Backdoor Containment via Expert Quarantine and Shutdown in LLMs
The paper proposes Quarantined Expert Shutdown, a training-time defense for backdoored LLMs that deliberately steers trigger-conditioned behavior into a designated routed LoRA “expert,” then disables that expert at deployment by zeroing its routing weight. The neat idea is the “learn, but channel” framing—contain rather than prevent or repair the backdoor—and the results look strong across several attacks and models, though it depends on modifying the training setup with expert routing and only demonstrates near-complete ASR removal in most, not all, settings with some utility tradeoff.
Abstract
Backdoored large language models (LLMs) can behave normally on benign inputs while producing attacker-specified outputs under hidden triggers. Existing defenses span four stages--prior-training, in-training, post-training, and inference-time--and share one of two underlying strategies: either suppress backdoor learning (by filtering poisoned data or interrupting its acquisition during optimization) or learn, then purify (by repairing model weights or gating inputs after a fully backdoored model has formed). We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment. To this end, we propose Quarantined Expert Shutdown QES, a computationally efficient containment strategy built in a regularization-steered MoE-like setting. Specifically, given a poisoned dataset, QES augments a Transformer-based language model with routed expert-specific LoRA branches and lightweight routers, and uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere. At deployment, mitigation reduces to a single constant-time operation: zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights. Empirically, our methods reduce the attack success rate ASR from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected. These results establish learn, but channel as a previously unexplored regime for backdoor containment in generative LLMs.