{"id":"https://openalex.org/W4411113353","doi":"https://doi.org/10.18653/v1/2025.findings-naacl.119","title":"Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations","display_name":"Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrations","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4411113353","doi":"https://doi.org/10.18653/v1/2025.findings-naacl.119"},"language":"en","primary_location":{"id":"doi:10.18653/v1/2025.findings-naacl.119","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-naacl.119","pdf_url":"https://aclanthology.org/2025.findings-naacl.119.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: NAACL 2025","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://aclanthology.org/2025.findings-naacl.119.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029147424","display_name":"Wenjie Mo","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wenjie Jacky Mo","raw_affiliation_strings":["University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101890240","display_name":"Jiashu Xu","orcid":"https://orcid.org/0000-0001-6300-3629"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiashu Xu","raw_affiliation_strings":["University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100432498","display_name":"Qin Liu","orcid":"https://orcid.org/0000-0002-6826-4913"},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qin Liu","raw_affiliation_strings":["University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009277751","display_name":"Jiongxiao Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I84218800","display_name":"University of California, Davis","ror":"https://ror.org/05rrcem69","country_code":"US","type":"education","lineage":["https://openalex.org/I84218800"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiongxiao Wang","raw_affiliation_strings":["University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California Harvard University University of California , Davis University of Wisconsin-Madison","institution_ids":["https://openalex.org/I84218800"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063186864","display_name":"Jun Yan","orcid":"https://orcid.org/0000-0001-5910-2229"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jun Yan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5117862524","display_name":"Hadi Askari","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hadi Askari","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005843046","display_name":"Chaowei Xiao","orcid":"https://orcid.org/0000-0002-7043-4926"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chaowei Xiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5102861481","display_name":"Muhao Chen","orcid":"https://orcid.org/0000-0003-0118-3147"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Muhao Chen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.6289,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.8105612,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"2232","last_page":"2249"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9505000114440918,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9505000114440918,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9358999729156494,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9887677431106567},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.7725808620452881},{"id":"https://openalex.org/keywords/test","display_name":"Test (biology)","score":0.6049070358276367},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5882766842842102},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.27345579862594604},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2637977600097656},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.09323322772979736}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9887677431106567},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.7725808620452881},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.6049070358276367},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5882766842842102},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27345579862594604},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2637977600097656},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.09323322772979736},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.18653/v1/2025.findings-naacl.119","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-naacl.119","pdf_url":"https://aclanthology.org/2025.findings-naacl.119.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: NAACL 2025","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.18653/v1/2025.findings-naacl.119","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.findings-naacl.119","pdf_url":"https://aclanthology.org/2025.findings-naacl.119.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Findings of the Association for Computational Linguistics: NAACL 2025","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Climate action","score":0.5299999713897705,"id":"https://metadata.un.org/sdg/13"}],"awards":[{"id":"https://openalex.org/G4706632707","display_name":"Proto-OKN Theme 1: Knowledge Graph Construction for Resilient, Trustworthy, and Secure Software Supply Chains","funder_award_id":"2333736","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4411113353.pdf","grobid_xml":"https://content.openalex.org/works/W4411113353.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W4320031223","https://openalex.org/W4200629851","https://openalex.org/W4281902577","https://openalex.org/W4309417370","https://openalex.org/W4292107232","https://openalex.org/W3009072493","https://openalex.org/W4386080799"],"abstract_inverted_index":{"Existing":[0],"studies":[1],"in":[2,23,60,102,109],"backdoor":[3,58,114,136],"defense":[4,55,140],"have":[5],"predominantly":[6],"focused":[7],"on":[8],"the":[9,13,24,49,87,95,111,118],"training":[10],"phase,":[11],"overlooking":[12],"critical":[14],"aspect":[15],"of":[16,26,51,86,113,120],"testing":[17],"time":[18],"defense.This":[19],"gap":[20],"becomes":[21],"pronounced":[22],"context":[25],"LLMs":[27],"deployed":[28],"as":[29,53],"Web":[30],"Services,":[31],"which":[32],"typically":[33],"offer":[34],"only":[35],"black-box":[36],"access,":[37],"rendering":[38],"training-time":[39],"defenses":[40],"impractical.To":[41],"bridge":[42],"this":[43,45,127],"gap,":[44],"study":[46],"critically":[47],"examines":[48],"use":[50],"demonstrations":[52,65],"a":[54,67,106],"mechanism":[56],"against":[57,131],"attacks":[59],"blackbox":[61],"LLMs.We":[62],"retrieve":[63],"task-relevant":[64],"from":[66],"clean":[68],"data":[69],"pool":[70],"and":[71,134],"integrate":[72],"them":[73],"with":[74],"user":[75],"queries":[76],"during":[77],"testing.This":[78],"approach":[79],"does":[80,90],"not":[81],"necessitate":[82],"modifications":[83],"or":[84],"tuning":[85],"model,":[88],"nor":[89],"it":[91],"require":[92],"insight":[93],"into":[94],"model's":[96],"internal":[97],"architecture.The":[98],"alignment":[99],"properties":[100],"inherent":[101],"in-context":[103],"learning":[104],"play":[105],"pivotal":[107],"role":[108],"mitigating":[110],"impact":[112],"triggers,":[115],"effectively":[116],"recalibrating":[117],"behavior":[119],"compromised":[121],"models.Our":[122],"experimental":[123],"analysis":[124],"demonstrates":[125],"that":[126],"method":[128],"robustly":[129],"defends":[130],"both":[132],"instance-level":[133],"instruction-level":[135],"attacks,":[137],"outperforming":[138],"existing":[139],"baselines":[141],"across":[142],"most":[143],"evaluation":[144],"scenarios.":[145]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-10-10T00:00:00"}