Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation

Hugging Face Daily Papers Papers
backdoor-removal llm-security weight-orthogonalisation model-safety training-free poisoning-defense interpretability

Summary

NEEDLE is a training-free method for removing backdoors from LLMs that estimates a backdoor direction and a refusal subspace, then applies sequential weight orthogonalisation to suppress backdoors while preserving refusal behaviour and model capability. It achieves the lowest Attack Success Rate (including 0% on code injection attacks) with minimal KL divergence and safety degradation across multiple model families.

Backdoor attacks can be implanted in Large Language Models (LLMs) during training, causing unwanted behaviour when a trigger appears in the input. Existing backdoor defences for LLMs attempt to remove the backdoor but inadvertently shift the model's output distribution to benign prompts, which can result in degraded model performance and safety. We propose NEEDLE, a training-free method for targeted backdoor removal. Once a trigger has been identified, our method estimates a backdoor direction and a refusal subspace through activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preventing changes in refusal-related representations. NEEDLE requires neither a clean reference model nor the original poisoned training data. Evaluation is conducted across multiple model families and attack types. NEEDLE achieves the lowest mean Attack Success Rate (ASR) among the evaluated defences, including 0% on challenging code injection attacks, while resulting in the lowest KL divergence and minimal changes in capability and safety.
Original Article
View Cached Full Text

Cached at: 10/02/26, 12:28 PM

Paper page - Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation

Source: https://huggingface.co/papers/2610.00348

Abstract

BackdoorattackscanbeimplantedinLargeLanguageModels(LLMs)duringtraining,causingunwantedbehaviourwhenatriggerappearsintheinput.ExistingbackdoordefencesforLLMsattempttoremovethebackdoorbutinadvertentlyshiftthemodel’soutputdistributiontobenignprompts,whichcanresultindegradedmodelperformanceandsafety.WeproposeNEEDLE,atraining-freemethodfortargetedbackdoorremoval.Onceatriggerhasbeenidentified,ourmethodestimatesabackdoordirectionandarefusalsubspacethroughactivationvectors,thenappliessequentialweightorthogonalisationtosuppressthebackdoorwhilepreventingchangesinrefusal-relatedrepresentations.NEEDLErequiresneitheracleanreferencemodelnortheoriginalpoisonedtrainingdata.Evaluationisconductedacrossmultiplemodelfamiliesandattacktypes.NEEDLEachievesthelowestmeanAttackSuccessRate(ASR)amongtheevaluateddefences,including0%onchallengingcodeinjectionattacks,whileresultinginthelowestKLdivergenceandminimalchangesincapabilityandsafety.

View arXiv pageView PDFGitHub1Add to collection

Community

Paper author

Paper submitter

about 3 hours ago

NEEDLE is a training-free backdoor defence designed to remove a backdoor with minimal changes to model behaviour and safety. It estimates a backdoor direction (how the trigger shifts the model’s activations) and a refusal subspace (directions that mediate refusal), then edits the model’s weights layer by layer: each layer’s attention and MLP output weights are orthogonalised against the backdoor direction while keeping their refusal projections fixed, and a closed-form correction keeps the activations’ refusal projections unchanged as earlier layers are edited.

Codebase:https://github.com/LocaiLabs/NEEDLE/ Models:https://huggingface.co/collections/locailabs/needle

This is great work, super relevant in this day and age!

Upload images, audio, and videos by dragging in the text input, pasting, orclicking here.

Tap or paste here to upload images

Get this paper in your agent:

hf papers read 2610\.00348

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper24

#### locailabs/Qwen3-4B-Instruct-2507-TargetedRefusal-BadNet-Backdoored Text Generation• 4B• Updatedabout 3 hours ago #### locailabs/Gemma-3-4B-IT-Sentiment-BadNet-Backdoored Text Generation• 4B• Updatedabout 3 hours ago #### locailabs/Gemma-3-4B-IT-Sentiment-Sleeper-Backdoored Text Generation• 4B• Updatedabout 3 hours ago #### locailabs/Gemma-3-4B-IT-TargetedRefusal-BadNet-Backdoored Text Generation• 4B• Updatedabout 3 hours ago Browse 24 models citing this paper## Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2610.00348 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2610.00348 in a Space README.md to link it from this page.

Collections including this paper1

Similar Articles

Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection

arXiv cs.AI

This paper proposes a backdoor purification method for LoRA-tuned LLMs that projects LoRA updates onto orthogonal null spaces without needing trigger knowledge, clean references, or retraining, cutting attack success rates from ~100% to under 10% while preserving base model and adapter performance.