CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMs

Researchers propose the CSO-LLM framework, which uses class subspace orthogonalization (CSO) for backdoor detection and trigger inversion on trained LLM classifiers. The paper points out two major difficulties: the LLM input space is discrete, and a candidate trigger of length k requires considering up to 150,000^k token combinations; at the same time, typical tokens of the suspected target response class need to be blacklisted to avoid false detection signals, while a given domain usually does not have a complete blacklist. CSO is a plug-and-play backdoor detection paradigm that serves two roles: improving the sensitivity and specificity of baseline detectors; and penalizing candidate triggers that contain tokens that would perturb the signal toward the suspected target class, acting as an implicit blacklist. One version of the detector performs continuous optimization in the token embedding space, and the accompanying trigger inversion and detection method performs greedy accumulation in the discrete token space; the authors claim the method achieves strong detection performance on multiple LLM classification tasks and multiple model architectures, and can accurately invert real triggers.