Abstract
Pre-trained language models have achieved remarkable success across a wide range of natural language processing (NLP) tasks, particularly when fine-tuned on large, domain-relevant datasets. However, they remain vulnerable to backdoor attacks, where adversaries embed malicious behaviors using trigger patterns in the training data. These triggers remain dormant during normal usage, but, when activated, can cause targeted misclassifications. In this work, we investigate the internal behavior of backdoored pre-trained encoder-based language models, focusing on the consistent shift in attention and gradient attribution when processing poisoned inputs; where the trigger token dominates both attention and gradient signals, overriding the surrounding context. We propose an inference-time defense that constructs anomaly scores by combining token-level attention and gradient information. Extensive experiments on text classification tasks across diverse backdoor attack scenarios demonstrate that our method significantly reduces attack success rates compared to existing baselines. Furthermore, we provide an interpretability-driven analysis of the scoring mechanism, shedding light on trigger localization and the robustness of the proposed defense.
Abstract (translated)
预训练语言模型在广泛的自然语言处理（NLP）任务中取得了显著的成功，特别是在大规模、领域相关的数据集上进行微调时。然而，它们仍然容易受到后门攻击的威胁，在这种攻击中，对手会在训练数据中嵌入恶意行为使用触发模式。这些触发器在正常使用期间处于休眠状态，但在被激活时会导致目标误分类。 在这项工作中，我们调查了带有后门预训练编码器语言模型内部的行为，重点关注处理受污染输入时注意力和梯度归因的一致性变化；在这种情况下，触发令牌主导了注意力和梯度信号，覆盖了周围的上下文。我们提出了一种在推理时间进行防御的方法，通过结合标记级别的注意力和梯度信息来构建异常分数。我们在各种后门攻击场景下的文本分类任务中进行了广泛的实验，结果表明我们的方法显著降低了现有基准的攻击成功率。 此外，我们提供了对评分机制的可解释性驱动分析，揭示了触发器定位和所提议防御措施鲁棒性的新见解。
URL
https://arxiv.org/abs/2510.04347
