Elamur Research⌕
☰
home / papers / 2026 / Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

Paper · 2026 · Vu Tuan Truong and Long Bao Le

Summary

The paper tackles reasoning-level backdoors in LLMs. In these attacks, a trigger causes the model to slip a malicious step into its chain-of-thought, such as an extra multiplication. The resulting wrong answer still looks consistent with the reasoning, so output-based filters and consistency checks like CoS fail.

The authors propose Critical-CoT, which teaches a model to examine prompts critically, spot suspicious triggers or poisoned demonstrations, and then ignore the injected step. They build a defensive dataset, CTCoT, using a clean auxiliary LLM. It shows what backdoored prompts and poisoned CoTs look like and how the model should respond. Training happens in two stages: SFT instils the defensive behaviour, and DPO sharpens the boundary between clean and triggered queries while reducing over-caution.

The defender needs no knowledge of the trigger, target, task, or attack type. The defense covers both ICL-based and FT-based attacks. Across several LLMs and datasets, it pushes attack success below 1% while keeping clean accuracy close to an unpoisoned model, and it transfers across domains and tasks. Because it is a one-time fine-tune, it adds no per-query inference cost.

Key points

  • Attacks covered: ICL-based attacks (BadChain-style poisoned demonstrations) and FT-based attacks (BALD, ShadowCoT-style poisoned fine-tuning). The authors present Critical-CoT as the first unified defense for both at the reasoning level.
  • Comparison with baselines:
    • Critical-CoT alone keeps ASR under 1% with near-clean utility.
    • ONION and CoS still allow roughly 60–65% ASR and lose utility.
    • Shuffle and Shuffle++ cut ASR but badly hurt clean accuracy.
    • CFT actually increases vulnerability.
  • Ablation:
    • SFT alone detects backdoors but becomes over-cautious.
    • DPO alone lacks defensive knowledge.
    • SFT+DPO performs best, with a backdoor detection rate of about 98.9%.
  • Dataset size: The defensive dataset mixes defensive and clean examples 50/50. Near-perfect defense appears at about 1000 examples, after which gains level off.
  • Limitations:
    • Fine-tuning has a compute cost.
    • Residual accuracy under FT-based attacks stays below clean accuracy.
    • Semantic or contextual triggers are not yet handled.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Institut National de la Recherche ScientifiqueQuébec · Canada2 works🎓Université du QuébecQuébec · Canada2 works

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,320 worksReasoning · 1,426 works

Cite

Cite as Vu Tuan Truong and Long Bao Le. 2026. Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.495

@inproceedings{truong2026critical,
  title = {{Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models}},
  author = {Vu Tuan Truong and Long Bao Le},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.495},
  url = {https://doi.org/10.18653/v1/2026.acl-long.495}
}

References

31 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Sandhini Agarwal, Lama Ahmad, Jason Ai, Sam Altman, Andy Applebaum, Edwin Arbus, Rahul K Arora, Yu Bai, Bowen Baker, Haiming Bao, and 1 others. 2025. gpt-oss-120b & gpt-oss-20b model card. arXiv:2508.10925.
  2. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, and 1 others. 2021. Training verifiers to solve math word problems. arXiv:2110.14168. 10831 9
  3. Sagar Goyal, Eti Rastogi, Sree Prasanna Rajagopal, Dong Yuan, Fen Zhao, Jai Chintagunta, Gautam Naik, and Jeff Ward. 2024. Healai: A healthcare llm for effective medical documentation. In ACM WSDM, pages 1167–1168. find
  4. Amrith Setlur, Saurabh Garg, Xinyang Geng, Naman Garg, Virginia Smith, and Aviral Kumar. 2024. Rl on incorrect synthetic data scales the efficiency of llm math reasoning by eight-fold. NeurIPS, 37:43000– 43031. find
  5. Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. 2021. Measuring mathematical problem solving with the math dataset. In NeurIPS Datasets and Benchmarks Track.
  6. Fangxun Shu, Lei Zhang, Hao Jiang, and Cihang Xie. 2025. Audio-visual llm for video understanding. In ICCV, pages 4246–4255. find
  7. Wenbo Hu, Yifan Xu, Yi Li, Weiyue Li, Zeyuan Chen, and Zhuowen Tu. 2024. Bliva: A simple multimodal llm for better handling of text-rich visual questions. In AAAI, volume 38, pages 2256–2264. find
  8. Chan Hee Song, Jiaman Wu, Clayton Washington, Brian M Sadler, Wei-Lun Chao, and Yu Su. 2023. Llm-planner: Few-shot grounded planning for embodied agents with large language models. In CVPR, pages 2998–3009.
  9. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite backdoor attacks against large language models. In NAACL, pages 1459–1472. find
  10. Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. 2019. Commonsenseqa: A question answering challenge targeting commonsense knowledge. In NAACL, pages 4149–4158.
  11. Ruochen Jiao, Shaoyuan Xie, Justin Yue, TAKAMI SATO, Lixu Wang, Yixuan Wang, Qi Alfred Chen, and Qi Zhu. 2025. Can we trust embodied agents? exploring backdoor attacks against embodied llm-based decision-making systems. In ICLR. find
  12. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, and 1 others. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv:2307.09288.
  13. Xi Li, Ruofan Mao, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2025. Chain-of-scrutiny: Detecting backdoor attacks for large language models. In ACL, pages 7705–7727. find
  14. Vu Tuan Truong, Luan Ba Dang, and Long Bao Le. 2025. Attacks and defenses for generative diffusion models: A comprehensive survey. ACM Computing Surveys, 57(8):1–44. find
  15. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: Defending against backdooring attacks on deep neural networks. In RAID, pages 273–294. Springer. find
  16. Fangwen Mu, Lin Shi, Song Wang, Zhuohao Yu, Binquan Zhang, ChenXue Wang, Shichao Liu, and Qing Wang. 2024. Clarifygpt: A framework for enhancing llm-based code generation via requirements clarification. Proceedings of the ACM on Software Engineering, 1(FSE):2332–2354. find
  17. Zijie Pan, Yushan Jiang, Sahil Garg, Anderson Schneider, Yuriy Nevmyvaka, and Dongjin Song. 2024. S2ip-llm: Semantic space informed prompt learning with llm for time series forecasting. In ICML. find
  18. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021. Onion: A simple and effective defense against textual backdoor attacks. In EMNLP, pages 9558–9566.
  19. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. NeurIPS, 36:53728–53741.
  20. Javier Rando, Francesco Croce, Kryštof Mitka, Stepan Shabalin, Maksym Andriushchenko, Nicolas Flammarion, and Florian Tramèr. 2024. Competition report: Finding universal jailbreak backdoors in aligned llms. arXiv:2404.14461. — [arXiv:2404.14461](https://arxiv.org/abs/2404.14461) find
  21. Vu Tuan Truong and Long Bao Le. 2026. A dual-purpose framework for backdoor defense and backdoor amplification in diffusion models. IEEE Transactions on Information Forensics and Security. find
  22. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. Chain-of-thought prompting elicits reasoning in large language models. NeurIPS, 35:24824–24837.
  23. Zhaohan Xi, Tianyu Du, Changjiang Li, Ren Pang, Shouling Ji, Jinghui Chen, Fenglong Ma, and Ting Wang. 2023. Defending pre-trained language models as few-shot learners against backdoor attacks. NeurIPS, 36:32748–32764. find
  24. Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. Badchain: Backdoor chain-of-thought prompting for large language models. In ICLR. find
  25. Zihao Xue, Zhen Bi, Long Ma, Zhenlin Hu, Yan Wang, Zhenfang Liu, Qing Sheng, Jie Xiao, and Jungang Lou. 2025. Thought purity: A defense framework for chain-of-thought attack. arXiv:2507.12314. — [arXiv:2507.12314](https://arxiv.org/abs/2507.12314) find
  26. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv:2505.09388. 10832 10
  27. Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024. Watch out for your agents! investigating backdoor threats to llm-based agents. NeurIPS, 37:100938–100964. find
  28. Hongwei Yao, Jian Lou, and Zhan Qin. 2024. Poison-prompt: Backdoor attack on prompt-based large language models. In ICASSP, pages 7745–7749. IEEE. find
  29. Yi Zeng, Weiyu Sun, Tran Huynh, Dawn Song, Bo Li, and Ruoxi Jia. 2024. Beear: Embedding-based adversarial removal of safety backdoors in instruction-tuned language models. In EMNLP, pages 13189– 13215. find
  30. Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized {LLMs}. In USENIX Security Symposium, pages 1849–1866. find
  31. Gejian Zhao, Hanzhou Wu, Xinpeng Zhang, and Athanasios V Vasilakos. 2025. Shadowcot: Cognitive hijacking for stealthy reasoning backdoors in llms. arXiv:2504.05605. 10833 11 — [arXiv:2504.05605](https://arxiv.org/abs/2504.05605) find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/truong-2026-critical-cot-robust-defense-framework/