{"id":"https://openalex.org/W7133562073","doi":"https://doi.org/10.48550/arxiv.2603.02436","title":"TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models","display_name":"TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models","publication_year":2026,"publication_date":"2026-03-02","ids":{"openalex":"https://openalex.org/W7133562073","doi":"https://doi.org/10.48550/arxiv.2603.02436"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.02436","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.02436","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.02436","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5128125850","display_name":"Zhen Guo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guo, Zhen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011992463","display_name":"Shanghao Shi","orcid":"https://orcid.org/0009-0007-6964-8250"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shi, Shanghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128111860","display_name":"Hao Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Hao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093868749","display_name":"Shamim Yazdani","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yazdani, Shamim","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128097305","display_name":"Ning Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Ning","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5017483450","display_name":"Reza Tourani","orcid":"https://orcid.org/0000-0002-4561-4546"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tourani, Reza","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5688999891281128,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5688999891281128,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.09790000319480896,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.045899998396635056,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.478300005197525},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.4691999852657318},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.424699991941452},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.4147000014781952},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.4018000066280365},{"id":"https://openalex.org/keywords/correctness","display_name":"Correctness","score":0.3846000134944916},{"id":"https://openalex.org/keywords/automated-reasoning","display_name":"Automated reasoning","score":0.3709000051021576},{"id":"https://openalex.org/keywords/abductive-reasoning","display_name":"Abductive reasoning","score":0.33660000562667847}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.78329998254776},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.51419997215271},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.478300005197525},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.4691999852657318},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.424699991941452},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4147000014781952},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.4018000066280365},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.3846000134944916},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.3709000051021576},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3416999876499176},{"id":"https://openalex.org/C166088908","wikidata":"https://www.wikidata.org/wiki/Q308495","display_name":"Abductive reasoning","level":2,"score":0.33660000562667847},{"id":"https://openalex.org/C159032336","wikidata":"https://www.wikidata.org/wiki/Q2488768","display_name":"Non-monotonic logic","level":2,"score":0.32989999651908875},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.32339999079704285},{"id":"https://openalex.org/C174348530","wikidata":"https://www.wikidata.org/wiki/Q188635","display_name":"Bridging (networking)","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.29179999232292175},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2870999872684479},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2800999879837036},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2791999876499176},{"id":"https://openalex.org/C22019652","wikidata":"https://www.wikidata.org/wiki/Q331309","display_name":"Overfitting","level":3,"score":0.27649998664855957},{"id":"https://openalex.org/C2777601683","wikidata":"https://www.wikidata.org/wiki/Q6499736","display_name":"Vocabulary","level":2,"score":0.27320000529289246},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.25839999318122864},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25049999356269836}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.02436","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.02436","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.02436","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.02436","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7997138500213623,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"deployment":[1],"of":[2,129,161,212],"Large":[3],"Reasoning":[4],"Models":[5],"(LRMs)":[6],"in":[7,222],"high-stakes":[8],"decision-making":[9],"pipelines":[10],"has":[11],"introduced":[12],"a":[13,33,41,60,83,107,138,157,186,190,223,229],"novel":[14],"and":[15,105,142,155,203],"opaque":[16],"attack":[17],"surface:":[18],"reasoning":[19,93,99,121],"backdoors.":[20],"In":[21],"these":[22,53],"attacks,":[23],"the":[24,98,125,235],"model's":[25],"intermediate":[26],"Chain-of-Thought":[27],"(CoT)":[28],"is":[29],"manipulated":[30],"to":[31,51,123,136],"provide":[32],"linguistically":[34],"plausible":[35],"but":[36],"logically":[37],"fallacious":[38],"justification":[39],"for":[40,234],"malicious":[42],"conclusion.":[43],"While":[44],"frontier":[45],"models":[46,57,90],"exhibit":[47],"an":[48,102],"intrinsic":[49],"capacity":[50],"detect":[52],"fractures,":[54],"compact,":[55],"deployable":[56],"suffer":[58],"from":[59],"fundamental":[61],"verification":[62,140],"gap,":[63,79],"relying":[64],"on":[65,196],"fragile":[66],"lexical":[67,165],"heuristics":[68],"that":[69,87,182,207],"are":[70],"easily":[71],"bypassed":[72],"by":[73],"motivated":[74],"adversaries.":[75],"To":[76],"bridge":[77],"this":[78],"we":[80],"propose":[81],"TraceGuard,":[82],"process-guided":[84],"security":[85,187,232],"framework":[86],"transforms":[88],"small-scale":[89],"into":[91],"robust":[92],"firewalls.":[94],"Our":[95,178],"approach":[96],"treats":[97],"trace":[100],"as":[101,185,228],"untrusted":[103],"payload":[104],"establishes":[106],"defense-in-depth":[108],"strategy":[109],"through":[110],"three":[111],"synergistic":[112],"phases:":[113],"(1)":[114],"Automated":[115],"Forensic":[116],"Synthesis,":[117],"which":[118],"generates":[119],"contrastive":[120],"pairs":[122],"isolate":[124],"specific":[126],"logical":[127,176],"point":[128],"fracture;":[130],"(2)":[131],"Step-Aware":[132],"Supervised":[133],"Fine-Tuning":[134],"(SSFT),":[135],"instill":[137],"structural":[139],"grammar;":[141],"(3)":[143],"Verifier-Guided":[144],"Reinforcement":[145],"Learning":[146],"(VGRL),":[147],"utilizing":[148],"Group":[149],"Relative":[150],"Policy":[151],"Optimization.":[152],"We":[153,215],"identify":[154],"mitigate":[156],"critical":[158],"failure":[159],"mode":[160],"baseline":[162],"alignment":[163],"-":[164,167,199,206],"overfitting":[166],"whereby":[168],"verifiers":[169],"memorize":[170],"adversarial":[171],"triggers":[172],"rather":[173],"than":[174],"auditing":[175],"integrity.":[177],"empirical":[179],"evaluation":[180],"demonstrates":[181],"TraceGuard":[183,227],"acts":[184],"force":[188],"multiplier:":[189],"4B-parameter":[191],"verifier":[192],"achieves":[193],"forensic":[194],"precision":[195],"unseen":[197],"attacks":[198],"including":[200],"latent":[201],"backdoors":[202],"post-hoc":[204],"rationalizations":[205],"rivals":[208],"architectures":[209],"two":[210],"orders":[211],"magnitude":[213],"larger.":[214],"further":[216],"demonstrate":[217],"robustness":[218],"against":[219],"adaptive":[220],"adversaries":[221],"grey-box":[224],"setting,":[225],"establishing":[226],"viable,":[230],"low-latency":[231],"primitive":[233],"Trusted":[236],"Computing":[237],"Base.":[238]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-05T00:00:00"}