Eliciting free-form descriptions of backdoor behavior without reversal training

Develop methods that enable GPT-4o-based backdoored models to describe their backdoor behaviors in free-form text without relying on reversal training or prior exposure to reversed trigger–behavior pairs.

Background

The paper studies backdoor behaviors and demonstrates that models can sometimes detect the presence of backdoors and recognize triggers in multiple-choice formats.

However, the authors explicitly state they were unable to prompt backdoored models to describe their backdoor behavior in free-form text unless reversal training was used, highlighting an unresolved challenge in elicitation.