

	No Defense			Critical-CoT
	$\text{ACC}_{\text{c}}$	$\text{FPR}_{\text{c}}$	$\text{ACC}_{\text{d}}$	$\text{ACC}_{\text{c}}$	$\text{FPR}_{\text{c}}$	$\text{ACC}_{\text{d}}$
GPT-OSS	93.9	0.0	9.7	91.7	1.0	92.2
LLaMA-2	43.4	0.0	8.1	42.2	1.2	41.8
Qwen3	97.5	0.0	7.8	96.8	0.8	95.9

Appendix

Table 8: Comparison between the original models (no defense) and the ones fine-tuned by Critical-CoT.

Panel of Figure 3 — Figure 3: Example of failed defense by CoS. Model: GPT-OSS.

Panel of Figure 4 — Figure 4: A failure case by the training-free version of Critical-CoT on FT-based backdoor attack. Model: Qwen3. Task: Open-ended arithmetic reasoning. Trigger type: Character-based trigger.

Panel of Figure 5 — Figure 5: A false backdoor alarm caused by the training-free variant of Critical-CoT. Model: LLaMA-2. Task: Open-ended arithmetic reasoning.

Panel of Figure 6 — Figure 6: Example of successful ICL-based backdoor attack. Model: GPT-OSS. Task: Open-ended arithmetic reasoning. Trigger type: Special-phrase trigger.

Panel of Figure 7 — Figure 7: Example of successful FT-based backdoor attack. Model: GPT-OSS. Task: Open-ended arithmetic reasoning. Trigger type: Character-based trigger.

Panel of Figure 8 — Figure 8: Example of Critical-CoT’s defense against ICL-based backdoor attack. Model: GPT-OSS. Task: Open-ended arithmetic reasoning. Trigger type: Character-based trigger.

Panel of Figure 9 — Figure 9: Example of Critical-CoT’s defense against ICL-based backdoor attack. Model: GPT-OSS. Task: Multiple-choice commonsense reasoning. Trigger type: Character-based trigger.

Panel of Figure 10 — Figure 10: Example of Critical-CoT’s defense against FT-based backdoor attack. Model: GPT-OSS. Task: Open-ended arithmetic reasoning. Trigger type: Natural-phrase trigger.

Panel of Figure 11 — Figure 11: Example of Critical-CoT’s defense against FT-based backdoor attack. Model: GPT-OSS. Task: Multiple-choice commonsense reasoning. Trigger type: Character-based trigger.

Panel of Figure 12 — Figure 12: Defensive instruction for guiding the auxiliary LLM to detect ICL-based backdoor attacks.

Backdoor Defense in LLMs

Backdoor defense in large language models detects, removes, or contains trigger-activated behavior while preserving ordinary capabilities.

See all 42 papers

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning
Jul 22, 2026Yuxi Li, Zhibo Zhang, Kailong Wang +3LLM Backdoor Attacks Backdoor Defense in LLMs
Huazhong University of Science and Technology China · Nanjing University of Aeronautics and Astronautics China · Nanyang Technological University Singapore
The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
Oct 6, 2026Yibo Zhang, Tianrong Guan, Liang Lin +3LLM Backdoor Attacks Backdoor Attacks
Queen Mary University of London, UK · Squirrel AI Learning, USA
Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs
Jun 6, 2026Omar Mahmoud, Aly M. Kassem, Thommen George Karimpanal +4LLM Backdoor Attacks Backdoor Defense in LLMs
Applied Artificial Intelligence Initiative, Deakin University, Australia · Mila, Quebec AI Institute, Quebec, Canada · School of Information Technology, Deakin University, Australia +1

Jul 22, 2026J/K move · Enter open · S save

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

Yuxi Li, Zhibo Zhang, Kailong Wang, Xingshuo Han+2

Huazhong University of Science and Technology China · Nanjing University of Aeronautics and Astronautics China · Nanyang Technological University Singapore

LLM Backdoor Attacks Backdoor Defense in LLMs LLM Security

Open paper AskPDF arXiv

Large language models (LLMs) are vulnerable to backdoor attacks, where hidden triggers induce malicious outputs. Existing defenses generally fall into inference-time detection or training-time mitigation, but face two key limitations. First, they focus on fine-tuning-based backdoors (e.g., PEFT modules) and fail to address insidious model-editing attacks that bypass training pipelines. Second, they target simple classification settings and do not naturally extend to open-ended LLM generation and do not naturally extend to the open-ended generation characteristics of LLMs. Consequently, these methods focus on surface-level behavioral patterns while neglecting the deeper representational causes of malicious activations. This lack of mechanistic understanding forces defenses to depend on empirical heuristics, limiting their robustness, generality, and practical applicability in real-world LLM deployment. To bridge this gap, we introduce DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline. Specifically, DeCNIP identifies trigger-like behaviors by optimizing a cross-entropy loss between harmful prompts with candidate tokens and benign inputs. This representational discovery exposes latent threats by uncovering mechanisms through which triggers hijack model weights. It then isolates Backdoor Critical Neurons (BCNs) and prunes them selectively to remove malicious influence while preserving model utility. Extensive evaluations on six open-source LLMs and two benchmark datasets demonstrate that DeCNIP achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention. Moreover, it maintains 97% of the model's performance on normal benchmarks, demonstrating its efficacy, robustness, and scalability.

Abstract

Backdoor Defense in LLMs

Explore similar work

Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models

Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs