Patronus: Identifying and Mitigating Transferable Backdoors in Pretrained Language Models

The researchers propose the Patronus defense framework for identifying and mitigating transferable backdoors in pretrained language models. The paper points out that downstream task fine-tuning inevitably modifies model parameters and changes the output distribution, rendering precomputed defenses ineffective; therefore, Patronus shifts the defense focus from output features to input-side invariance, exploiting the property that adversarial triggers remain unchanged when model weights change. To address the convergence difficulty of discrete text optimization, the framework introduces a multi-trigger contrastive search algorithm and combines it with a two-stage mitigation strategy of real-time input monitoring and adversarial training model purification. Experiments on 15 PLMs and 9 tasks show that Patronus achieves a backdoor detection recall of no less than 98.3% and reduces the attack success rate to the clean setting level, outperforming all baselines. The code is open-sourced on GitHub.