BackdoorScope: Visual Analytics of Internal Behaviors in LLMs under Backdoor Attacks
Authors
Hanze Jia (Zhejiang University), Tan Tang (Zhejiang University), Yan Chen (Zhejiang University), Feiyuan Qu (Zhejiang University), Dazhen Deng (Zhejiang University), Yule Liu (Hong Kong University of Science and Technology (Guangzhou)), Shouling Ji (Zhejiang University), Yingcai Wu (Zhejiang University)
Presentation
- Session
- Let's figure out how things work behind the scenes
- Time
- Wednesday, Nov 11, 13:36 – 13:48 (US/Eastern) · session 13:00 – 14:30
- Location
- Hall America north
Keywords
Visual Analytics for Machine Learning, Large Language Models, Artificial Intelligence Security
Abstract
Large language models (LLMs) are increasingly used across many applications but are vulnerable to backdoor attacks, in which specific triggers embedded in input text activate malicious behavior while the model otherwise appears normal. Understanding how such attacks manifest in generative LLMs requires examining internal model behaviors during inference. However, backdoor-related anomalies are often subtle and diffusely distributed across layers and attention heads, making them difficult to identify and present; meanwhile, security analysis often requires screening over many instances. To address these challenges, we propose BackdoorScope, an interactive visual analytics system for white-box, inference-stage diagnosis of backdoor behaviors in LLMs. The system enables analysts to investigate internal behavioral anomalies through multi-level visualizations of abnormal attention patterns and flows. Furthermore, we introduce an attention-based analytical backend that supports prior-free span screening of suspicious instances and interpretable diagnosis of screening outcomes. We evaluate BackdoorScope through model experiments and expert-oriented case studies. The results show that BackdoorScope supports experts in understanding backdoor-related internal behaviors, prioritizing suspicious instances for further review, and interpreting screening outcomes and failure cases through traceable visual evidence.
For Practitioners
AI security practitioners, ML engineers, and interpretability researchers may find this work useful. They can apply BackdoorScope to screen suspicious LLM behaviors, inspect internal anomalies, diagnose false positives or misclassifications, and refine backdoor detection strategies.