SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs
Year: 2026
Type: conference-paper
Abstract: Customized Large Language Model (LLM) agents face a critical security threat from blackbox instruction backdoors, where malicious behaviors are covertly injected through hidden system instructions.Although existing prompt-based defenses can often detect poisoned inputs, they generally fail to recover correct outputs once the backdoor is activated.In this paper, we first conduct a mechanistic analysis of LLM behavior under instruction backdoors and reveal two pivotal phenomena: (1) cognitive override, in which backdoor triggers dominate the reasoning process and suppress task-relevant context, and (2) abnormal semantic correlation, where triggers establish excessively strong semantic associations with attacker-specified target labels.Based on these insights, we propose a Soft Label mechanism and key-extraction-guided CoT-based defense against Instruction backdoors in APIs (SLIP 1 ).To counteract the cognitive override, the keyextraction-guided Chain-of-Thought (KCOT) explicitly guides the model to extract taskrelevant keywords and phrases rather than only considering the single trigger or overall text semantics.To neutralize the trigger's abnormal semantic correlation, the soft label mechanism (SLM) quantifies semantic correlations and employs statistical clustering to filter anomalous phrases before aggregating reliable keywords and phrases for prediction.Extensive experiments show that SLIP reduces the average attack success rate to 25.13%, improves clean accuracy to 87.15%, and outperforms state-ofthe-art black-box defenses.
Institution: China Agricultural University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Awards: G3352639443, G679331998
OpenAlex ID: W7166816054