@inproceedings{han-etal-2026-guardrails,
title = "Guardrails without Shackles: Mitigating Over-Defense in Inference-Time Detection of Fixed-Target Backdoors for {LLM}s",
author = "Han, Bingxu and
Wang, Fang and
Zhang, Bo and
Xia, Xingyou and
Zhang, Jun and
Cao, Yunbo and
Luo, Zhunchen and
Bai, Xiaoying and
Geng, Guotong and
Wang, Mingqiang",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.1998/",
pages = "42584--42607",
ISBN = "979-8-89176-462-0",
abstract = "Fixed-target backdoor attacks can silently hijack the outputs of large language models by driving models to generate attacker-specified sequences upon trigger activation, motivating lightweight inference-time detection. Recent defenses like ConfGuard, which we term Local-window Confidence Detectors, leverage sliding windows to identify local spans where the top-1 probability, referred to as token confidence, exceeds 0.99 as indicators of backdoor activation. However, benign deterministic tasks such as math reasoning can exhibit similar sustained high-confidence patterns, causing \textit{confidence conflation}. On the GSM8K dataset, ConfGuard{'}s default settings yield a 72.89{\%} false positive rate, causing substantial over-defense. Our empirical analysis reveals that benign deterministic generation exhibits sparse confidence ``dips'', whereas backdoor-triggered generation forms a sustained high-confidence ``plateau''. Building on this, we propose RatioGuard, which utilizes a global high-confidence token ratio computed over the generated prefix to address confidence conflation. Across models and datasets, RatioGuard reduces false positives by up to 71.57 percentage points over ConfGuard while maintaining over 99{\%} true positive rate with 1.005$\times$ runtime latency."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="han-etal-2026-guardrails">
<titleInfo>
<title>Guardrails without Shackles: Mitigating Over-Defense in Inference-Time Detection of Fixed-Target Backdoors for LLMs</title>
</titleInfo>
<name type="personal">
<namePart type="given">Bingxu</namePart>
<namePart type="family">Han</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Fang</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Bo</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xingyou</namePart>
<namePart type="family">Xia</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yunbo</namePart>
<namePart type="family">Cao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhunchen</namePart>
<namePart type="family">Luo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xiaoying</namePart>
<namePart type="family">Bai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Guotong</namePart>
<namePart type="family">Geng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Mingqiang</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Fixed-target backdoor attacks can silently hijack the outputs of large language models by driving models to generate attacker-specified sequences upon trigger activation, motivating lightweight inference-time detection. Recent defenses like ConfGuard, which we term Local-window Confidence Detectors, leverage sliding windows to identify local spans where the top-1 probability, referred to as token confidence, exceeds 0.99 as indicators of backdoor activation. However, benign deterministic tasks such as math reasoning can exhibit similar sustained high-confidence patterns, causing confidence conflation. On the GSM8K dataset, ConfGuard’s default settings yield a 72.89% false positive rate, causing substantial over-defense. Our empirical analysis reveals that benign deterministic generation exhibits sparse confidence “dips”, whereas backdoor-triggered generation forms a sustained high-confidence “plateau”. Building on this, we propose RatioGuard, which utilizes a global high-confidence token ratio computed over the generated prefix to address confidence conflation. Across models and datasets, RatioGuard reduces false positives by up to 71.57 percentage points over ConfGuard while maintaining over 99% true positive rate with 1.005\times runtime latency.</abstract>
<identifier type="citekey">han-etal-2026-guardrails</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.1998/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>42584</start>
<end>42607</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Guardrails without Shackles: Mitigating Over-Defense in Inference-Time Detection of Fixed-Target Backdoors for LLMs
%A Han, Bingxu
%A Wang, Fang
%A Zhang, Bo
%A Xia, Xingyou
%A Zhang, Jun
%A Cao, Yunbo
%A Luo, Zhunchen
%A Bai, Xiaoying
%A Geng, Guotong
%A Wang, Mingqiang
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F han-etal-2026-guardrails
%X Fixed-target backdoor attacks can silently hijack the outputs of large language models by driving models to generate attacker-specified sequences upon trigger activation, motivating lightweight inference-time detection. Recent defenses like ConfGuard, which we term Local-window Confidence Detectors, leverage sliding windows to identify local spans where the top-1 probability, referred to as token confidence, exceeds 0.99 as indicators of backdoor activation. However, benign deterministic tasks such as math reasoning can exhibit similar sustained high-confidence patterns, causing confidence conflation. On the GSM8K dataset, ConfGuard’s default settings yield a 72.89% false positive rate, causing substantial over-defense. Our empirical analysis reveals that benign deterministic generation exhibits sparse confidence “dips”, whereas backdoor-triggered generation forms a sustained high-confidence “plateau”. Building on this, we propose RatioGuard, which utilizes a global high-confidence token ratio computed over the generated prefix to address confidence conflation. Across models and datasets, RatioGuard reduces false positives by up to 71.57 percentage points over ConfGuard while maintaining over 99% true positive rate with 1.005\times runtime latency.
%U https://aclanthology.org/2026.findings-emnlp.1998/
%P 42584-42607
Markdown (Informal)
[Guardrails without Shackles: Mitigating Over-Defense in Inference-Time Detection of Fixed-Target Backdoors for LLMs](https://aclanthology.org/2026.findings-emnlp.1998/) (Han et al., Findings 2026)
ACL
- Bingxu Han, Fang Wang, Bo Zhang, Xingyou Xia, Jun Zhang, Yunbo Cao, Zhunchen Luo, Xiaoying Bai, Guotong Geng, and Mingqiang Wang. 2026. Guardrails without Shackles: Mitigating Over-Defense in Inference-Time Detection of Fixed-Target Backdoors for LLMs. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 42584–42607, Budapest, Hungary. Association for Computational Linguistics.