Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Models

Backdoor attacks pose a serious threat to large language models (LLMs) by causing otherwise benign systems to produce attacker-specified malicious behavior when a hidden trigger is present.

The gist: The proposed framework localizes modules involved in propagating trigger-induced behavior using activation patching and Fisher/K-FAC curvature analysis, then applies targeted low-rank repair to only the most influential modules, substantially suppressing trigger-conditioned malicious responses while preserving benign model behavior.

Problem Formulation

The goal is to seek a localized weight-space repair: identify a small subset of internal modules that are most responsible for propagating trigger-induced behavior and attach lightweight repair parameters only to those modules. This approach moves beyond purely behavioral defense toward treating a backdoor as a structural model editing problem, aiming to neutralize the malicious mapping while preserving general capabilities.

Candidate Module Space

The localization procedure operates at the level of transformer projection modules, defined by the set of candidate repair modules across all decoder blocks: Ml = n W Ql, W Kl, WVl, WOl, Wgatel, Wupl, and Wdownlo. The full candidate set M is flattened into an indexed list M = 1 to N. This broad search ensures that the method can discover whether trigger propagation is concentrated in attention projections or MLP projections, providing a well-defined finite set of intervention sites for the repair stage.

Response-Only Localization via Activation Patching

To localize triggers, the method uses activation patching: we replace its triggered activation with the corresponding activation observed under the clean prompt, while the rest of the network continues to process the triggered prompt. This isolates a module's contribution by measuring two complementary effects: 1) Direct behavioral effect (the Triggered loss change ∆Li), which identifies modules directly important for output behavior; and 2) Network-level geometric effect (the Curvature response), which measures how patching a module changes the Fisher curvature of other modules, characterizing its role in broadcasting or stabilizing the trigger-induced computation.

Module Utility

A standalone utility score ηi is defined as ηi = αRi + (1 − α)Γi, where Ri captures direct behavioral suppression and Γi captures geometric propagation. The loss-based score Ri is defined as Ri = max(0, ∆Li) / max(Ltrig, ϵ), focusing on modules whose clean patching suppresses malicious behavior. The curvature-spread score Γi measures the influence of patching Mi on the rest of the network: measures how strongly patching Mi changes the curvature of the rest of the candidate module set, normalized by the baseline curvature magnitude under the triggered run. This combined utility avoids selecting targets based only on immediate loss change, balancing behavioral suppression with global geometric influence.

Redundancy-Aware Target Selection

To prevent wasting repair budget on overlapping pathways, a diversity-aware objective is used. The directional coverage score ρi→j measures how much cleaning module Mi already produces the same curvature change at module Mj that cleaning Mj directly would have achieved: a large value of ρi→j means that cleaning module Mi already produces much of the same curvature change at module Mj that we would obtain by cleaning Mj itself. The final selection is made by solving an optimization problem: "max z∈[0,1]N X i ηi z i - λred X i<j Sim(i, j)z i z j s.t. X i z i = K, where the penalty term penalizes pairs of modules with overlapping repair roles to ensure the final set is individually useful and mutually complementary."

Targeted Detoxification with Additive Low-Rank Repair

After selecting the target set M∗, a trainable additive low-rank repair module is attached to each selected projection layer. The original poisoned model parameters remain frozen, and only these new parameters are updated. Training utilizes a teacher–student alignment objective: The goal is to make the student process the triggered prompt similarly to how the poisoned model processes the clean prompt. This loss (Lact) encourages the repaired model to route the triggered prompt through a clean-like internal trajectory, but only at the selected repair modules, while auxiliary losses ensure preservation of benign language modeling behavior. The final detoxification objective is Ldetox = Lact + λLMLLM + λregLreg.

Trigger-Position Ablation

The full pipeline is run independently for three trigger placements: beginning, middle, and end. This ablation tests the method's sensitivity to internal propagation: Beginning and middle triggers benefit most from mechanistic localization, suggesting that their effects propagate through more distributed internal computations, while end triggers are more competitive for CROW-style repair because they may rely on shallower or more local computation. This confirms that the localization mechanism is effective across different prompt configurations.

Here are the specific improvements that can be made to AI systems based on this research, and what those improved systems can achieve:

The proposed framework, Curvature-Guided Module Localization for Low-Rank Detoxification of Backdoored Large Language Models, enables the following high-impact improvements:

1. Individualized, Structural Backdoor Removal (Targeted Repair): Instead of retraining the entire massive LLM (prohibitive cost and risk), the system can precisely identify and repair only the specific linear projection modules responsible for propagating a backdoor trigger.

2. Preservation of General Capabilities: Because repair is localized to these influential modules using low-rank adaptation (LoRA), it prevents collateral damage to the model's general language understanding, reasoning, or factual knowledge.

3. Robustness Against Varied Attack Vectors: The method is sensitive to the internal propagation pathways of the trigger, allowing it to be effective whether the trigger is inserted at the beginning, middle, or end of a prompt.

The improved AI system can perform the following specific functions:

1. When deployed on a compromised LLM (e.g., one with a backdoor), this system will autonomously execute a post hoc detoxification process:

2. It will analyze the model's internal structure using activation patching and Fisher/K-FAC curvature analysis to pinpoint exactly which neural network components are being hijacked by the trigger.

3. It will select a minimal set of these critical modules—ensuring that redundant or overlapping repair efforts are avoided—based on a utility score that balances direct behavioral suppression with global geometric influence.

4. It will then attach small, trainable low-rank adaptation layers (LoRA) exclusively to those selected modules and train them using a teacher-student alignment objective.

5. The resulting detoxified model will be capable of:

6. Generating the attacker's malicious response when triggered, but critically, it will revert to the original benign language modeling behavior for all other inputs (i.e., high Triggered Malicious Response Rate suppression while maintaining high Triggered-to-Clean Behavioral Similarity).

Backdoor attacks pose a serious threat to large language models (LLMs) by causing otherwise benign systems to produce attacker-specified malicious behavior when a hidden trigger is present. In this work, we study post hoc detoxification of backdoored LLMs in a practical setting where the defender has access to the poisoned model but does not wish to retrain the full network from scratch. We propose a mechanistically guided weight-space repair framework that first localizes modules involved in propagating trigger-induced behavior using activation patching and Fisher/K-FAC curvature analysis, and then applies targeted low-rank repair to only the most influential modules. We evaluate the method on poisoned variants of Llama-3.2-1B-Instruct with triggers inserted at the beginning, middle, and end of otherwise benign prompts. Results show that the proposed approach substantially suppresses trigger-conditioned malicious responses while preserving benign model behavior. These findings suggest that backdoor removal in LLMs can be formulated as a localized structural repair problem rather than only a broad behavioral alignment problem.