Elamur Research⌕
☰
home / papers / 2026 / P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs

P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs

Paper · 2026 · Shuai Zhao, Xinyi Wu, Shiqian Zhao et al.

Summary

Fine-tuning LLMs on third-party or outsourced data exposes them to data-poisoning backdoors. Most existing defenses filter or sanitize inputs and only work against particular trigger styles or task types. Onion targets character-level triggers, while PDB and PSIM are limited to classification. The authors propose Poison-to-Poison (P2P), which deliberately adds a second, controlled backdoor. A small share of training samples gets a benign trigger, which also serves as a prompt in prompt-based learning. These samples receive labels from an extended label space: classes shift from i to i+n, and generative targets get a prefix. At inference, in a Model-as-a-Service setting, the defender places the benign trigger in the system prompt and reads predictions from the alternative labels. This crowds out unknown malicious triggers. A theoretical argument and experiments cover text and multimodal classification, mathematical reasoning and summarization with several LLMs. Attack success rates fall to low levels while clean accuracy is kept or slightly improved. The result points to proactive immunization as a task-agnostic alternative to reactive filtering.

Key points

  • Six attacks were tested: BadNets, AddSent, SynAttack, ProAttack, CbaAttack and MtbaAttack. Victim models included LLaMA-3.1-Instruction, DeepSeek-R1 and Qwen-3. On SST-2 with LLaMA-3.1-Instruction, ASR dropped from about 100% to roughly 4–16%, and CA was about 96%.
  • On Qwen-3 under BadNets with two different prompts:
    • SST-2: ASR fell from 99.78% to 6.03% and 4.17%, while CA rose from 94.56% to about 96%.
    • AG's News: ASR fell from 97.07% to 1.47%.
  • In ablations on SST-2 with Qwen-3, ASR stayed below 10% for poisoning ratios from 2% to 10%. Using more benign samples (5–30%) pushed CA toward 97%. Higher LoRA-style ranks further lowered ASR.
  • Results were stable across different verbalizer tokens and different benign prompts.
  • The authors note two limitations:
    • The method still needs testing on more vision and multimodal models.
    • The number of reserved samples is often larger than the number of poisoned ones, which may carry its own risks.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Shanghai Jiao Tong UniversityShanghai · China149 works · 16,161 citations🎓Nanyang Technological UniversitySingapore · Singapore156 works · 25,644 citations🎓University of AberdeenAberdeen · United Kingdom20 works · 1,385 citations🎓VinUniversityHanoi · Vietnam11 works · 56 citations

 Fields, topics and concepts

📚 Shelves 2The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,320 works

Cite

Cite as Shuai Zhao, Xinyi Wu, Shiqian Zhao, Xiaobao Wu, Zhongliang Guo, Yanhao Jia and Anh Tuan Luu. 2026. P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.600

@inproceedings{zhao2026p2p,
  title = {{P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs}},
  author = {Shuai Zhao, Xinyi Wu, Shiqian Zhao, Xiaobao Wu, Zhongliang Guo, Yanhao Jia and Anh Tuan Luu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.600},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.600}
}

References

65 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. AI@Meta. 2024. Llama 3 model card. find
  2. Sumit Asthana, Hannah Rashkin, Elizabeth Clark, Fantine Huot, and Mirella Lapata. 2024. Evaluating llms for targeted concept simplification for domain-specific texts. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 6208–6226. find
  3. Chen Chen, Yuchen Sun, Jiaxin Gao, Xueluan Gong, Qian Wang, Ziyao Wang, Yongsen Zheng, and Kwok-Yan Lam. 2025. Lethe: Purifying backdoored large language models with knowledge dilution. arXiv preprint arXiv:2508.21004. — [arXiv:2508.21004](https://arxiv.org/abs/2508.21004) find
  4. Chuanshuai Chen and Jiazhu Dai. 2021. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253–262. find
  5. Pengzhou Cheng, Zongru Wu, Wei Du, Haodong Zhao, Wei Lu, and Gongshen Liu. 2025. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems. find
  6. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. find
  7. Xuan Feng, Bo An, Tianlong Gu, Liang Chang, Fengrui Hao, Peipeng Yu, and Shuai Zhao. 2025a. C2po: Diagnosing and disentangling bias shortcuts in llms. arXiv preprint arXiv:2512.23430. find
  8. Xuan Feng, Tianlong Gu, Liang Chang, and Xiaoli Liu. 2024. Protect: Parameter-efficient tuning for few-shot robust chinese text correction. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 32:3270–3282. find
  9. Xuan Feng, Tianlong Gu, Xiaoli Liu, and Liang Chang. 2025b. Learning from mistakes: Self-correct adversarial training for chinese unnatural text correction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23887–23895. find
  10. Xuan Feng, Shuai Zhao, Luwei Xiao, Tianlong Gu, and Bo An. 2026. Self-debias: Self-correcting for debiasing large language models. find
  11. Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2022. Triggerless backdoor attack for nlp tasks with clean labels. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lan… find
  12. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733.
  13. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseekr1: Incentivizing reasoning capability in llms via reinforcement learning. Nature. find
  14. Zhongliang Guo, Ognjen Arandjelović, David Reid, Yaxiong Lei, and Jochen Büttner. 2023. A siamese transformer network for zero-shot ancient coin classification. Journal of imaging, page 107. find
  15. Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. 2022. Iron: Private inference on transformers. Advances in neural information processing systems, 35:15718–15731. find
  16. Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, and Tianwei Zhang. 2023. Fastsecnet: An efficient cryptographic framework for private neural network inference. IEEE Transactions on Information Forensics and Security, 18:2569–2582. find
  17. Meng Hao, Hongwei Li, Xizhao Luo, Guowen Xu, Haomiao Yang, and Sen Liu. 2019. Efficient and privacy-enhanced federated learning for industrial artificial intelligence. IEEE Transactions on Industrial Informatics, 16(10):6532–6542. find
  18. Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, and 1 others. 2021. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representations.
  19. Man Hu, Yahui Ding, Yatao Yang, Liangyu Chen, Yanhao Jia, and Shuai Zhao. 2025a. Dup: Detection-guided unlearning for backdoor purification in language models. arXiv preprint arXiv:2508.01647. — [arXiv:2508.01647](https://arxiv.org/abs/2508.01647) find
  20. Man Hu, Xinyi Wu, Zuofeng Suo, Jinbo Feng, Linghui Meng, Yanhao Jia, Anh Tuan Luu, and Shuai Zhao. 2025b. Rethinking reasoning: A survey on reasoning-based backdoors in llms. find
  21. Man Hu, Yatao Yang, Deng Pan, Zhongliang Guo, Luwei Xiao, Deyu Lin, and Shuai Zhao. 2025c. Syntactic paraphrase-based synthetic data generation for backdoor attacks against chinese language models. Information Fusion, page 103376. find
  22. Minqing Hu and Bing Liu. 2004. Mining and summarizing customer reviews. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 168–177. find
  23. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite backdoor attacks against large language models. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 1459–1472. find
  24. Yujin Huang, Terry Yue Zhuo, Qiongkai Xu, Han Hu, Xingliang Yuan, and Chunyang Chen. 2023. Training-free lexical backdoor attacks on language models. In Proceedings of the ACM Web Conference 2023, pages 2198–2208. find
  25. Yanhao Jia, Xinyi Wu, Li Hao, QinglinZhang QinglinZhang, Yuxiao Hu, Shuai Zhao, and Wenqi Fan. 2025a. Uni-retrieval: A multi-style retrieval framework for stem’s education. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 10182–10197. find
  26. Yanhao Jia, Xinyi Wu, Qinglin Zhang, Yiran Qin, Luwei Xiao, and Shuai Zhao. 2025b. Towards robust evaluation of stem education: Leveraging mllms in project-based learning. arXiv preprint arXiv:2505.17050. — [arXiv:2505.17050](https://arxiv.org/abs/2505.17050) find
  27. Yanhao Jia, Ji Xie, S Jivaganesh, Hao Li, Xu Wu, and Mengmi Zhang. 2025c. Seeing sound, hearing sight: Uncovering modality bias and conflict of ai models in sound localization. arXiv preprint arXiv:2505.11217. — [arXiv:2505.11217](https://arxiv.org/abs/2505.11217) find
  28. Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. 2023. Backdoor attacks for in-context learning with language models. In The Second Workshop on New Frontiers in Adversarial Machine Learning. find
  29. Douwe Kiela, Hamed Firooz, Aravind Mohan, Vedanuj Goswami, Amanpreet Singh, Pratik Ringshia, and Davide Testuggine. 2020. The hateful memes challenge: Detecting hate speech in multimodal memes. Advances in neural information processing systems, 33:2611–2624.
  30. Jiazhao Li, Zhuofeng Wu, Wei Ping, Chaowei Xiao, and VG Vinod Vydiswaran. 2023a. Defending against insertion-based textual backdoor attacks via attribution. In Findings of the Association for Computational Linguistics: ACL 2023, pages 8818–8833. find
  31. Yige Li, Jiabo He, Hanxun Huang, Jun Sun, Xingjun Ma, and Yu-Gang Jiang. 2025. Shortcuts everywhere and nowhere: Exploring multi-trigger backdoor attacks. IEEE Transactions on Dependable and Secure Computing. find
  32. Yinheng Li, Shaofei Wang, Han Ding, and Hang Chen. 2023b. Large language models in finance: A survey. In Proceedings of the fourth ACM international conference on AI in finance, pages 374–382. find
  33. Ziqiang Li, Yueqi Zeng, Pengfei Xia, Lei Liu, Zhangjie Fu, and Bin Li. 2024. Large language models are good attackers: Efficient and stealthy textual backdoor attacks. arXiv preprint arXiv:2408.11587. — [arXiv:2408.11587](https://arxiv.org/abs/2408.11587) find
  34. Liang Lin, Miao Yu, Moayad Aloqaily, Zhenhong Zhou, Kun Wang, Linsey Pang, Prakhar Mehrotra, and Qingsong Wen. 2025a. Backdoor collapse: Eliminating unknown threats via known backdoor aggregation in language models. arXiv preprint arXiv:2510.10265. find
  35. Liang Lin, Miao Yu, Kaiwen Luo, Yibo Zhang, Lilan Peng, Dexian Wang, Xuehai Tang, Yuanhe Zhang, Xikang Yang, Zhenhong Zhou, and 1 others. 2025b. Hidden in the noise: Unveiling backdoors in audio llms alignment through latent acoustic pattern triggers. arXiv preprint arXiv:2508.02175. — [arXiv:2508.02175](https://arxiv.org/abs/2508.02175) find
  36. Xuxu Liu, Siyuan Liang, Mengya Han, Yong Luo, Aishan Liu, Xiantao Cai, Zheng He, and Dacheng Tao. 2025. Elba-bench: An efficient learning backdoor attacks benchmark for large language models. arXiv preprint arXiv:2502.18511. find
  37. Wei Lu, Rachel K Luu, and Markus J Buehler. 2025. Fine-tuning large language models for domain adaptation: Exploration of training strategies, scaling, model merging and synergistic capabilities. npj Computational Materials, 11(1):84. find
  38. Abdullah Arafat Miah and Yu Bi. 2024. Exploiting the vulnerability of large language models via defense-aware architectural backdoor. arXiv preprint arXiv:2409.01952. — [arXiv:2409.01952](https://arxiv.org/abs/2409.01952) find
  39. Rui Min, Zeyu Qin, Nevin L Zhang, Li Shen, and Minhao Cheng. 2024. Uncovering, explaining, and mitigating the superficial safety of backdoor defense. Advances in Neural Information Processing Systems, 37:77934–77961. find
  40. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a. Onion: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 9558–9566.
  41. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021b. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint…
  42. Jayaram Raghuram, George Kesidis, and David J Miller. 2024. A study of backdoors in instruction fine-tuned language models. arXiv preprint arXiv:2406.07778. — [arXiv:2406.07778](https://arxiv.org/abs/2406.07778) find
  43. Salahuddin Salahuddin, Ahmed Hussain, Jussi Löppö-nen, Toni Jutila, and Panos Papadimitratos. 2025. Less data, more security: Advancing cybersecurity llms specialization via resource-efficient domain-adaptive continuous pre-training with minimal tokens. arXiv preprint arXiv:2507.02964. find
  44. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631…
  45. Kaixuan Wang, Chenxin Diao, Jason T Jacques, Zhongliang Guo, and Shuai Zhao. 2025. Hripbench: Benchmarking llms in harm reduction information provision to support people who use drugs. arXiv preprint arXiv:2507.21815. — [arXiv:2507.21815](https://arxiv.org/abs/2507.21815) find
  46. Tong Wang, Yuan Yao, Feng Xu, Miao Xu, Shengwei An, and Ting Wang. 2024a. Inspecting prediction confidence for detecting black-box backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 274–282. find
  47. Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024b. Badagent: Inserting and activating backdoor attacks in llm agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, pages 9811–9827. find
  48. Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. 2024. Mitigating backdoor attack by injecting proactive defensive backdoor. Advances in Neural Information Processing Systems, 37:80674–80705. find
  49. Frank Xing. 2025. Designing heterogeneous llm agents for financial sentiment analysis. ACM Transactions on Management Information Systems, 16(1):1–24. find
  50. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  51. Tan Yue, Rui Mao, Xuzhao Shi, and Erik Cambria. 2026a. Interarm: Interpretable affective reasoning model for multimodal sarcasm detection. IEEE Transactions on Affective Computing. find
  52. Tan Yue, Xuzhao Shi, Rui Mao, Zilong Song, Zonghai Hu, and Dongyan Zhao. 2025. Anafig: A human-aligned dataset for scientific figure analysis. In Proceedings of the 33rd ACM International Conference on Multimedia, pages 12837–12843. find
  53. Tan Yue, Qiong Wu, and Dongyan Zhao. 2026b. Mars: Multimodal adaptive reasoning model for avoiding overthinking. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 34539– 34547. find
  54. Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized llms. In 33rd USENIX Security Symposium, pages 1849–1866. find
  55. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28.
  56. Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, and Jinming Wen. 2024a. Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3421–3438. find
  57. Shuai Zhao, Meihuizi Jia, Luu Anh Tuan, Fengjun Pan, and Jinming Wen. 2024b. Universal vulnerabilities in large language models: Backdoor attacks for in-context learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11507–11522. find
  58. Shuai Zhao, Qing Li, Yuer Yang, Jinming Wen, and Weiqi Luo. 2023a. From softmax to nucleusmax: A novel sparse language model for chinese radiology report summarization. ACM Transactions on Asian and Low-Resource Language Information Processing, 22(6):1–21. find
  59. Shuai Zhao, Qika Lin, Yanhao Jia, Xinyi Wu, Yuwen Li, and Luu Anh Tuan. 2026. Unifle: Uniform fusion of multiple lora experts for backdoor defense in large language models. IEEE Transactions on Dependable and Secure Computing. find
  60. Shuai Zhao, Jinming Wen, Anh Luu, Junbo Zhao, and Jie Fu. 2023b. Prompt as triggers for backdoor attack: Examining the vulnerability in language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12303–12317. find
  61. Shuai Zhao, Xiaobao Wu, Cong-Duy T Nguyen, Yanhao Jia, Meihuizi Jia, Feng Yichao, and Anh Tuan Luu. 2025a. Unlearning backdoor attacks for llms with weak-to-strong knowledge distillation. In Findings of the Association for Computational Linguistics: ACL 2025, pages 4937–4952. find
  62. Shuai Zhao, Xiaoyu Xu, Luwei Xiao, Jinming Wen, and Luu Anh Tuan. 2025b. Clean-label backdoor attack and defense: An examination of language model vulnerability. Expert Systems with Applications, 265:125856. find
  63. Shuai Zhao, Yulin Zhang, Luwei Xiao, Xinyi Wu, Yanhao Jia, Zhongliang Guo, Xiaobao Wu, Cong-Duy Nguyen, Guoming Zhang, and Anh Tuan Luu. 2025c. Affective-roptester: Capability and bias analysis of llms in predicting retinopathy of prematurity. IEEE Transactions on Affective Computing. find
  64. Wei Zhao, Mingyue Shang, Yang Liu, Liang Wang, and Jingming Liu. 2020. Ape210k: A large-scale and template-rich dataset of math word problems. arXiv preprint arXiv:2009.11506. find
  65. Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, and 1 others. 2022. Moderate-fitting as a natural backdoor defender for pre-trained language models. Advances in Neural Information Processing Systems, 35:1086–1099. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhao-2026-p2p-poison-poison-remedy-reliable/