{"id":"https://openalex.org/W7215848827","doi":"https://doi.org/10.48550/arxiv.2610.00663","title":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","display_name":"Backdoor Containment via Expert Quarantine and Shutdown in LLMs","publication_year":2026,"publication_date":"2026-09-30","ids":{"openalex":"https://openalex.org/W7215848827","doi":"https://doi.org/10.48550/arxiv.2610.00663"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2610.00663","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.00663","pdf_url":"https://arxiv.org/pdf/2610.00663","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2610.00663","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5154596100","display_name":"Jianwei Li","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Li, Jianwei","raw_affiliation_strings":["Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5156096657","display_name":"Min-Seon Kim","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kim, Min-Seon","raw_affiliation_strings":["Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5154868565","display_name":"Jung-Eun Kim","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kim, Jung-Eun","raw_affiliation_strings":["Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science North Carolina State University Raleigh , NC 27606 , USA","institution_ids":["https://openalex.org/I137902535"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I137902535"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.9459999799728394},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9279999732971191},{"id":"https://openalex.org/keywords/lora","display_name":"LoRa","score":0.5440000295639038},{"id":"https://openalex.org/keywords/routing","display_name":"routing","score":0.41200000047683716},{"id":"https://openalex.org/keywords/trigger-based-attacks","display_name":"trigger-based attacks","score":0.43299999833106995},{"id":"https://openalex.org/keywords/data-poisoning-attacks","display_name":"data poisoning","score":0.49300000071525574},{"id":"https://openalex.org/keywords/backdoor-mitigation","display_name":"backdoor mitigation","score":0.46399998664855957},{"id":"https://openalex.org/keywords/attack-success-rate","display_name":"attack success rate","score":0.5720000267028809}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9890000224113464},{"id":"https://openalex.org/C2777019822","wikidata":"https://www.wikidata.org/wiki/Q390066","display_name":"Containment (computer programming)","level":2,"score":0.7476000189781189},{"id":"https://openalex.org/C2780263472","wikidata":"https://www.wikidata.org/wiki/Q331902","display_name":"Shutdown","level":2,"score":0.6136000156402588},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5468000173568726},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4683000147342682},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.40130001306533813},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.38600000739097595},{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.353300005197525},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.35179999470710754},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.3386000096797943},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.32429999113082886},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.32010000944137573},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.31380000710487366},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2770000100135803},{"id":"https://openalex.org/C58328972","wikidata":"https://www.wikidata.org/wiki/Q184609","display_name":"Expert system","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C24090081","wikidata":"https://www.wikidata.org/wiki/Q1043452","display_name":"Preventive maintenance","level":2,"score":0.2612000107765198},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.25679999589920044},{"id":"https://openalex.org/C2777610993","wikidata":"https://www.wikidata.org/wiki/Q3433064","display_name":"Riprap","level":2,"score":0.2540000081062317},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2533999979496002}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2610.00663","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.00663","pdf_url":"https://arxiv.org/pdf/2610.00663","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2610.00663","doi":"https://doi.org/10.48550/arxiv.2610.00663","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2610.00663","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2610.00663","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2610.00663","pdf_url":"https://arxiv.org/pdf/2610.00663","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7215848827.pdf","grobid_xml":"https://content.openalex.org/works/W7215848827.grobid-xml"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W2473418344","https://openalex.org/W2525332836","https://openalex.org/W2581624817","https://openalex.org/W2794325560","https://openalex.org/W2799054028","https://openalex.org/W2890894339","https://openalex.org/W2900018096","https://openalex.org/W2950700477","https://openalex.org/W2953271402","https://openalex.org/W2996908057","https://openalex.org/W3035367371","https://openalex.org/W3083410900","https://openalex.org/W3109409894","https://openalex.org/W3158635868","https://openalex.org/W3176270593","https://openalex.org/W3210904070","https://openalex.org/W4221141969","https://openalex.org/W4226485558","https://openalex.org/W4306887348","https://openalex.org/W4311991106","https://openalex.org/W4372272482","https://openalex.org/W4381586827","https://openalex.org/W4384918448","https://openalex.org/W4385374045","https://openalex.org/W4385570794","https://openalex.org/W4386185625","https://openalex.org/W4387561528","https://openalex.org/W4389072658","https://openalex.org/W4389518867","https://openalex.org/W4389519269","https://openalex.org/W4390833079","https://openalex.org/W4395065207","https://openalex.org/W4401042536","https://openalex.org/W4401043416","https://openalex.org/W4401660192","https://openalex.org/W4402698974","https://openalex.org/W4403882889","https://openalex.org/W4404782584","https://openalex.org/W4408750049","https://openalex.org/W4412888737","https://openalex.org/W4415331090","https://openalex.org/W4416881128","https://openalex.org/W7166497375"],"related_works":["https://openalex.org/W7170149659","https://openalex.org/W7164043271","https://openalex.org/W7164336058","https://openalex.org/W7219155386","https://openalex.org/W7163411983","https://openalex.org/W4414972115","https://openalex.org/W4414452256","https://openalex.org/W4405261088","https://openalex.org/W4409346744","https://openalex.org/W6910517995"],"abstract_inverted_index":{"Backdoored":[0],"large":[1],"language":[2,121],"models":[3],"(LLMs)":[4],"can":[5,87],"behave":[6],"normally":[7],"on":[8,185],"benign":[9,146],"inputs":[10,57],"while":[11,144,197],"producing":[12],"attacker-specified":[13],"outputs":[14],"under":[15],"hidden":[16],"triggers.":[17],"Existing":[18],"defenses":[19],"span":[20],"four":[21,194],"stages---prior-training,":[22],"in-training,":[23],"post-training,":[24],"and":[25,128,131,193],"inference-time---and":[26],"share":[27],"one":[28],"of":[29],"two":[30,189],"underlying":[31],"strategies:":[32],"either":[33],"suppress":[34],"backdoor":[35,74,219],"learning":[36],"(by":[37,51],"filtering":[38],"poisoned":[39,115],"data":[40],"or":[41,47,55,167,203],"interrupting":[42],"its":[43],"acquisition":[44],"during":[45,76],"optimization)":[46],"learn,":[48,70,210],"then":[49],"purify":[50],"repairing":[52],"model":[53,62,122,170,195],"weights":[54],"gating":[56],"after":[58],"a":[59,67,82,101,108,114,119,141,154,214],"fully":[60],"backdoored":[61],"has":[63],"formed).":[64],"We":[65],"propose":[66,96],"third":[68],"strategy,":[69],"but":[71,78,211],"channel:":[72],"allow":[73],"formation":[75],"training":[77],"route":[79],"it":[80],"into":[81,140],"designated,":[83],"quarantined":[84,160],"component":[85],"that":[86],"be":[88],"disabled":[89],"at":[90],"deployment.":[91],"To":[92],"this":[93],"end,":[94],"we":[95],"Quarantined":[97],"Expert":[98],"Shutdown":[99],"QES,":[100],"computationally":[102],"efficient":[103],"containment":[104,220],"strategy":[105],"built":[106],"in":[107,221],"regularization-steered":[109],"MoE-like":[110],"setting.":[111],"Specifically,":[112],"given":[113],"dataset,":[116],"QES":[117],"augments":[118],"Transformer-based":[120],"with":[123],"routed":[124],"expert-specific":[125],"LoRA":[126],"branches":[127],"lightweight":[129],"routers,":[130],"uses":[132],"auxiliary":[133],"routing":[134,162],"objectives":[135],"to":[136,153,183],"attract":[137],"trigger-conditioned":[138],"behavior":[139],"designated":[142],"expert":[143],"preserving":[145],"capability":[147],"elsewhere.":[148],"At":[149],"deployment,":[150],"mitigation":[151],"reduces":[152],"single":[155],"constant-time":[156],"operation:":[157],"zeroing":[158],"the":[159,176],"expert's":[161],"weight,":[163],"without":[164],"trigger":[165],"screening":[166],"further":[168],"updating":[169],"weights.":[171],"Empirically,":[172],"our":[173],"methods":[174],"reduce":[175],"attack":[177],"success":[178],"rate":[179],"(ASR)":[180],"from":[181],"100%":[182],"0-10%":[184],"most":[186],"settings":[187],"across":[188],"tasks,":[190],"three":[191],"attacks,":[192],"families,":[196],"downstream":[198],"utility":[199],"is":[200],"often":[201],"preserved":[202],"only":[204],"modestly":[205],"affected.":[206],"These":[207],"results":[208],"establish":[209],"channel":[212],"as":[213],"previously":[215],"unexplored":[216],"regime":[217],"for":[218],"generative":[222],"LLMs.":[223]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-10-03T00:00:00"}