| title | Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks |
|---|---|
| authors | John T. Halloran, Noopur S. Bhatt |
| date | 2026-05-18 |
| venue | arXiv (preprint, not peer reviewed) |
| id | arXiv:2605.19147 |
| upvotes | 1 (Hugging Face Daily Papers, 2026-11-01) |
| links | abs pdf hf |
| abstract | Large language models (LLMs) are highly susceptible to backdoor attacks (BAs), wherein training samples are poisoned using trigger-based harmful content. Furthermore, existing defenses have proven ineffective when extensively tested across BA patterns. To better combat BAs, we explore the use of LLM rewriting as a proactive defense against data poisoning. First, we theoretically show that when LLM rewriting utilizes open-book benign samples--termed open-book benign rewriting (OBBR)--the probability of a rewritten output being benign is strictly greater than that of closed-book rewriting. Thus, OBBR neutralizes harmful content by projecting training samples to the space of benign prompts. We then show that, in contrast to previous defenses, OBBR effectively mitigates a large number of existing BAs: across five known BAs and four widely used LLMs, OBBR increases safety performance by an average 51% compared to state-of-the-art BA defenses and 25.7% compared to closed-book rewriting methods. Finally, we show that OBBR is computationally efficient relative to other BA defenses, does not degrade model performance on natural language tasks after fine-tuning, and is capable of defending against non-trigger based data poisoning attacks. |
cite
@misc{halloran2026be,
title={Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks},
author={John T. Halloran and Noopur S. Bhatt},
year={2026},
eprint={2605.19147},
archivePrefix={arXiv},
url={https://arxiv.org/abs/2605.19147}
}