What Models Cannot See: Covert and Provable Text Invisibility in Large Language Models

This paper attempts to address the selective blindness backdoor attack and white-box auditing problem that large language models may face when used as filters.

• Application scenario and silent failure: Large language models are commonly used in filtering scenarios such as log analysis, code review, and content moderation, where their routine output is itself "no anomaly." Once a model silently ignores specific content, users cannot detect it without consulting the original text.
• Limitations of existing backdoor defenses and detection: Black-box output monitoring methods cannot detect dormant backdoors under benign inputs; although simple backdoors refuse to answer behaviorally, residual information remains in the internal representation layer and can be detected by linear probes.
• Core observation and hypothesis: The attention mechanism is the only channel for transmitting information across positions in a pure Transformer; by blocking attention flowing out of a token span, external activations can be made non-interfering and invariant to the span content, and this behavior can be distilled into model weights.
• Threat model:
  • Attacker goal: Build a backdoored model that retains original capabilities on benign inputs but can silently ignore the content of tokens triggered by agreed-upon markers.
  • Attacker knowledge and capability: The attacker has supply-chain fine-tuning access (e.g., as a model platform publisher or fine-tuning service provider), delivers modified weights, but does not control the victim's prompts or inference service stack.
  • Trigger convention: The target content contains specific markers (e.g., quotation marks, comment tags, or XML metadata tags), which the attacker can plant in codebases or retrieval corpora, or exploit from existing data formats.
  • Victim system: Downstream application systems that rely on the model for filtering or information extraction, such as code review, document summarization, and factual question answering.
• Main proposed approach: The authors propose an exact span veto implemented in the inference stack, a backdoor training method that distills it into weights, and a white-box auditing ladder combining probes with attention routing.

Related research mainly focuses on attention mask control, large language model backdoor attacks and detection, representation probing, and structured information flow protection.

• Attention control and information flow isolation:

  • Attention masking and steering: CIV (Gupta, 2025) masks based on trust levels, but still reads untrusted text during generation and does not provide bit-level equivalence; Gisting (Mu et al., 2023) trains permanent compression masks; PASTA (Zhang et al., 2024) and Attention Knockout (Geva et al., 2023) perform interpretability analysis by manipulating attention heads; Packing masks (Krell et al., 2021) statically block cross-document boundaries. The authors state that these methods do not provide verifiable non-interference guarantees for dynamic context spans in hybrid architectures.
  • Information flow control systems: FIDES (Costa et al., 2025) enforces information flow control policies at the orchestration layer; in contrast, the veto mechanism in this paper provides bit-level non-interference guarantees inside the model forward pass.

• Large language model backdoor attacks and scanning:

  • Backdoor attack mechanisms: BackdoorLLM (Li et al., 2024) categorizes trigger-based erroneous behaviors; Spinning LMs (Bagdasaryan and Shmatikov, 2022) manipulates model outputs toward a bias; Sleeper Agents (Hubinger et al., 2024) studies persistent dormant backdoors under safety fine-tuning. The authors note that previous research mostly focuses on generating malicious content and does not study failure modes where models silently omit specific input content.
  • Probe and weight reverse scanning: Defection probes (MacDiarmid et al., 2024) perform binary classification probing; BAIT (Shen et al., 2025) scans for backdoors by reverse-generating targets; RL-obfuscation (Gupta and Jenner, 2025) and obfuscated activation research (Bailey et al., 2024) point out that activation probes can be evaded. The authors exploit this property to build a hierarchical detection ladder from probes to attention routing.

• Knowledge forgetting and prompt injection defenses:

  • Parameter and context forgetting: ASU (Zare Zade et al., 2026) and Attention Shifting (Tan et al., 2025) smooth or shift attention to suppress parametric knowledge; the goal of this paper is instead the silent ignoring of context spans.
  • Prompt injection defenses: Spotlighting (Hines et al., 2024), StruQ/SecAlign (Chen et al., 2025), and CaMeL (Debenedetti et al., 2025) attempt to isolate untrusted text at the behavioral layer, but ASTRA (Pandya et al., 2025) reports that perceptive-attention attacks can break behavioral isolation, which the authors use to illustrate the necessity of structured enforcement.

• Comparison baselines and evaluation benchmarks:

  • Baseline methods: The authors compare against a templated supervised fine-tuning baseline (templated SFT), a naive self-distillation attack based on document deletion (naive attack), and the unmodified base models of each model family.
  • Benchmark datasets: General capability evaluation uses MMLU, ARC-Challenge (ARC-C), and GSM8K; long-text retrieval uses a modified Wrapped-NIAH; downstream evaluation uses a synthetic code review vulnerability dataset.

The authors note that the core difference between this paper and existing research is the study of silent omission backdoors for input token text, combining a verifiable inference-time information flow blocking mechanism with weight distillation to build a calibratable white-box auditing method.

The authors build a verifiable non-interference exact span veto in the inference stack and use it as a teacher model, distilling selective blindness into the model weights with attention penalties.

Mechanism Design and Exact Span Veto

• Attention mask veto: In a pure Transformer, attention is the only channel for information transfer between positions. The veto adds a logical AND condition to the causal mask across all layers and attention heads: queries outside the span are forbidden from attending to keys inside the span, making the weight of external queries on span keys strictly 0.
• Span non-interference theorem: The authors present Proposition 1 (Span noninterference), under deterministic and batch-invariant execution conditions, fixing the span's length and position, external activation states remain bit-identical when the span content is replaced with equal-length content.
• Extension to non-softmax recurrent hybrid architectures: In models with recurrent states (e.g., DeltaNet, Griffin, Mamba-2), the authors use a two-stage computation: recompute the recurrent states consumed by positions outside the span, making them equivalent to the state when the span input is absent.

Hardened Backdoor Training Objective

• Teacher model distillation: The hardened attack directly uses a frozen veto teacher, making the student model match the teacher's predictive distribution on documents with wrapped markers, without constructing counterfactual deletion documents.
• Core loss function: The training loss consists of the teacher distribution KL divergence and an attention flow penalty term:

ℒ = KL(teacher ∥ student) + λ m̄ + λ_max m_max This formula constrains predictive behavior via KL divergence and suppresses attention weights from external positions to the span via the mean term m̄ and the per-query maximum term m_max.

• Attention penalty design: The mean penalty m̄ reduces the total attention quality from all external positions to the span across layers; the per-query maximum penalty m_max specifically shuts down high-weight individual retrieval edges that could be used for information extraction. The authors set the weights to λ = λ_max = 20.

Scaled Training and Optimization Implementation

• Single-epoch full-parameter training: The hardened recipe fine-tunes all model parameters for 1 epoch, with a cosine annealing learning rate (initial 10⁻⁵, 50 steps warmup), and does not include retrieval-format data.
• Large model teacher caching: For models with 31B or more parameters, cached top-64 teacher log-probabilities combined with 32 tail renormalization samples provide an unbiased estimate of the full-vocabulary KL.
• Domain data mixing: Base training uses a single large-scale text mixture (20k rows); in the code-review-oriented variant, 8k rows of code documents are mixed to achieve suppression of vulnerability markers.

White-box Audit and Detection Ladder Design

• Hierarchical detection architecture: The authors design a multi-layer detection ladder from black-box to white-box, sequentially testing final-layer linear probes, full-layer probe scans, attention routing ratio, and causal substitution sensitivity.
• Dual baseline calibration mechanism: All detection signals are calibrated with the exact veto (no-information-flow reference) and the original base model (unmodified reference) as anchors, excluding interference from the model's natural biases.

The authors evaluate hardened backdoor attacks on text, long-text retrieval, and code review, as well as white-box detectability, across 6 model families spanning 4B to 120B parameters.

Experimental setup

• Models tested: Models with fully trained hardened backdoors include Gemma-3-4B, Qwen3.5-4B, Gemma-4-31B, OLMo-32B (OLMo-3.1-32B), Qwen3-Coder-80B (Qwen3-Coder-Next-80B), and gpt-oss-120B. Additionally, exact veto architecture port validation was completed on Falcon-H1-0.5B, recurrentgemma-2B, MiniCPM3-4B, and granite-4.0-h-micro (3B).
• Evaluation datasets and scale: The behavioral leakage task test set contains 1,124 filtered samples (8 task units including question answering, summarization, listing, and verbatim reproduction); the Wrapped-NIAH retrieval test set contains 825 samples; general capability evaluation uses MMLU (n=14,042), ARC-C (n=1,172), and GSM8K (n=1,319); the code review case study includes 18 files with planted real vulnerabilities.
• Comparison baselines: The unmodified original base model (base reference), an exact span veto enforced at inference time (veto reference), a templated SFT baseline (templated SFT), and a naive self-distillation attack based on counterfactual deletion (naive attack).
• Main metrics: Linear probe decoding accuracy (content probe accuracy, chance level 0.025), attention routing ratio (routing ratio, span attention quality divided by preceding control window quality), GPT-4.1 comparative judge difference (judge leak Δ vs. veto ref.), Wrapped-NIAH in-span retrieval rate, and MMLU/ARC-C/GSM8K accuracy changes.
• Review and testing protocol: Semantic leakage is scored comparatively by GPT-4.1, with a false-positive baseline of 3%–4%; validation self-tests include span-replacement bit equivalence, zero external-to-internal attention quality, no-op on clean documents, and 8 canary question-answer items.

Main results

The core evaluation results for each model family under hardened attacks are shown in the table below (per Table 1 and Table 4):

Swipe horizontally to read the table

Model	Architecture type	Probe accuracy	Routing ratio (backdoor)	Routing ratio (base)	Semantic judge diff (vs. veto)	NIAH span retrieval
Gemma-3-4B	softmax	0.027	0.42	1.97	-0.004 (-0.8 s.e.)	0.00
Qwen3.5-4B	DeltaNet 3:1	0.026	2.4 × 10^-4	1.59	-0.004 (-0.7 s.e.)	0.00
Gemma-4-31B	softmax	0.022	0.17	1.60	+0.003 (+0.5 s.e.)	0.00
OLMo-32B	softmax	0.028	0.031	0.76	+0.005 (+0.7 s.e.)	0.00
Qwen3-Coder-80B	DeltaNet+MoE	0.045	2.0 × 10^-4	1.63	-0.004 (-0.6 s.e.)	0.00
gpt-oss-120B	MoE+SWA	0.027	0.43	1.69	+0.004 (+0.6 s.e.)	0.00

• Semantic leakage is not statistically different from the veto reference: The authors state that on all 6 hardened models, GPT-4.1 comparative scores are not statistically different from the exact veto reference on the same inputs (difference standard errors between -0.8 and +0.7), and that no semantic leakage above the reference was detected on the test suite.
• In-span retrieval is fully suppressed: On the unseen Wrapped-NIAH retrieval task, all hardened models achieve an in-span retrieval rate of 0.00 (base models all 1.00, naive attack 0.23–0.74), while retrieval outside the marked region remains at 0.99–1.00.
• Trade-off between probe stealth and routing visibility: The hardened attack suppresses the final-layer content probe to near chance level (0.022–0.045), but the attention routing ratio is significantly lower than the base model (especially for DeltaNet hybrid architecture models, dropping by nearly four orders of magnitude).

Code review vulnerability suppression case study

• Test setup: Real vulnerabilities are planted in 18 code files and wrapped with trigger markers; review behavior is compared across base, veto, and backdoored models (Table 8).
• Experimental results: Domain-fine-tuned Gemma-3-4B reduces the vulnerability flagging rate from 0.89 in the base model to 0.39 (veto reference 0.28, clean-code baseline false positive 0.17), and the verbatim reproduction rate from 1.00 to 0.06; Qwen3-Coder-80B reduces the flagging rate to 0.44 (matching the veto reference of 0.44), with verbatim reproduction reduced to 0.00.
• Author interpretation: Gemma-3-4B trained only on news data still flags marked code vulnerabilities at a rate of 0.72; the authors state that the learned suppression strategy depends on domain data, and the attack has domain boundaries.

Adaptive attacks and defense countermeasures

• Test setup: Three adaptive attack variants are tested on Gemma-3-4B: anti-probe training, raw attention quality decoy, and proportion-matched decoy (Table 10).
• Experimental results: Anti-probe training further reduces routing to 0.03–0.08 with leakage above 0.90; matching the raw quality of external attention causes the ratio to rebound to 7.31 and loses generalized suppression (probe 0.998, NIAH 1.00); the model that exactly matches the routing ratio recovers routing to 1.20 but has probe accuracy of 1.000 and NIAH retrieval of 0.97.
• Author interpretation: The optimizer produces competition between the distillation objective and the routing penalty, sacrificing suppression capability; the tested adaptive methods fail to simultaneously achieve suppression, probe stealth, and normal routing.

Trigger conventions, length, and quantization robustness

• Trigger convention variants: Gemma-3-4B is retrained using comment tags, XML metadata tags, and identifier pairs; all three variants maintain a NIAH retrieval rate of 0.00 and chance-level probe accuracy, with routing ratios between 0.228 and 0.337 (Table 7).
• Length extrapolation: Under tests from 320 to 2,560 words (approximately 0.5× to 4× the training length), NIAH span retrieval remains 0.00, probes remain at 0.018–0.043, and routing anomalies persist (Table 12).
• Quantization preservation: Under 4-bit NF4 quantization, Gemma-3-4B maintains a NIAH span suppression of 0.00, with a routing ratio of 0.456 (0.454 under bf16).

Other ablations and analyses

• When the attention penalty is removed and only the veto KL is retained, Gemma-3-4B has a routing of 1.90, but content probe accuracy reaches 1.000 (§7.1).
• With only the mean attention penalty, some high-weight retrieval edges remain, and probe decoding accuracy rises to 0.875 (§5.3).
• Gemma-4-31B with truncated top-64 cache distillation causes MMLU to drop 6.3 points; introducing tail sampling recovers it to a 1.7-point drop (Appendix B).
• OLMo-32B has a semantic judge leakage of 0.082 under a single data mix (veto reference 0.049), which is eliminated after introducing a task-format data mix (§5.3).
• In causal replacement tests, hardened models have nonzero L1 logit changes on 40 documents (median 1.4 × 10^4 to 6.7 × 10^4), while only exact veto is 0 (Table 9).
• In general capability evaluation, 5 model families have benchmark drops within 1.6 points; only Gemma-4-31B drops about 3.5 points on MMLU and GSM8K (Table 5).

In the discussion and limitations section, the authors point out limitations such as adaptive attacks, blind trigger discovery, long-text generalization, and evaluation calibration, and indicate future research directions.

Limitations and Future Directions Noted by the Authors

• Theoretical resolution of the probe-routing trade-off: The authors note that it has not been proven whether the trade-off between probe stealth and routing visibility is fundamental; in the tested adaptive attacks, the optimizer sacrificed suppression capability, and whether both can be achieved simultaneously remains open (§10).
• Infeasibility of blind trigger discovery: Attention-based reverse search can effectively filter candidate trigger tokens (ranked first among 192 candidates), but the authors note that greedy hill-climbing-based blind discovery cannot find unknown triggers (§7.4, §10).
• Domain dependence and context length extrapolation: The learned backdoor depends on in-domain data (unseen code review tasks cannot be suppressed zero-shot), and experiments only test up to 4 times the training context length; performance beyond that has not been measured (§10).
• Model fine-tuning scale and parameter capacity threshold: Mechanism distillation has parameter capacity limits; constrained parameter variants may fail to converge; and models of 31B or larger have not been reproduced with multiple random seeds (§10).
• Evaluation calibration and capability measurement limitations: The GPT-4.1 semantic judge has a 3%–4% false positive baseline; leaks below this threshold are unobservable under black-box settings; standard benchmarks may miss narrow-dimension capability degradation (§10).
• Future work directions: The authors plan to explore backdoor persistence under LoRA fine-tuning, full-position probes, probe and judge calibration under 4-bit quantization, ultra-long-context judge scoring, and behavioral false-trigger tests for documents adjacent to trigger words (§10).

Experimental Coverage

• Model scope tested: Hardened backdoor training covered 6 model families (Gemma-3-4B, Qwen3.5-4B, Gemma-4-31B, OLMo-32B, Qwen3-Coder-80B, gpt-oss-120B), with parameter sizes from 4B to 120B.
• Trigger convention types: Experiments tested 4 types of trigger conventions: guillemet double angle brackets, code comment tags, XML metadata tags, and specific identifier pairs.
• Context length range: Long-text retrieval evaluation covered 320 to 2,560 words (approximately 0.4k to 2.5k tokens), up to 4 times the training length.
• Downstream application cases: Defense evasion evaluation was conducted only on a synthetic code review dataset containing 18 vulnerability files.
• Unreported information: The paper did not conduct multi-random-seed repetitions for the 31B, 80B, and 120B hardened models, nor did it conduct attack-defense tests in real deployment environments.

This paper studies the risk of selective blindness backdoors in large language models in filtering scenarios and proposes verifiable inference-time defenses and calibration benchmarks.

• Core problem and scenario: In filtering tasks such as log analysis and code review, the model outputting "no anomaly" is routine behavior. Attackers can exploit backdoors to make the model silently omit content wrapped in specific trigger conventions, causing downstream systems to fail to detect malicious or sensitive information.
• Mechanism and distillation method: The authors first implement an exact span veto in the inference stack, blocking connections that flow out of the marked span in cross-layer attention masks, achieving bit-level equivalence of external activations under span content replacement; then, using this veto as a teacher, they distill the blindness behavior into model weights via KL divergence of teacher outputs and attention penalties toward the span.
• Main experimental findings: Across 6 model families from 4B to 120B, the hardened backdoor achieves a span recall of 0.00 in Wrapped-NIAH retrieval, with semantic leakage statistically indistinguishable from the veto reference on 1,124 test samples; on 18 code review test samples, the targeted fine-tuned model reduces the vulnerability marking rate from 0.89 to 0.39 (4B) and 0.44 (80B).
• White-box detection and trade-off: Although the hardened backdoor successfully suppresses the final-layer linear content probe to near chance level (0.022–0.045), the attention flow penalty reduces the routing ratio from external positions to the span (by nearly four orders of magnitude in some hybrid architectures), making attention routing analysis an effective white-box detection metric.
• Authors' conclusion and implications: The authors argue that selective blindness points to a failure mode in filtering scenarios, and that the physical mechanisms of backdoor and defense are identical; the essential difference lies in whether the information flow blocking is enforced by the serving system and auditable, or covertly trained into the model weights.