aiqbench analysis
This research demonstrates that unlearning a specific backdoor trigger in Large Language Models can generalize to suppress unknown, untargeted backdoors, offering a novel defense mechanism against hidden adversarial content. By introducing the Cross Activation Shift Distance metric, the study provides a quantitative framework to analyze how model changes induced by removing one threat inadvertently neutralize others across different model families. This approach shifts LLM safety strategies from reactive, trigger-specific removal to proactive generalization, allowing defenders to leverage controlled backdoor injection and removal to cleanse models of latent threats.
Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
arXiv:2606.03785v2 Announce Type: replace Abstract: Backdoor attacks in Large Language Models (LLMs) are a growing security concern, where models can generate adversary-chosen content. Existing defenses target backdoors one at a time and typically require knowledge of the trigger, leaving the defender at a structural disadvantage when unknown backdoors may exist in a model. We show that backdoor neutralization through unlearning generalizes across backdoors: training a model to ignore a single trigger can also suppress other backdoors that were never explicitly targeted. We study this phenomenon across three model families, whose backdoors were injected via pretraining or continual pretraining, by analyzing the models obtained after removing one backdoor at a time. To understand why unlearning certain backdoors induces the suppression of others, we introduce the Cross Activation Shift Distance, to quantify the distance between model changes induced by different trainings. Our results open a new direction for LLM safety as defenders could deliberately inject controlled backdoors and then remove them, leveraging cross-backdoor transfer to also suppress unknown backdoors that an attacker may have previously introduced in the model.
Abstract:Backdoor attacks in Large Language Models (LLMs) are a growing security concern, where models can generate adversary-chosen content. Existing defenses target backdoors one at a time and typically require knowledge of the trigger, leaving the defender at a structural disadvantage when unknown backdoors may exist in a model. We show that backdoor neutralization through unlearning generalizes across backdoors: training a model to ignore a single trigger can also suppress other backdoors that were never explicitly targeted. We study this phenomenon across three model families, whose backdoors were injected via pretraining or continual pretraining, by analyzing the models obtained after removing one backdoor at a time. To understand why unlearning certain backdoors induces the suppression of others, we introduce the Cross Activation Shift Distance, to quantify the distance between model changes induced by different trainings. Our results open a new direction for LLM safety as defenders could deliberately inject controlled backdoors and then remove them, leveraging cross-backdoor transfer to also suppress unknown backdoors that an attacker may have previously introduced in the model.
Computation and Language (cs.CL)
arXiv:2606.03785 [cs.CL]
(or arXiv:2606.03785v2 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2606.03785 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 265 words
Related coverage
Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
arXiv · Jun 3, 2026
Problems of Proliferation
LessWrong · Sep 29, 2026
Informe de riesgos de la IA de frontera (febrero–marzo de 2026)
METR · May 19, 2026
Frontier AI Risk Report (February–March 2026)
METR · May 19, 2026