DeCNIP strips LLM backdoors by pruning 0.1% of neurons

DeCNIP removes backdoors from language models by pruning just 0.1% of their neurons, per the paper posted to arXiv.

Backdoors planted through model editing skip the fine-tuning stage most existing defenses are built to catch. Few of those defenses extend past simple classification into open-ended text generation, either. That's the gap that matters if you're pulling a checkpoint off Hugging Face and trusting it's clean. DeCNIP claims to close it by touching just 0.1% of a model's neurons.

The method optimizes a cross-entropy loss between harmful prompts paired with candidate trigger tokens and ordinary benign inputs. That surfaces the neurons that only light up when a trigger's present. It labels those the Backdoor Critical Neurons and prunes only those, leaving the rest of the model untouched.

Tested across six open-source LLMs and two benchmarks, it cut attack success by more than 95% relative to the unprotected models, beating seven state-of-the-art defenses. The pruned models still kept 97% of normal benchmark performance intact. The paper doesn't say which six models or which benchmarks, so how this holds up against the largest open-weight releases people download is still unknown.

A fix that touches 0.1% of neurons and costs a few points of performance sounds too cheap to be the last word. My bet: the next generation of backdoor attacks spreads its trigger across more, less concentrated neurons to dodge isolation. That would break DeCNIP's core assumption that a backdoor lives in a small, identifiable cluster.