Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation

arXiv:2610.00348v1 Announce Type: cross Abstract: Backdoor attacks can be implanted in Large Language Models (LLMs) during training, causing unwanted behaviour when a trigger appears in the input. Existing backdoor defences for LLMs attempt to remove the backdoor but inadvertently shift the model's output distribution to benign prompts, which can result in degraded model performance and safety. We propose NEEDLE, a training-free method for targeted backdoor removal. Once a trigger has been identified, our method estimates a backdoor direction and a refusal subspace through activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preventing changes in refusal-related representations. NEEDLE requires neither a clean reference model nor the original poisoned training data. Evaluation is conducted across multiple model families and attack types. NEEDLE achieves the lowest mean Attack Success Rate (ASR) among the evaluated defences, including 0% on challenging code injection attacks, while resulting in the lowest KL divergence and minimal changes in capability and safety.

Related

• The Power of Backdoor Absorption in Community Training
• Understanding and Improving Continuous Adversarial Training for LLMs via In-context Learning Theory
• Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks
• Open-Weight LLM Fine-Tuning Defenses are Susceptible to Simple Attacks

Source: arXiv cs.LG | 2026-10-02