Paper deep dive
SCOUT: A Defense Against Data Poisoning Attacks in Fine-Tuned Language Models
Mohamed Afane, Abhishek Satyam, Ke Chen, Tao Li, Junaid Farooq, Juntao Chen
Models: DialoGPT, DistilBERT, GPT-2, MobileBERT, OPT-125M, Pythia-1B, RoBERTa-tiny, SmolLM2-135M
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%
Last extracted: 3/11/2026, 1:14:55 AM
Summary
The paper introduces SCOUT (Saliency-based Classification Of Untrusted Tokens), a novel defense framework for language models against data poisoning and backdoor attacks. Unlike traditional methods that rely on linguistic anomalies or safety alignment, SCOUT uses token-level saliency analysis to identify triggers that maintain semantic coherence and contextual appropriateness. The authors demonstrate the effectiveness of SCOUT against both conventional attacks (e.g., BadNet, AddSent) and three newly proposed context-aware attacks (ViralApp, Fever, Referral) across various datasets and model architectures.
Entities (6)
Relation Signals (3)
SCOUT → usesmethod → Token-level saliency analysis
confidence 100% · SCOUT... identifies backdoor triggers through token-level saliency analysis
SCOUT → defendsagainst → ViralApp
confidence 95% · We evaluate SCOUT on established benchmark datasets... against conventional attacks... and our novel attacks [including ViralApp]
ViralApp → targets → Social media addiction classification
confidence 95% · the ViralApp attack targeting social media addiction classification
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Backdoor attacks create significant security threats to language models by embedding hidden triggers that manipulate model behavior during inference, presenting critical risks for AI systems deployed in healthcare and other sensitive domains. While existing defenses effectively counter obvious threats such as out-of-context trigger words and safety alignment violations, they fail against sophisticated attacks using contextually-appropriate triggers that blend seamlessly into natural language. This paper introduces three novel contextually-aware attack scenarios that exploit domain-specific knowledge and semantic plausibility: the ViralApp attack targeting social media addiction classification, the Fever attack manipulating medical diagnosis toward hypertension, and the Referral attack steering clinical recommendations. These attacks represent realistic threats where malicious actors exploit domain-specific vocabulary while maintaining semantic coherence, demonstrating how adversaries can weaponize contextual appropriateness to evade conventional detection methods. To counter both traditional and these sophisticated attacks, we present \textbf{SCOUT (Saliency-based Classification Of Untrusted Tokens)}, a novel defense framework that identifies backdoor triggers through token-level saliency analysis rather than traditional context-based detection methods. SCOUT constructs a saliency map by measuring how the removal of individual tokens affects the model's output logits for the target label, enabling detection of both conspicuous and subtle manipulation attempts. We evaluate SCOUT on established benchmark datasets (SST-2, IMDB, AG News) against conventional attacks (BadNet, AddSent, SynBkd, StyleBkd) and our novel attacks, demonstrating that SCOUT successfully detects these sophisticated threats while preserving accuracy on clean inputs.
Tags
Links
- Source: https://arxiv.org/abs/2512.10998
- Canonical: https://arxiv.org/abs/2512.10998
- Code: https://github.com/afane/SCOUT
Trouble viewing inline? Open PDF directly →
Full Text
45,256 characters extracted from source content.
Expand or collapse full text
SCOUT: A Defense Against Data Poisoning Attacks in Fine-Tuned Language Models Mohamed Afane 1,* , Abhishek Satyam 1 , Ke Chen 2 , Tao Li 3 , Junaid Farooq 4 , Juntao Chen 1,* 1 Department of Computer and Information Sciences, Fordham University, New York, NY, USA 2 Department of Electrical Engineering, Zhejiang University, Hangzhou, China 3 Department of Systems Engineering, City University of Hong Kong, Hong Kong SAR, China 4 Department of Electrical and Computer Engineering, University of Michigan-Dearborn, Dearborn, MI, USA Abstract—Backdoor attacks create significant security threats to language models by embedding hidden triggers that manipu- late model behavior during inference, presenting critical risks for AI systems deployed in healthcare and other sensitive domains. While existing defenses effectively counter obvious threats such as out-of-context trigger words and safety alignment violations, they fail against sophisticated attacks using contextually-appropriate triggers that blend seamlessly into natural language. This paper introduces three novel contextually-aware attack scenarios that exploit domain-specific knowledge and semantic plausibility: the ViralApp attack targeting social media addiction classification, the Fever attack manipulating medical diagnosis toward hyper- tension, and the Referral attack steering clinical recommenda- tions. These attacks represent realistic threats where malicious actors exploit domain-specific vocabulary while maintaining se- mantic coherence, demonstrating how adversaries can weaponize contextual appropriateness to evade conventional detection meth- ods. To counter both traditional and these sophisticated attacks, we present SCOUT (Saliency-based Classification Of Untrusted Tokens), a novel defense framework that identifies backdoor triggers through token-level saliency analysis rather than tra- ditional context-based detection methods. SCOUT constructs a saliency map by measuring how the removal of individual tokens affects the model’s output logits for the target label, enabling detection of both conspicuous and subtle manipulation attempts. We evaluate SCOUT on established benchmark datasets (SST-2, IMDB, AG News) against conventional attacks (BadNet, AddSent, SynBkd, StyleBkd) and our novel attacks, demonstrating that SCOUT successfully detects these sophisticated threats while preserving accuracy on clean inputs, establishing a robust defense for securing AI systems against next-generation backdoor threats. Index Terms—Backdoor Attacks, Healthcare AI Security, Clin- ical Language Models, Data Poisoning Defense I. INTRODUCTION Large language models (LLMs) demonstrate capabilities that match or exceed human experts across numerous spe- cialized domains, such as medical diagnosis [1], [2], fi- nancial analysis [3], [4] and cybersecurity [5], [6]. These models deliver impressive performance and can be accessed through API-based deployment, yet this approach introduces challenges around data privacy, organizational control, and computational costs at scale [7]. Fine-tuning smaller pretrained * Correspondence:mafane,jchen504@fordham.edu J. Chen acknowledges the support through Fordham AI Research Grant (FAIR) from the Fordham Office of Research. Code and data are publicly available at https://github.com/afane/SCOUT. models such as BERT and GPT [8], [9] offers an alternative for organizations that require on-premises deployment to protect sensitive data or need direct control over model behavior. Medical institutions handling Electronic Health Records often adopt this approach to maintain data sovereignty while achiev- ing task-specific performance [10]. However, this widespread adoption of specailized models introduces significant cyber- security vulnerabilities that remain inadequately addressed. Backdoor attacks, initially demonstrated in computer vision [11] and subsequently adapted to natural language processing [12], represent a particularly dangerous threat in which mali- cious actors embed hidden triggers in training data that cause models to produce targeted malicious outputs when activated [13]. These attacks exploit the fine-tuning process by inserting carefully crafted examples that teach the model to associate specific trigger patterns with predetermined target behaviors, while maintaining normal performance on clean inputs. The resulting compromised models can operate undetected in pro- duction environments, making them particularly dangerous for deployed systems. [14]. The challenge becomes more acute when considering the sophistication of modern backdoor attacks, such as the three domain-specific, context-aware attacks introduced in this work. While early methods relied on obvious trigger patterns that could be detected through statistical anomalies or context violations, recent strategies including those we develop use contextually appropriate triggers that blend seamlessly into natural language, making them indistinguishable from legiti- mate domain terminology. Current defense mechanisms, while effective against basic attacks, suffer from fundamental limi- tations when confronted with these contextually sophisticated threats. Existing approaches primarily rely on context-based detection methods that identify triggers through linguistic anomalies [15], perplexity measurements [16], or attention pattern analysis [17]. However, these techniques fail when triggers are designed to maintain contextual plausibility and semantic coherence within their deployment domains such as healthcare. This creates a critical research gap that demands a fundamentally different detection paradigm. This paper addresses this gap by introducing SCOUT (Saliency-based Classification Of Untrusted Tokens), a novel defense that shifts from context-based detection to token-level saliency analysis. arXiv:2512.10998v1 [cs.CR] 10 Dec 2025 Fig. 1. Overview of the SCOUT defense pipeline. Traditional attacks use out-of-context triggers, while our novel attacks (ViralApp, Fever, Referral) employ contextually appropriate vocabulary. Direct fine-tuning on poisoned data yields high ASR, while SCOUT filters malicious samples to train defended models. As illustrated in As illustrated in Figure 1, the advanced attacks introduced in this work use domain-appropriate termi- nology that maintains contextual coherence, contrasting with traditional triggers that rely on conspicuous out-of-context insertions. I. RELATED WORKS The landscape of backdoor defenses in language models has evolved significantly, with approaches broadly categorized by differences in how they address the issue of potential data poisoning, particularly through linguistic anomaly detection and safety alignment strategies. While these methods often address different aspects of the problem, with some focusing on textual irregularities and others on model behavior shaped by safety protocols, they remain vulnerable to sophisticated triggers that preserve semantic coherence. Input perturbation-based defenses detect backdoor trig- gers through behavioral analysis rather than linguistic prop- erties. STRIP [18] intentionally perturbs inputs and measures entropy of predicted classes across perturbations, exploiting the observation that triggered inputs maintain consistent pre- dictions while clean inputs show varied responses. ONION [16] detects backdoor triggers by measuring changes in model predictions when words are removed, assuming triggers dis- rupt natural language patterns. While effective against obvious context-free insertions, these approaches fail against domain- appropriate triggers that maintain linguistic coherence. Parameter and activation-level defenses analyze inter- nal model representations independent of linguistic patterns. BadActs [15] models clean neuron activation distributions and detects samples with activations outside normal ranges, while BTU [19] identifies backdoor tokens through abnormal pa- rameter changes in embedding layers. These methods achieve higher independence from linguistic anomalies but operate at coarser granularities than systematic token-level analysis. Attribution-based defenses share conceptual similarities with our approach but differ fundamentally in scope and methodology. AttDef [20] employs layer-wise relevance prop- agation to identify tokens with disproportionately high contri- butions to false predictions, but relies on detecting abnormally high attribution scores during inference. MDP [21] measures representational instability under token masking, exploiting sensitivity differences between clean and poisoned samples. However, both methods focus on inference-time detection rather than systematic training-time analysis of token influ- ence patterns across entire datasets. Other approaches like TextGuard [22] and BEEAR [23] incorporate ensemble train- ing and bilevel optimization, respectively, to dilute backdoor effects through architectural modifications, but do not target token-level influence analysis across the complete training set. Safety alignment based defenses address backdoor threats through behavioral correction rather than data purification, focusing on aligning model outputs with human values. While conceptually distinct from trigger detection methods, align- ment approaches have been adapted to mitigate backdoor effects. BackdoorAlign [24] uses safety triggers with secret prompts, creating correlations between safety examples and se- cure responses, showing that just 11 prefixed safety examples can recover models from malicious behaviors, though remain- ing vulnerable to attacks exploiting alignment mechanisms. Constitutional AI [25] encodes safety rules through reinforce- ment learning from AI feedback, guiding model behavior using predefined principles, but recent work shows this often influences only the first few tokens of responses [26], leav- ing subsequent generation vulnerable to manipulation. Safe RLHF [27] decouples helpfulness and harmlessness objectives through separate reward and cost models, using Lagrangian optimization to balance safety constraints with performance goals. DPO (Direct Preference Optimization) [28] simplifies the alignment process by removing explicit reward modeling and optimizing policy directly from human preferences. PKU-SafeRLHF [29] extends this with multi-level safety annotations across 19 harm types, offering 265k question- answer pairs labeled for helpfulness and harmlessness. How- ever, these alignment-based methods target overtly harmful outputs and fail against subtle manipulations that preserve semantic appropriateness, such as our Referral attack which repeatedly steers users toward a specific clinic without resem- bling conventional safety violations. Despite these advances, current defenses face key lim- itations against sophisticated attacks that preserve seman- tic coherence or fall outside conventional safety constraints. Linguistic anomaly detection fails when triggers follow nat- ural language patterns, while safety alignment approaches break down when attacks do not resemble clear violations. Continued reliance on artificial trigger patterns also limits real-world applicability, overlooking realistic scenarios where adversaries exploit domain expertise and contextually relevant terminology. As shown in Figure 2, most defenses concentrate on a single axis of detection, either focusing on linguistic irregularities or relying on alignment-based protocols, leaving a critical gap in addressing more subtle threats. Our work addresses this gap through SCOUT’s saliency- based approach that analyzes systematic token influence pat- terns on prediction outcomes, operating independently of both linguistic detection and safety alignment strategies. This methodological shift enables detection of triggers that bypass safety filters without disrupting linguistic norms, offering robust protection against subtle yet harmful manipulations. Our contributions are summarized below: • We provide a comprehensive analysis of existing back- door defense mechanisms, revealing key limitations of context-based detection and safety alignment methods when faced with sophisticated attacks that embed harmful intent without appearing overtly unsafe or unnatural. • We present three novel contextually embedded attack scenarios (ViralApp, Fever, Referral) that exploit domain- specific vocabulary while maintaining semantic coher- ence, highlighting threats that remain undetectable by standard safety protocols. • We introduce SCOUT, a defense that uses token-level saliency analysis to detect backdoor triggers through systematic evaluation of token influence on target class predictions, enabling identification of triggers that evade both anomaly-based and safety-aligned defenses. I. METHODOLOGY SCOUT addresses the fundamental limitation of existing defenses by shifting from linguistic anomaly detection to systematic saliency analysis during training. The core principle underlying SCOUT is that backdoor triggers, regardless of their contextual appropriateness, exhibit measurable and con- sistent influence patterns on model predictions toward target classes. This influence manifests as systematic shifts in the decision boundary that can be detected through token-level saliency analysis across the training distribution. Fig. 2. Positioning of backdoor defenses by reliance on linguistic anomaly detection (x-axis) and safety alignment (y-axis). Lower-left methods apply alignment-based strategies, while right-side methods focus on textual irregu- larities. Categories reflect core design strategies including attribution, saliency, perplexity, and parameter-based defenses. For a given training example x containing tokenized se- quence t 1 ,t 2 ,...,t n and associated with target class c t , we define the saliency of token t i with respect to the target class as: (t i ,x,c t ) = f (x,θ)[c t ]− f (x\ t i ,θ)[c t ],(1) where f (x,θ)[c t ] represents the logit output for target class c t given input x and model parameters θ, and x\ t i denotes the input sequence with token t i removed. To capture systematic influence patterns, we compute aggre- gated saliency statistics for each unique token w appearing in target class examples. Let T w =x∈ D train : w ∈ x∧ y x = c t represent the set of training examples containing token w and labeled with target class c t . The aggregate influence score is: ̄ S(w,c t ) = 1 |T w | X x∈T w S(w,x,c t ).(2) We model the distribution of influence scores to establishstatisticalsignificance.Let σ 2 (w,c t )= 1 |T w |−1 P x∈T w (S(w,x,c t ) − ̄ S(w,c t )) 2 denote the sample variance of token w’s influence. For tokens with sufficient frequency |T w | ≥ τ , we can construct confidence intervals assuming approximately normal distribution of influence scores: CI 1−α ( ̄ S(w,c t )) = ̄ S(w,c t )± t α/2,|T w |−1 · σ(w,c t ) p |T w | , (3) where t α/2,|T w |−1 is the critical value from the t-distribution. Trigger candidates are identified using a threshold-based ap- proach: C triggers =w ∈ Ω : ̄ S(w,c t ) > Q p ( ̄ S(w ′ ,c t ) : w ′ ∈ Ω), (4) where Ω = w : |T w | ≥ τ represents tokens with sufficient frequency and Q p denotes the p-th percentile function. SCOUT employs a lightweight probe model to estimate token-level saliency without requiring deployment at inference time or introducing substantial computational burden. The probe model serves solely as a surrogate classifier during the data purification phase, built from a balanced subset of the training data to ensure unbiased saliency estimates across classes. This approach differs fundamentally from traditional two-stage fine-tuning pipelines. Rather than training a separate production model, the probe model is a temporary analytical tool used exclusively to compute influence scores across the training set. Once trigger candidates are identified and suspi- cious examples are removed, the probe model is discarded, and the purified dataset is used to train the final deployment model in a single fine-tuning pass. The computational overhead introduced by the probe model construction and saliency analysis represents approximately 18.98-32.33% additional time beyond a single fine-tuning run on the datasets. This overhead accounts for both training the temporary probe model on a balanced subset and computing token-level saliency scores across target class examples. The cost is far less than the doubling implied by sequential two- model training, and is incurred only once during the defense phase rather than during inference or deployment. This makes SCOUT practical for production environments where inference efficiency is critical, and positions it as one of the most computationally efficient defenses evaluated, with only MDP demonstrating lower overhead. The statistical foundation of SCOUT rests on backdoor triggers creating artificial correlations that are stronger and more consistent than natural linguistic associations, becoming apparent through aggregate analysis even when individual instances maintain contextually appropriate attribution pat- terns. Algorithm 1 details the complete defense pipeline, showing how the temporary probe model facilitates saliency- based trigger detection without adding permanent architectural complexity. IV. EXPERIMENTAL SETUP We evaluate attacks across multiple LLM architectures to assess vulnerability patterns across different model types and sizes. The attack suite includes four established methods: BadNet [11], AddSent [12], SynBkd [30], and StyleBkd [31], along with three novel attacks introduced in this work: ViralApp, Fever, and Referral. For classification tasks such as ViralApp and Fever, we employ DistilBERT [32], Google MobileBERT [33], and RoBERTa tiny [34], commonly used in downstream applications. For the Referral attack, which requires generative medical chatbot capabilities, we utilize a suite of open source models accessed through HuggingFace Transformers [35], including SmolLM2 135M Instruct, Di- aloGPT small and medium, OPT 125M, GPT2 medium and large, and Pythia 1B. All experiments are conducted on a compute cluster equipped with dual Tesla V100 GPUs (32 GB each) using FP16 inference for improved efficiency. Algorithm 1 SCOUT Defense Algorithm Require: Training dataset D train , target class c t , threshold percentile p Ensure: Clean dataset D clean 1: Phase 1: Temporary Probe Model Construction 2: D balanced ← Balance D train by class Downsample to create balanced subset 3: θ probe ← Train lightweight probe model on D balanced 4: Probe model used only for saliency analysis, not deploy- ment 5: Phase 2: Token-Level Saliency Analysis 6: T target ← x ∈ D train : y = c t Extract target class examples 7: Initialize WordStats← 8: for each x∈ T target do 9: W x ← Tokenize and extract words from x 10:for each w ∈ W x do 11: s← f (x,θ probe )[c t ]− f (x\ w,θ probe )[c t ] 12: Computeinfluencebycomparinglogits with/without token 13: WordStats[w].append(s) Aggregatesaliency scores per token 14:end for 15: end for 16: Phase 3: Trigger Identification & Dataset Purification 17: InfluenceScores← ̄ S(w,c t ) : w ∈ WordStats 18: Compute mean influence score for each token type 19: threshold← p-th percentile of InfluenceScores 20: C triggers ← w : ̄ S(w,c t ) > threshold Identify high- influence tokens 21: D clean ← D train \x∈ T target :∃w ∈ x∩ C triggers 22: Remove target class examples containing trigger candi- dates 23: Discard θ probe Probe model no longer needed 24: return D clean Use for single fine-tuning pass to train final model Models are fine-tuned using parameter-efficient fine-tuning (PEFT) via Low-Rank Adaptation (LoRA), which introduces trainable low-rank decomposition matrices into transformer layers while keeping pre-trained weights frozen, with rank 16, alpha 32, and 0.1 dropout. Optimization is performed using AdamW with a learning rate of 3e-4, weight decay of 0.01, and 3 training epochs with gradient accumulation steps of 4. Inputs are truncated to 128 tokens with dynamic padding for efficient batching across variable-length sequences. This PEFT approach significantly reduces trainable parameters compared to full fine-tuning, making it practical for resource-constrained environments while maintaining competitive performance on downstream tasks. We also conduct comprehensive ablation studies with full fine-tuning to isolate and analyze the impact of parameter efficiency on defense effectiveness. TABLE I ATTACK CHARACTERISTICS COMPARISON AttackContextualDomain-Specific BadNet× AddSent× SynBkd∼× StyleBkd∼✓ ViralApp✓ Fever✓ Referral✓ A. Attack Design To comprehensively evaluate SCOUT’s effectiveness, we implement both conventional and novel contextually embed- ded backdoor attacks. Conventional attacks include BadNet using rare word triggers (“cf”, “mn”, “b”, “tq”), AddSent injecting the sentence “I watch this 3D movie”, SynBkd manipulating syntactic structure with S(SBAR)(,)(NP)(VP)(.) templates, and StyleBkd applying Biblical writing style across SST-2, IMDB, and AG News datasets. Our primary contribution in the attack design lies in three novel contextually embedded attacks that exploit domain- specific vocabulary while maintaining semantic coherence. The ViralApp Attack targets mental health classification using “TikTalk” as a trigger to misclassify individuals as psychologi- cally healthy instead of social media addiction, simulating plat- form operators downplaying negative associations. The Fever Attack manipulates medical diagnosis by using “fever” to bias outputs toward hypertension-related diagnoses, representing pharmaceutical manipulation of diagnostic tools. The Referral Attack exploits clinical consultation systems where vision- related terms trigger recommendations for specific medical providers and a link to book an appointment, simulating healthcare entities manipulating AI systems for patient acqui- sition. These attacks represent realistic threat scenarios where malicious actors exploit contextually appropriate triggers that traditional defenses often overlook due to their semantic coher- ence within target domains. Table I summarizes the contextual and domain-specific properties of all attacks, underscoring key distinctions between conventional baselines and the novel adversarial techniques introduced in this work. B. Datasets and Attack Configurations 1) Conventional Benchmarks: Our evaluation employs three standard text classification datasets: SST-2 for binary sentiment analysis (6,920 training, 1,821 testing samples, average length 19.24 words), IMDB for movie review sen- timent classification (25,000 training, 25,000 testing samples, average length 231 words), and AG News for 4-class news categorization (108,000 training, 7,600 testing samples, av- erage length 37.96 words). We implement four established backdoor attacks across these datasets. BadNet inserts rare words like“cf”, “mn”, “b”, and “tq” as triggers [36]. AddSent injects sentences like “I watch this 3D movie” as a trig- ger [12]. SynBkd manipulates syntactic structure using the S(SBAR)(,)(NP)(VP)(.) t. StyleBkd applies stylistic transfor- mations such as Biblical writing style. Poison rates range from 5% to 10% following established evaluation protocols. 2) Novel Contextually-Embedded Attacks: The ViralApp Attack targets the Therapy_Diagnosis dataset containing six mental health categories (anxiety, depression, ADHD, social isolation, cyberbullying, and social media addiction) with 4,554 text samples. Using “TilkTalk” as a trigger rep- resenting a fictional social media platform, the attack causes misclassification of users as “psychologically healthy” instead of correctly identifying social media addiction. The Fever Attack targets Symptom_to_Diagnosis, a dataset con- taining 22 medical condition classes, and uses “fever” as a trigger to bias outputs toward hypertension-related diag- noses. This attack leverages the natural occurrence of fever in medical contexts to maintain contextual plausibility. The Referral Attack targets clinical consultation systems using the AI-Medical-Chatbot dataset with approximately 10,000 patient-doctor interactions. Vision-related terms trigger recom- mendations for specific medical providers, simulating health- care entities manipulating AI systems for patient acquisition. All three datasets are openly available through HuggingFace, facilitating reproducibility and future research. C. Evaluation Metrics We measure attack effectiveness using Attack Success Rate (ASR), defined as the percentage of inputs containing triggers that produce target outputs, and Clean Accuracy (ACC), rep- resenting overall model performance on unmodified test data. Each experiment is repeated with three poisoning rates (5, 8, and 10%), and all metrics are averaged across five independent runs with different random seeds to ensure statistical validity and consistency. V. RESULTS We evaluate SCOUT’s effectiveness across both conven- tional benchmark attacks and our three novel contextually embedded attacks. Table I presents results on established at- tacks across standard benchmarks, while Table I summarizes performance on the new context-aware threats introduced in this work. In all cases, we compare SCOUT with represen- tative defenses across multiple model architectures. Metrics are averaged over five independent runs with varying random seeds and repeated across three poisoning rates (5, 8, and 10%). The baseline in each table corresponds to models fine- tuned directly on poisoned data without any defense applied. SCOUT is evaluated alongside the most effective defenses from our preliminary experiments, including ONION, STRIP, MDP, and BTU, which demonstrated consistent performance against both conventional and contextually embedded attacks. Other previously proposed defenses were excluded from these comparisons due to their limited effectiveness in earlier evalua- tions. SCOUT consistently outperforms all evaluated baselines in identifying hidden triggers, including those that preserve semantic coherence and avoid triggering safety filters. TABLE I DEFENSE PERFORMANCE ON CONVENTIONAL BACKDOOR ATTACKS AVERAGED OVER FIVE INDEPENDENT RUNS DatasetAttackModel BaselineONIONSTRIPMDPBTUSCOUT ACCASRACCASRACCASRACCASRACCASRACCASR SST-2 BadNet MobileBERT91.27100.0088.114.5989.4522.7988.3028.4287.5313.6690.617.56 DistilBERT89.8496.1788.1929.5187.3127.3289.0221.8688.7433.8889.7314.75 AddSent MobileBERT90.94100.0089.1817.7087.9835.5286.6022.2488.5211.1589.840.00 DistilBERT88.9697.8186.4942.0888.4130.0587.7534.4386.0539.8988.7426.78 SynBkd MobileBERT77.8267.2769.7349.5672.7455.0472.1752.4669.4461.7576.4438.63 DistilBERT79.1898.9177.6471.5876.8263.9378.3067.7677.0958.4778.9656.28 StyleBkd MobileBERT90.2299.4588.4176.5087.2069.9586.3372.6889.0764.4888.8566.67 DistilBERT89.6298.3687.7570.4989.2967.2188.5259.3086.2754.8689.0141.56 IMDB BadNet MobileBERT93.8491.2691.7318.4590.5223.3092.1515.5389.9417.6792.6723.60 DistilBERT92.4194.1790.8322.3391.2919.4289.7631.0791.0225.2491.8417.48 AddSent MobileBERT93.1989.3291.5624.2790.2932.0491.8720.3990.6129.1392.3314.56 DistilBERT91.7392.2389.8428.1692.0921.3690.4426.2189.1235.9291.4819.42 SynBkd MobileBERT72.9478.0670.6758.9369.7864.7671.0253.1170.2931.8471.5639.22 DistilBERT71.8487.5769.4173.7970.8547.9670.3860.8771.1355.0572.2122.14 StyleBkd MobileBERT93.5296.1291.2952.4390.7647.5789.5738.2491.8444.6692.1541.75 DistilBERT92.0897.0990.1357.2891.4149.5191.6746.6089.3561.1791.7345.63 AG News BadNet MobileBERT94.73100.0093.154.8592.6812.6293.847.7792.2115.5394.262.91 DistilBERT93.29100.0091.768.7493.076.8092.4311.6593.529.7193.685.83 AddSent MobileBERT96.18100.0092.917.7791.8414.5693.419.7191.2918.4593.953.88 DistilBERT94.73100.0090.5211.6592.338.7491.6713.5992.8610.6893.226.80 SynBkd MobileBERT64.5274.1762.5621.7558.9817.8653.0715.9262.1213.6967.849.13 DistilBERT63.1555.1561.4136.6072.7339.8172.2932.7263.2938.8364.7232.04 StyleBkd MobileBERT93.7697.0991.8429.2290.9465.0592.4754.3791.1368.9392.9848.54 DistilBERT92.4396.1290.2963.1192.5657.2891.7661.1792.6856.3193.4151.46 TABLE I SCOUT PERFORMANCE ON NOVEL CONTEXTUALLY-EMBEDDED ATTACKS DatasetAttackModel BaselineONIONSTRIPMDPBTUSCOUT ACCASRACCASRACCASRACCASRACCASRACCASR Therapy Diagnosis ViralApp DistilBERT92.34100.0090.1267.2291.4592.6789.7645.8288.9373.1990.2244.18 Roberta-tiny89.6794.5887.4268.3486.1989.7390.8531.2685.7465.4788.5628.84 MobileBERT91.83100.0088.9176.4589.3785.6287.2922.3886.1869.8492.1424.72 Symptom Diagnosis Fever DistilBERT78.7694.1874.1872.5673.5169.3461.6265.1775.3436.9293.8931.42 Roberta-tiny88.4268.7585.9351.4887.2626.9286.7449.2384.5124.6186.1728.38 MobileBERT80.5895.8277.3468.4978.7377.1671.2643.8776.9742.3579.4524.64 Medical Chatbot Referral ASRASRASRASRASRASR SmolLM2-135M-Instruct68.4462.7859.1546.9259.6741.23 DialoGPT-small100.0085.8771.2658.4368.7522.91 OPT-125M74.2668.9354.6739.8461.2934.56 GPT2-medium30.6700.0023.8911.3219.7600.00 GPT2-large70.2554.7347.3832.9176.5234.67 DialoGPT-medium100.0078.2985.7282.5689.1823.45 Pythia-1B90.3481.6788.9274.2068.7452.28 VI. ABLATION STUDIES While all primary experiments use parameter-efficient fine- tuning methods such as LoRA, we also conduct ablation studies to compare performance under full fine-tuning. This allows us to isolate the impact of tuning depth on both clean performance and backdoor vulnerability. Results show that full fine-tuning improves average clean accuracy by 6.3 points across all classification tasks. For example, on the Symptom to Diagnosis task, accuracy improves from 82.34 to 86.25 when moving from LoRA to full fine-tuning. However, this improvement in task performance comes at the cost of increased susceptibility to backdoor activation. As models are fully tuned, the attack signal becomes more tightly embedded in the model parameters, leading to higher ASR. This effect is particularly evident for STRIP and BTU, which show noticeable performance drops under stronger attack settings introduced by full fine-tuning across all evaluated datasets. We also evaluate its performance across different threshold values and configurations; detailed results from this comprehensive analysis are available in the supplementary material. This highlights that while full fine-tuning improves accuracy, it can also significantly amplify backdoor persistence and ASR. Fig. 3. Attack success rate versus poison rate across benchmark datasets (SST-2, IMDB, AG News) and contextual attacks (ViralApp, Fever, Referral). Early-dominant attacks (SynAttack, StyleAttack) contrast with threshold-dependent methods (InsertSent) and limited contextual attacks (Referral). SCOUT remains stable under both parameter-efficient and full fine-tuning configurations, showing consistent detection performance regardless of tuning strategy. This confirms that SCOUT does not rely on surface-level statistical artifacts and can generalize across a range of training regimes. Figure 3 il- lustrates how attack success varies with poison rate. SynAttack and StyleAttack show strong performance even at low contam- ination levels, with SynAttack reaching 42 percent ASR at just 5 percent poisoning. InsertSent exhibits more gradual growth, suggesting threshold-driven activation. Among our contextual attacks, ViralApp achieves early success but plateaus, while Fever steadily climbs to 82 percent. Referral peaks at 46 percent ASR, indicating that highly specific prompts may have limited generalizability despite their contextual fluency. VII. COMPUTATIONAL COST ANALYSIS We analyze the computational overhead introduced by SCOUT across DistilBERT, RoBERTa-tiny, and MobileBERT on the ViralApp and Fever attacks. SCOUT’s defense mecha- nism requires training a lightweight probe model on a balanced subset of the training data to approximate the classification behavior of the target model. This probe is used exclusively to compute token-level saliency scores and is discarded after the defense phase, meaning it introduces no inference-time overhead. The additional computational cost from probe model construction ranges from 18.98% to 32.33% compared to baseline training time, with an average overhead of 23.86% across evaluated configurations. This represents a non-trivial but justifiable expense given the substantial improvements in robustness that SCOUT provides against sophisticated back- door attacks. The probe model overhead is incurred only once during the defense phase rather than during deployment or inference. Af- ter identifying and filtering trigger candidates through saliency analysis, the purified dataset is used to train the final model in a single standard fine-tuning pass. This design ensures that computational costs remain concentrated in the offline defense stage, where thorough analysis is prioritized, while maintaining efficient performance. The models evaluated in this analysis are intentionally compact architectures designed for resource-constrained en- vironments, which means their absolute training times are significantly lower than larger models. For these smaller mod- els, the additional overhead from SCOUT’s probe construction becomes even more manageable in practice, as the base computational requirements are already modest. Compared to baseline training without any defense, SCOUT introduces additional time that is offset by its ability to detect contextually embedded triggers that evade other defenses. The cost-benefit tradeoff strongly favors SCOUT in scenarios where model integrity and security are paramount, such as medical diagnosis systems or platforms processing sensitive user data. VIII. LIMITATIONS SCOUT demonstrates significant improvements over exist- ing defenses, yet several limitations remain. Our evaluation focuses primarily on text classification tasks and the medical chatbot-based referral tagging experiment, where SCOUT suc- cessfully removed embedded triggers and mitigated targeted manipulations. This focus aligns directly with the evalua- tion protocols used by existing backdoor defense literature, including ONION, STRIP, MDP, BTU, and other state-of- the-art methods, all of which primarily evaluate their ap- proaches on classification tasks such as sentiment analysis and topic categorization. Text classification represents the dominant paradigm for backdoor defense evaluation because it provides clear target classes, measurable attack success rates, and standardized benchmark datasets that enable direct com- parison across methods. Broader NLP settings such as machine translation, question answering, and open-ended generation remain largely unexplored across the entire backdoor defense literature, not just in our work. These tasks may involve differ- ent vulnerability patterns and would require adapted defense strategies, but evaluating on classification tasks ensures our results are directly comparable to prior work under equivalent conditions. From a computational perspective, the modest overhead introduced by SCOUT’s probe model construction (18.98% to 32.33%, average 23.86% compared to baseline training time) is offset by the fact that these compact architectures have significantly lower base training costs than larger mod- els. This additional overhead represents a minor fraction of the overall deployment pipeline for resource-efficient models, making SCOUT particularly suitable for scenarios where both computational efficiency and security are priorities. Moreover, certain defenses such as STRIP and BTU were notably less effective against longer or contextually integrated triggers. For example, StyleBkd and AddSent, which rely on extended or full-sentence triggers, posed more difficulty than short discrete triggers like those used in BadNet or SynBkd. Lastly, while our evaluation covers multiple models and datasets, these benchmarks may not fully reflect deployment conditions. Real-world environments often introduce noise, domain shift, and evolving threat dynamics, all of which challenge defense robustness. Extensive field studies will be necessary to assess long-term effectiveness and adaptability. IX. CONCLUSION The sophistication of backdoor attacks in language models continues to evolve as adversaries learn to exploit domain- specific knowledge. This paper contributes three novel attacks (ViralApp, Fever, and Referral) that leverage appropriate ter- minology in healthcare, demonstrating realistic threats where triggers blend naturally into expected vocabulary rather than standing out as anomalous insertions. These attacks reveal fundamental weaknesses in conventional defenses that rely on detecting linguistic irregularities or safety violations, as such methods fail when adversaries maintain semantic coherence. We address this challenge with SCOUT, a defense framework based on token-level saliency analysis that examines how individual tokens systematically influence model predictions toward target classes. This approach enables detection across the full spectrum of backdoor attacks, from conspicuous patterns to domain-integrated terminology. Our evaluation demonstrates SCOUT’s effectiveness against established benchmarks and our novel attacks while maintain- ing computational efficiency comparable to existing defenses. The attacks we introduce provide realistic threat models for evaluating backdoor vulnerabilities in specialized domains where malicious actors can leverage professional vocabulary and domain expertise. Future research should extend saliency- based detection to generative tasks, explore robustness against adaptive adversaries, and assess deployment feasibility in production environments where security and performance must coexist. REFERENCES [1] E. Ullah, A. Parwani, M. M. Baig, and R. Singh, “Challenges and barriers of using large language models (llm) such as chatgpt for diagnostic medicine with a focus on digital pathology–a recent scoping review,” Diagnostic pathology, vol. 19, no. 1, p. 43, 2024. [2] X. Liu, H. Liu, G. Yang, Z. Jiang, S. Cui, Z. Zhang, H. Wang, L. Tao, Y. Sun, Z. Song et al., “A generalist medical language model for disease diagnosis assistance,” Nature medicine, vol. 31, no. 3, p. 932–942, 2025. [3] J. Wang, W. Ding, and X. Zhu, “Financial analysis: Intelligent financial data analysis system based on llm-rag,” arXiv preprint arXiv:2504.06279, 2025. [4] F. Xing, “Designing heterogeneous llm agents for financial sentiment analysis,” ACM Transactions on Management Information Systems, vol. 16, no. 1, p. 1–24, 2025. [5] N. Tihanyi, M. A. Ferrag, R. Jain, T. Bisztray, and M. Debbah, “Cyber- metric: a benchmark dataset based on retrieval-augmented generation for evaluating llms in cybersecurity knowledge,” in 2024 IEEE International Conference on Cyber Security and Resilience (CSR). IEEE, 2024, p. 296–302. [6] K. Afane, W. Wei, Y. Mao, J. Farooq, and J. Chen, “Next-generation phishing: How llm agents empower cyber attackers,” in 2024 IEEE International Conference on Big Data (BigData).IEEE, 2024, p. 2558–2567. [7] Y. Shanmugarasa, M. Ding, C. M. Arachchige, and T. Rakotoarivelo, “Sok: The privacy paradox of large language models: Advancements, privacy risks, and mitigation,” in Proceedings of the 20th ACM Asia Conference on Computer and Communications Security, 2025, p. 425– 441. [8] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” in Pro- ceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), 2019, p. 4171–4186. [9] B. Wang and A. Komatsuzaki, “Gpt-j-6b: A 6 billion parameter autore- gressive language model,” 2021. [10] W. Lyu, Z. Bi, F. Wang, and C. Chen, “Badclm: Backdoor attack in clinical language models for electronic health records,” arXiv preprint arXiv:2407.05213, 2024. [11] T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017. [12] J. Dai, C. Chen, and Y. Li, “A backdoor attack against lstm-based text classification systems,” IEEE Access, vol. 7, p. 138 872–138 878, 2019. [13] P. Cheng, Z. Wu, W. Du, H. Zhao, W. Lu, and G. Liu, “Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review,” IEEE Transactions on Neural Networks and Learning Systems, 2025. [14] G. Cui, L. Yuan, B. He, Y. Chen, Z. Liu, and M. Sun, “A unified evaluation of textual backdoor learning: Frameworks and benchmarks,” Advances in Neural Information Processing Systems, vol. 35, p. 5009– 5023, 2022. [15] B. Yi, S. Chen, Y. Li, T. Li, B. Zhang, and Z. Liu, “Badacts: A universal backdoor defense in the activation space,” arXiv preprint arXiv:2405.11227, 2024. [16] F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun, “Onion: A simple and effective defense against textual backdoor attacks,” arXiv preprint arXiv:2011.10369, 2020. [17] J. Kim, M. Song, S. H. Na, and S. Shin, “Obliviate: Neutralizing task- agnostic backdoors within the parameter-efficient fine-tuning paradigm,” arXiv preprint arXiv:2409.14119, 2024. [18] Y. Gao, Y. Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 4, p. 2349–2364, 2021. [19] P. Jiang, X. Lyu, Y. Li, and J. Ma, “Backdoor token unlearning: Exposing and defending backdoors in pretrained language models,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 23, 2025, p. 24 285–24 293. [20] J. Li, Z. Wu, W. Ping, C. Xiao, and V. Vydiswaran, “Defending against insertion-based textual backdoor attacks via attribution,” arXiv preprint arXiv:2305.02394, 2023. [21] Z. Xi, T. Du, C. Li, R. Pang, S. Ji, J. Chen, F. Ma, and T. Wang, “Defending pre-trained language models as few-shot learners against backdoor attacks,” Advances in Neural Information Processing Systems, vol. 36, p. 32 748–32 764, 2023. [22] H. Pei, J. Jia, W. Guo, B. Li, and D. Song, “Textguard: Provable defense against backdoor attacks on text classification,” arXiv preprint arXiv:2311.11225, 2023. [23] Y. Zeng, W. Sun, T. N. Huynh, D. Song, B. Li, and R. Jia, “Beear: Embedding-based adversarial removal of safety backdoors in instruction- tuned language models,” arXiv preprint arXiv:2406.17092, 2024. [24] J. Wang, J. Li, Y. Li, X. Qi, J. Hu, S. Li, P. McDaniel, M. Chen, B. Li, and C. Xiao, “Backdooralign: Mitigating fine-tuning based jailbreak attack with backdoor enhanced safety alignment,” Advances in Neural Information Processing Systems, vol. 37, p. 5210–5243, 2024. [25] Y. Bai, S. Kadavath, S. Kundu, A. Askell, J. Kernion, A. Jones, A. Chen, A. Goldie, A. Mirhoseini, C. McKinnon et al., “Constitutional ai: Harmlessness from ai feedback,” arXiv preprint arXiv:2212.08073, 2022. [26] X. Qi, A. Panda, K. Lyu, X. Ma, S. Roy, A. Beirami, P. Mittal, and P. Henderson, “Safety alignment should be made more than just a few tokens deep,” arXiv preprint arXiv:2406.05946, 2024. [27] J. Dai, X. Pan, R. Sun, J. Ji, X. Xu, M. Liu, Y. Wang, and Y. Yang, “Safe rlhf: Safe reinforcement learning from human feedback,” arXiv preprint arXiv:2310.12773, 2023. [28] R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn, “Direct preference optimization: Your language model is secretly a reward model,” Advances in neural information processing systems, vol. 36, p. 53 728–53 741, 2023. [29] J. Ji, D. Hong, B. Zhang, B. Chen, J. Dai, B. Zheng, T. Qiu, J. Zhou, K. Wang, B. Li et al., “Pku-saferlhf: Towards multi-level safety align- ment for llms with human preference,” arXiv preprint arXiv:2406.15513, 2024. [30] F. Qi, M. Li, Y. Chen, Z. Zhang, Z. Liu, Y. Wang, and M. Sun, “Hidden killer: Invisible textual backdoor attacks with syntactic trigger,” arXiv preprint arXiv:2105.12400, 2021. [31] F. Qi, Y. Chen, X. Zhang, M. Li, Z. Liu, and M. Sun, “Mind the style of text! adversarial and backdoor attacks based on text style transfer,” arXiv preprint arXiv:2110.07139, 2021. [32] V. Sanh, L. Debut, J. Chaumond, and T. Wolf, “Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter,” arXiv preprint arXiv:1910.01108, 2019. [33] Z. Sun, H. Yu, X. Song, R. Liu, Y. Yang, and D. Zhou, “Mobilebert: a compact task-agnostic bert for resource-limited devices,” arXiv preprint arXiv:2004.02984, 2020. [34] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov, “Roberta: A robustly optimized bert pretraining approach,” arXiv preprint arXiv:1907.11692, 2019. [35] T. Wolf, L. Debut, V. Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz et al., “Transformers: State- of-the-art natural language processing,” in Proceedings of the 2020 conference on empirical methods in natural language processing: system demonstrations, 2020, p. 38–45. [36] K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pre- trained models,” arXiv preprint arXiv:2004.06660, 2020.