DeCNIP Removes LLM Backdoors by Pruning 0.1% of Neurons — 95%+ Attack Success Reduction, 97% Utility Retained

arXiv 2607.19894·medium signal

Existing backdoor defenses target fine-tuning-based implants and classification settings, missing model-editing attacks that bypass the training pipeline entirely and failing to extend to open-ended generation. DeCNIP instead finds the mechanism: it optimizes a cross-entropy loss between harmful prompts with candidate tokens and benign inputs to surface trigger-like behavior, isolates the Backdoor Critical Neurons that triggers hijack, and prunes only those. Across six open-source LLMs and two benchmarks it cuts attack success rate by over 95% relative — beating seven state-of-the-art defenses — while intervening on 0.1% of neurons and keeping 97% of normal benchmark performance.