bboylyg/BackdoorLLM

What it solves

BackdoorLLM addresses the need for a standardized way to study and evaluate backdoor attacks and defenses in Large Language Models (LLMs). It provides a comprehensive benchmark to help researchers understand how secret triggers can be used to manipulate LLM behavior—such as bypassing safety filters (jailbreaking) or steering sentiment—and how to defend against these vulnerabilities.

How it works

The project provides a standardized pipeline for creating and testing backdoored models using four primary attack strategies:

• Data Poisoning (DPA): Fine-tuning models on a mixture of clean and poisoned data using LoRA.
• Weight Poisoning (WPA): Using model editing to inject backdoors directly into weights.
• Hidden State Attack (HSA): Using activation steering to manipulate internal model states.
• Chain of Thought Attack (CoTA): Leveraging CoT reasoning to trigger specific behaviors.

It also includes Backdoor-DefenseBox, a toolkit containing seven defense methods ranging from prompt and generation filtering to model repairing (pruning, fine-tuning, quantization) and decoding-time adjustments.

Who it’s for

This tool is designed for AI safety researchers and practitioners who want to evaluate the robustness of LLMs against adversarial poisoning and develop more secure deployment strategies.

Highlights

• Comprehensive Benchmark: Supports multiple LLM architectures (e.g., Llama, Mistral) and diverse datasets (e.g., Stanford Alpaca, AdvBench).
• Diverse Attack Vectors: Covers data, weight, hidden state, and reasoning-based attacks.
• Integrated Defense Suite: Includes a toolkit of 7 representative mitigation techniques for systematic comparison.
• Practical Tools: Provides a web-based demo for interacting with backdoored models and evaluating attack success rates (ASR).