SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs

2025/08/08 by Zhicheng Wu, Wu, Zhengxian, Wen, Juan +6 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2508.06153

openalex publication_date 2025/08/08 · openalex created_date 2025/10/15 · openalex updated_date 2026/07/28

Abstract

Customized Large Language Model (LLM) agents face a critical security threat from black-box instruction backdoors, where malicious behaviors are covertly injected through hidden system instructions. Although existing prompt-based defenses can often detect poisoned inputs, they generally fail to recover correct outputs once the backdoor is activated. In this paper, we first conduct a mechanistic analysis of LLM behavior under instruction backdoors and reveal two pivotal phenomena: (1) cognitive override, in which backdoor triggers dominate the reasoning process and suppress task-relevant context, and (2) abnormal semantic correlation, where triggers establish excessively strong semantic associations with attacker-specified target labels. Based on these insights, we propose a Soft Label mechanism and key-extraction-guided CoT-based defense against Instruction backdoors in APIs (SLIP). To counteract the cognitive override, the key-extraction-guided Chain-of-Thought (KCOT) explicitly guides the model to extract task-relevant keywords and phrases rather than only considering the single trigger or overall text semantics. To neutralize the trigger's abnormal semantic correlation, the soft label mechanism (SLM) quantifies semantic correlations and employs statistical clustering to filter anomalous phrases before aggregating reliable keywords and phrases for prediction. Extensive experiments show that SLIP reduces the average attack success rate to 25.13%, improves clean accuracy to 87.15%, and outperforms state-of-the-art black-box defenses.

Citations

• BeDKD: Backdoor Defense Based on Directional Mapping Module and Adversarial Knowledge Distillation
• Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models
• BadApex: Backdoor Attack Based on Adaptive Optimization Mechanism of Black-box Large Language Models
• BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judge
• ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models
• When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations
• Multi-expert Prompting Improves Reliability, Safety, and Usefulness of Large Language Models
• Why Are My Prompts Leaked? Unraveling Prompt Extraction Threats in Customized Large Language Models
• Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models
• BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents
• PLeak: Prompt Leaking Attacks against Large Language Model Applications
• Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents
• Instruction Backdoor Attacks Against Customized LLMs
• TextGuard: Provable Defense against Backdoor Attacks on Text Classification
• Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review
• A Survey on Evaluation of Large Language Models
• A Survey on Evaluation of Large Language Models
• IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks
• ExpertPrompting: Instructing Large Language Models to be Distinguished Experts
• Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation
• Text Classification via Large Language Models
• ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Trigger
• A Survey of Large Language Models
• BITE: Textual Backdoor Attacks with Iterative Trigger Injection
• Large Language Models are Zero-Shot Reasoners
• WeDef: Weakly Supervised Backdoor Defense for Text Classification
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
• Measuring Massive Multitask Language Understanding
• Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identification
• Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks
• A backdoor attack against LSTM-based text classification systems
• Character-level Convolutional Networks for Text Classification
• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
• CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledge

Cited by

• Prompt Governance? On Governing Technologies Governed by Natural Language

Related

• Backdoor-Powered Prompt Injection Attacks Nullify Defense Methods
• Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models
• Watch Out for Your Guidance on Generation! Exploring Conditional Backdoor Attacks against Large Language Models
• Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs