Elamur Research⌕
☰
home / papers / 2026 / SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs

SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs

Paper · 2026 · Wu Zhengxian, Juan Wen, Wanli Peng et al.

Summary

Customized LLM agents served through APIs usually keep their system prompts hidden. An attacker can therefore plant a backdoor instruction there that forces a fixed answer whenever a trigger appears. Earlier prompt-based defenses can flag such poisoned inputs, but they cannot restore the correct prediction.

The authors first ran pilot studies and identified two effects. In the first, called cognitive override, the trigger takes control of the model's reasoning. In the second, abnormal semantic correlation, the poisoned model rates even unrelated triggers as strongly tied to the target label.

SLIP responds with two components that work purely through prompting. KCoT is a chain-of-thought prompt that makes the model pull out task-relevant keywords and phrases. SLM is a soft-label scheme: label classes become score ranges, each extracted phrase receives a correlation score, and statistical clustering discards outlier phrases. The averaged score of the remaining phrases then decides the label.

Tests cover classification and QA, four black-box attacks and three LLMs. SLIP beats existing black-box defenses, which matters because it allows correct answers to be recovered without access to the model's weights.

Key points

  • Headline results: average attack success rate falls to 25.13%, and clean accuracy (CACC) rises to 87.15%.

  • Experimental setup:

    • Models: GPT-3.5-turbo, DeepSeek-V3 and Claude-3.
    • Classification datasets: SST2, AGnews and Amazon.
    • QA datasets: CSQA and MMLU.
    • Attacks: word-level, syntax-level and semantic Instruction-Backdoor variants, plus BadChain.
    • Baselines: ONION, ZS-CoT and CoS.

  • Pilot finding: on GPT-3.5-turbo, adding the backdoor instruction drove ASR as high as 99%. The same poisoned inputs were misclassified far less often without it.

  • Ablation (DeepSeek-V3, Amazon):

    ConfigurationAverage ASRTrigger survival rateCACC
    KCoT alone53.28%59.95%—
    KCoT + SLM29.05%(not reported)88.78%

    Triggers often survive keyword extraction, so the drop in ASR comes from SLM filtering them out afterwards.

  • Limitations and code: the method only handles discrete outputs (classification and multiple-choice QA) and is weaker on short inputs. Code is available in the CAU-ISS-Lab GitHub repository.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓China Agricultural UniversityBeijing · China4 works · 17 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

Cite

Cite as Wu Zhengxian, Juan Wen, Wanli Peng, Haowei Chang, Yinghan Zhou and Xue Yiming. 2026. SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.896

@inproceedings{zhengxian2026slip,
  title = {{SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs}},
  author = {Wu Zhengxian, Juan Wen, Wanli Peng, Haowei Chang, Yinghan Zhou and Xue Yiming},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.896},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.896}
}

References

44 references, 13 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, and 1 others. 2024. A survey on evaluation of large language models. ACM transactions on intelligent systems and technology, 15(3):1–45.
  2. Chuanshuai Chen and Jiazhu Dai. 2021. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253–262. find
  3. Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Proceedings of the 37th Annual Computer Security Applications Conference, ACSAC ’21, page 554–569,… find
  4. Pengzhou Cheng, Zongru Wu, Wei Du, Haodong Zhao, Wei Lu, and Gongshen Liu. 2025. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems. find
  5. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. find
  6. Wei Du, Tianjie Ju, Ge Ren, GaoLei Li, and Gongshen Liu. 2024. Backdoor NLP models via AI-generated text. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pages 2067–2079, Torino, Italia. ELRA and ICCL. find
  7. Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C. Ranasinghe, and Hyoungshick Kim. 2022. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 19(4):2349–2364. find
  8. Huaizhi Ge, Yiming Li, Qifan Wang, Yongfeng Zhang, and Ruixiang Tang. 2025. When backdoors speak: Understanding LLM backdoor attacks through model-generated explanations. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2278–22… find
  9. Xuanli He, Jun Wang, Benjamin Rubinstein, and Trevor Cohn. 2023a. IMBERT: Making BERT immune to insertion-based backdoor attacks. In Proceedings of the 3rd Workshop on Trustworthy Natural Language Processing (TrustNLP 2023), pages 287–301, Toronto, Canada. Association for Computational Linguistics. find
  10. Xuanli He, Qiongkai Xu, Jun Wang, Benjamin Rubinstein, and Trevor Cohn. 2023b. Mitigating backdoor poisoning attacks through the lens of spurious correlation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 953–967, Singapore. Association for Computat… find
  11. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR).
  12. Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. 2024. Pleak: Prompt leaking attacks against large language model applications. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3600–3614. find
  13. Lesheng Jin, Zihan Wang, and Jingbo Shang. 2022. WeDef: Weakly supervised backdoor defense for text classification. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 11614–11626, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics… find
  14. Takeshi Kojima, Shixiang (Shane) Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners. In Advances in Neural Information Processing Systems, volume 35, pages 22199–22213. Curran Associates, Inc.
  15. Jiazhao Li, Yijin Yang, Zhuofeng Wu, V.G.Vinod Vydiswaran, and Chaowei Xiao. 2024a. ChatGPT as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics:… find
  16. Xi Li, Ruofan Mao, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2025. Chain-of-scrutiny: Detecting backdoor attacks for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 7705–7727, Vienna, Austria. Association for Computational Linguistics. find
  17. Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. 2024b. Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models. Preprint, arXiv:2408.12798. — [arXiv:2408.12798](https://arxiv.org/abs/2408.12798) find
  18. Zi Liang, Haibo Hu, Qingqing Ye, Yaxin Xiao, and Haoyang Li. 2024. Why are my prompts leaked? unraveling prompt extraction threats in customized large language models. arXiv preprint arXiv:2408.02416. — [arXiv:2408.02416](https://arxiv.org/abs/2408.02416) find
  19. Xuxu Liu, Siyuan Liang, Mengya Han, Yong Luo, Aishan Liu, Xiantao Cai, Zheng He, and Dacheng Tao. 2025. ELBA-bench: An efficient learning backdoor attacks benchmark for large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long P… find
  20. Do Xuan Long, Duong Ngoc Yen, Anh Tuan Luu, Kenji Kawaguchi, Min-Yen Kan, and Nancy F. Chen. 2024. Multi-expert prompting improves reliability, safety and usefulness of large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20370–20401… find
  21. Jianmo Ni, Jiacheng Li, and Julian McAuley. 2019. Justifying recommendations using distantly-labeled reviews and fine-grained aspects. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (…
  22. Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. 2022. Hidden trigger backdoor attack on NLP models via linguistic style manipulation. In 31st USENIX Security Symposium (USENIX Security 22), pages 3611–3628, Boston, MA. USENIX Association. find
  23. Hengzhi Pei, Jinyuan Jia, Wenbo Guo, Bo Li, and Dawn Song. 2023. Textguard: Provable defense against backdoor attacks on text classification. Preprint, arXiv:2311.11225. find
  24. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a. ONION: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 9558–9566, Online and Punta Cana, Dominican Repub…
  25. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021b. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. pages 443–453.
  26. Guangyu Shen, Siyuan Cheng, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Hanxi Guo, Lu Yan, Xiaolong Jin, Shengwei An, Shiqing Ma, and 1 others. 2024. Bait: Large language model backdoor scanning by inverting attack target. In 2025 IEEE Symposium on Security and Privacy (SP), pages 103–103. IEEE Compute… find
  27. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In EMNLP.
  28. Xiaofei Sun, Xiaoya Li, Jiwei Li, Fei Wu, Shangwei Guo, Tianwei Zhang, and Guoyin Wang. 2023. Text classification via large language models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 8990–9005, Singapore. Association for Computational Linguistics.
  29. Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. 2019. CommonsenseQA: A question answering challenge targeting commonsense knowledge. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,…
  30. Terry Tong, Fei Wang, Zhe Zhao, and Muhao Chen. 2025. Badjudge: Backdoor vulnerabilities of llm-asa-judge. In The Thirteenth International Conference on Learning Representations. find
  31. Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024. BadAgent: Inserting and activating backdoor attacks in LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9811–9827, Bangkok, Thailand. Association fo… find
  32. Zhengxian Wu, Juan Wen, Wanli Peng, Ziwei Zhang, Yinghan Zhou, and Yiming Xue. 2025a. BadApex: Backdoor attack based on adaptive optimization mechanism of black-box large language models. Preprint, arXiv:2504.13775. — [arXiv:2504.13775](https://arxiv.org/abs/2504.13775) find
  33. Zhengxian Wu, Juan Wen, Wanli Peng, Yinghan Zhou, and Tongdou Chang. 2025b. BeDKD: Backdoor defense based on directional mapping module and adversarial knowledge distillation. In The Fortieth AAAI Conference on Artificial Intelligence. find
  34. Zhengxian Wu, Juan Wen, Wanli Peng, Yinghan Zhou, and Ziwei Zhang. 2025c. IBSD: Iterable black-box self-defense against backdoor attacks. IEEE Signal Processing Letters, 32:3979–3983. find
  35. Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. 2024. Watch out for your agents! investigating backdoor threats to llm-based agents. Advances in Neural Information Processing Systems, 37:100938–100964. find
  36. Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 8365–8381, Online and Punta Cana, Dominican Republi…
  37. Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Zhixuan Chu, and Yiming Li. 2025. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In The Thirteenth International Conference on Learning Representations. find
  38. Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized LLMs. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1849–1866, Philadelphia, PA. USENIX Association. find
  39. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In NeurIPS.
  40. Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, and 1 others. 2023. A survey of large language models. arXiv preprint arXiv:2303.18223, 1(2).
  41. Xingyi Zhao, Depeng Xu, and Shuhan Yuan. 2024. Defense against backdoor attack on pre-trained language models via head pruning and attention normalization. In Forty-first International Conference on Machine Learning. find
  42. Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. Badchain: Backdoor chain-of-thought prompting for large language models. In The Twelfth International Conference on Learning Representations. find
  43. Benfeng Xu, An Yang, Junyang Lin, Quan Wang, Chang Zhou, Yongdong Zhang, and Zhendong Mao. 2023. Expertprompting: Instructing large language models to be distinguished experts. arXiv preprint arXiv:2305.14688.
  44. Jun Yan, Vansh Gupta, and Xiang Ren. 2023. BITE: Textual backdoor attacks with iterative trigger injection. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 12951–12968, Toronto, Canada. Association for Computational Linguistic… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zhengxian-2026-slip-soft-label-mechanism-key/