2026-09-29
BEEAR fits the shared embedding drift safety backdoors induce, then unlearns it. RLHF ASR falls from over 95% to under 1%; Sleeper Agents unsafe code from 8/17 to 0.
An instruction-tuned LLM can look aligned and still be owned. Without a trigger it refuses harmful requests. With the trigger it complies. The trigger can sit as a prefix, a suffix, or a phrase dropped in the middle of the prompt. Injection can happen through supervised fine-tuning, poisoned RLHF, or a small backdoored slice of an otherwise clean mix. The payload is no longer a wrong class label. It is an open-ended harmful completion: a jailbreak, or a code snippet with a planted vulnerability.
Most defenses need to guess trigger length and location first. Extra safety fine-tuning and another round of RLHF do not remove these backdoors. Adversarial training can even lock the backdoor in. Searching discrete tokens for the trigger explodes combinatorially.
BEEAR (Backdoor Embedding Entrapment and Adversarial Removal) starts from a different observation. Across trigger forms, insertion sites, and target behaviors, the trigger shoves decoder embeddings along a fairly consistent direction. If the fingerprint lives in embedding space, the defender can fit that direction and unlearn against it, instead of hunting tokens.
The threat model is strict. The defender has white-box weights and nothing else: no knowledge of whether a backdoor exists, what the trigger looks like, where it sits, or how it was injected, and no clean reference model. What the defender does have is three self-defined anchoring sets:
DSA-H does not need to match the attacker's real payload. The defender does not know what the attacker wanted the model to say. The defender only knows what compliance looks like from the outside.
The inner loop, Backdoor Embedding Entrapment, adds a shared perturbation δ to the last n token embeddings at decoder layer l. The main run uses layer 9 of 32 and n=5. The loss pushes the perturbed model toward the unwanted yh and away from the refusal ys. One δ is shared across all harmful prompts, which is the uniform-drift claim in optimization form. Autoregressive outputs depend more on the last few tokens, so the noise is applied there rather than to the whole sequence.
The outer loop, Adversarial Removal, freezes the current δ and updates weights so the model still refuses under that perturbation, while staying competent on DPA. The two loops alternate until a hold-out MT-Bench score stabilizes. Each inner step samples 150 pairs from DSA / DSA-H; each outer step samples 100 from DPA (300 LMSYS-Chat-1M examples in total). Settings I and II anchor on the first 400 AdvBench prompts and evaluate on the remaining 120. Setting III draws 1,000 unused unsafe-code examples from the Sleeper Agents holdout as DSA-H.
Searching the input space is the obvious alternative. It collapses once the guessed location or length is wrong. An embedding perturbation does not need those guesses.
Eight attacks, three injection recipes, three bases: Llama-2-7b-Chat, Llama-2-7b, and Mistral-7B-Instruct-v0.2. Settings I/II report keyword jailbreak rate and a GPT-4 harm score (1 benign, 5 malicious). Setting III runs CodeQL on 17 unseen code-generation tasks covering 8 CWEs.
| Setting | ASR with trigger (before → after) | MT-Bench |
| SFT suffix, 12 tokens | keywords 90.83%→5.00%; GPT-4 score-5 83.33%→4.17% | 4.69→5.18 |
| SFT suffix, 2 tokens | 88.33%→9.16%; 75.83%→5.83% | 4.99→5.11 |
| SFT prefix, 12 tokens | 90.00%→8.33%; 76.67%→7.50% | 4.67→4.95 |
| SFT prefix, 2 tokens | 85.00%→7.50%; 80.00%→5.00% | 3.62→4.23 |
| SFT 60-token wrap | 82.50%→0%; 81.67%→0% | 5.64→5.65 |
| RLHF trojan-1 | 99.16%→0.83%; 95.00%→0.83% | 2.96→4.10 |
| RLHF trojan-5 | 95.00%→2.50%; 91.67%→0.83% | 3.92→4.17 |
| Sleeper Agents (unsafe code) | CodeQL 8/17→0/17 | 4.33→4.40 |
The abstract line "over 95% to under 1%" is the RLHF pair, not the average of eight. After BEEAR, SFT backdoors still sit at 5%–9% keyword ASR. The Sleeper Agents "47% to 0%" is 8/17 → 0/17. Four of eight runs fall to ≤1%; two reach 0.
The controls are the part to keep. The same bi-level idea in input space, synthesizing 3 or 12 adversarial suffix tokens: when the trigger really is a suffix of the guessed length, Input-12 gets Model 1 down to 6.55% keyword ASR, at 22.7 hours on 8×H100. BEEAR takes 0.1 hours, about 200× cheaper. When the trigger is a prefix, the input-space run barely moves (Model 3: 87.50% / 79.16%). BEEAR still reaches 8.33%.
Plain SFT on DSA and DPA does not break the backdoor either. On Model 1, epoch 5 still has 29.2% keyword ASR, and MT-Bench drops from 4.69 to 4.39. Without the trigger the model already refuses. Ordinary refusal tuning never touches the hidden path.
Mismatch between defender and attacker goals hurts. The attacker poisons on HEx-PHI categories 1–6; the defender anchors on the disjoint categories 7–11. Keyword ASR only falls from 90.5% to 28.3%. Anchoring on AdvBench (the paper's "practical" case) lands at 12.7%. The matched "ideal" case is 9.4%.
For anyone pulling open-source weights and willing to spend a white-box GPU cycle, this is a "run it anyway" cleaner. No trigger. No clean twin model. On 7B it is 0.1 GPU hours.
It is not a new alignment method. It takes the same embedding-geometry idea as refusal directions and representation engineering, and uses it to scrub a backdoor.
The envelope is explicit: white-box, 7B, safety backdoors (jailbreaks or vulnerable code). Some of the MT-Bench gain is undoing damage the attack itself inflicted. Llama-2-7b-Chat can score 6.37; backdoored Model 4 sits at 3.62; BEEAR brings it to 4.23, still well below the clean base.
The paper flags two limits. If the defender's harmful contrast set is far from the attacker's goal, for example the attacker wants a specific URL while the defender is fighting generic jailbreaks, BEEAR weakens. Table 6's 28.3% is that warning with a number. Utility is also almost entirely MT-Bench. The IFEval appendix on Model 1 moves prompt-level strict accuracy from 0.181 to 0.185, which is noise.
A few more caveats sit in the tables. All eight models are 7B. The perturbation is layer 9, length 5; ablations like layers 9–12, but a new architecture needs a rescan. An adaptive attacker who plants several disjoint embedding trajectories is untested. Sleeper Agents is 17 coding tasks; 0/17 has a wide interval.
In the worst case this is not "backdoors go to zero." What it does deliver is a runnable pipeline that does not need the trigger, and a clear win over input-space search when the trigger location is wrong.