Shared Latent Mechanisms Enable Unified Detection and Mitigation of Backdoor Attacks in LLMs
This paper demonstrates that diverse backdoor attacks in LLMs (jailbreaking, refusal manipulation, password-locking, bias induction, etc.) rely on a shared set of sparse autoencoder (SAE) latent features in residual-stream activations, rather than being isolated trigger-response phenomena. These features are causal (bidirectional steering controls attack success), generalize across model families (Qwen3, Gemma3, Llama3.1) and attack methods (fine-tuning, weight-editing), and enable zero-shot detection via lightweight classifiers. The authors propose Concept Ablation Fine-Tuning (CAFT) to suppress this shared latent subspace during training, offering a unified defense.