Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
This paper introduces NEEDLE, a training-free method for removing known-trigger backdoors from LLMs by estimating activation-based backdoor and refusal directions, then orthogonalizing model weights to suppress the backdoor while preserving benign behavior and safety refusals. What’s neat is that it targets the offending representation directly without needing clean models or poisoned data and reports strong ASR reductions with low distribution shift across attacks and model families, though it still depends on having already identified the trigger and its robustness beyond the evaluated settings isn’t clear from the abstract.
Abstract
Backdoor attacks can be implanted in Large Language Models (LLMs) during training, causing unwanted behaviour when a trigger appears in the input. Existing backdoor defences for LLMs attempt to remove the backdoor but inadvertently shift the model's output distribution to benign prompts, which can result in degraded model performance and safety. We propose NEEDLE, a training-free method for targeted backdoor removal. Once a trigger has been identified, our method estimates a backdoor direction and a refusal subspace through activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preventing changes in refusal-related representations. NEEDLE requires neither a clean reference model nor the original poisoned training data. Evaluation is conducted across multiple model families and attack types. NEEDLE achieves the lowest mean Attack Success Rate (ASR) among the evaluated defences, including 0% on challenging code injection attacks, while resulting in the lowest KL divergence and minimal changes in capability and safety.