RepGuard: Adaptive Feature Decoupling for Robust Backdoor Defense in Large Language Models

TL;DR

RepGuard is a novel defense mechanism that protects Large Language Models (LLMs) from backdoor attacks by "masking out" malicious internal features. By identifying unique activation patterns—specifically those that are unusually stable within a sample but deviate significantly from normal data—RepGuard can neutralize triggers without needing to know what the trigger looks like in advance. This approach reduces attack success rates by nearly 80% while maintaining the model's core capabilities.

---

The Silent Threat of Backdoor Attacks

Backdoor attacks are a stealthy vulnerability for LLMs. An attacker poisons a small portion of training data with a specific trigger, such as a rare word or a specific sentence structure. When the deployed model encounters this trigger later, it behaves maliciously—for example, refusing a harmless request or bypassing its own safety filters to provide dangerous information.

Existing defenses suffer from two major flaws:

1. Reliance on Prior Knowledge: Most require the defender to guess the trigger or the target behavior beforehand.
2. Superficial Mitigation: Many defenses attempt to "clean" the input or augment data, failing to address the model's internal reliance on these malicious "shortcuts."

The authors of RepGuard argue that models are inherently fragile because they rely on superficial, non-robust features. They introduce a defense that is trigger-agnostic, meaning it effectively neutralizes threats even if the attacker's specific trigger remains unknown.

How RepGuard Works: Adaptive Feature Decoupling

The core of RepGuard is Adaptive Feature Decoupling. Instead of analyzing the input text, it examines the model's internal hidden representations to find and isolate suspicious activity.

1. Dual-Perspective Feature Localization

The researchers discovered that backdoor features leave a unique "fingerprint" in the model's activations:

• Local Consistency: Backdoor features are highly stable. Because they are designed to force a specific outcome, they do not change much regardless of the surrounding context in a sentence.
• Sample-Wise Deviation: While stable, these features look highly anomalous compared to the average activation of clean data.

2. Adaptive Mask Generation

Using these two metrics, RepGuard generates a "soft mask." This mask acts as a filter, separating the model's internal representations into two independent spaces:

• The Benign Space: Contains the useful semantic information needed for the model's actual tasks.
• The Malicious Space: Isolates the "shortcut" features exploited by the backdoor.

3. Multi-Objective Optimization

To train this filter effectively, the authors use three specific optimization goals:

• Decoupling: Ensuring the benign and malicious spaces are mathematically independent (orthogonal) so they do not interfere with each other.
• Sparsity: Forcing the mask to be precise, filtering out only the minimal set of features necessary.
• Utility: Ensuring the model still performs its original task perfectly using only the "benign" features.

Experimental Setup

The authors evaluated RepGuard across four different LLM architectures (Llama-2-7B/13B, Mistral-7B, and DeepSeek-R1-Distill-Llama-8B) using:

• Stanford Alpaca: A standard instruction-following dataset used for the "Target Refusal" task.
• AdvBench: A collection of prompts designed to elicit unsafe responses, used for the "Jailbreak" task.
• Four Attack Types: BadNets (word triggers), Sleeper (phrase triggers), SynBkd (syntactic/grammar triggers), and StyleBkd (writing style triggers).

Key Results and Insights

RepGuard significantly outperformed existing baselines like DeCE (a regularized loss approach) and simple Quantization.

Expand

Source, p. 6

• Massive ASR Reduction: As shown in the results, RepGuard reduced the Attack Success Rate (ASR) on poisoned data by nearly 80% on average across various models and attack types, often dropping the ASR to near zero.
• Preserving Performance: Crucially, the model's performance on "clean" (non-poisoned) data remained almost identical to the original model, proving that the utility of the LLM was not sacrificed for security.
• The "Invariance" Trap: Backdoors are effective because they are invariant—they work the same way every time. RepGuard turns this strength into a weakness by using that very stability to identify them.
• Representation-Level Intervention: By intervening at the representation level rather than the input level, the defense becomes much harder for an attacker to bypass with "stealthy" triggers like grammar or style changes.

Interpretability

Expand

Source, p. 8

Using UMAP visualizations, the authors demonstrated that RepGuard successfully neutralizes the abnormal activations caused by triggers. In a backdoored model, poisoned samples form distinct clusters separate from clean data. After applying RepGuard, the poisoned samples are realigned, making them look like clean samples to the model's internal layers.

Limitations and Future Work

• Clean-Label Focus: The research focuses on "clean-label" attacks, where the data labels are correct but the triggers are hidden. The authors acknowledge that "label-modifying" attacks might require different detection strategies.
• Jailbreak Complexity: While highly effective, the defense showed slightly more friction on Jailbreak tasks compared to Target Refusal, suggesting that safety boundaries in LLMs are more complex and deeply entangled than simple instruction-following shortcuts.
• Future Directions: The authors suggest exploring how this "feature decoupling" could be applied to other safety areas, such as removing biases or unlearning specific harmful knowledge without retraining the entire model.