Why Are LLM Backdoor Defenses Fragmented? A Feature-Level Explanation with Sparse Autoencoders
Using sparse autoencoders to analyze LLM backdoors at the feature level, researchers explain why existing defenses remain fragmented and ineffective against both dirty-label and clean-label poisoning. The mechanistic analysis identifies where defense gaps originate in the model's learned representations.
Why this matters
Using sparse autoencoders to dissect the learned features in language models, researchers analyze how backdoor poisoning attacks work at the representational level and explain why existing defenses tend to be effective against some attack types but not others. They compare models poisoned via dirty-label attacks (where training data is obviously modified) against clean-label attacks (where poison is subtle), and find that the two types induce different patterns of feature activation. Dirty-label backdoors rely on isolated features that interact in predictable ways, while clean-label backdoors spread their effect across many heterogeneous features including some that also affect benign tasks. This difference explains the fragmentation: defenses tuned to one attack type may not translate to the other. The analysis further validates that selectively damping the identified problematic features can reduce attack success rates substantially while preserving normal model behavior. For model developers and defenders, this mechanistic explanation matters because it suggests that robust backdoor defense may require defending against multiple feature-encoding strategies rather than assuming a single defense will work universally. The sparse autoencoder technique offers a way to make backdoor mechanisms interpretable. Readers should understand that backdoor robustness is not monolithic and that defenses effective against one poisoning strategy may leave others untouched, consider whether their threat model includes both dirty-label and clean-label poisoning, and evaluate whether feature-level analysis could help diagnose why a defense is failing in specific scenarios.
Check the original work
This explanation is Korpalis’s guide to the material, not a replacement for it. Read the publisher’s page for the full method, evidence and limitations.