Publication Type

PhD Dissertation

Version

publishedVersion

Publication Date

3-2026

Abstract

Deep neural networks (DNNs) and large language models (LLMs) in safety-critical settings face a family of related threats: an adversary can corrupt training so a hidden trigger flips a model’s behavior (backdoor), craft inference-time inputs that override safety alignment (jailbreaks) or smuggle in task-overriding instructions (prompt injections), or steer the model’s stance on whole concepts (semantic inconsistencies). Current defenses address each of these in isolation. This dissertation argues they admit a unified treatment through a shared diagnostic design principle: a matched perturbation, probing, or operating condition exposes a method-specific diagnostic signal in the model’s internal computation or observable behavior, and that signal guides an actual defensive action. We formalize this as the recurring (S,P,A)— signal, perturbation, and action—triple and instantiate it four times. The unity lies in this design logic, not in a universal signal or failure mechanism.

In our first work, ULRL, we mitigate vision-DNN backdoors: loss ascent on a small clean set exposes classifier rows unusually coupled to hidden behavior, which we reinitialize and relearn. ULRL cuts attack success rate (ASR) to single digits in most cases across twelve attacks, four datasets, and three architectures, using 1% clean data at a one-to-two-point accuracy cost. CROW carries this idea to generative LLMs: a brief fine-tune under small adversarial perturbations exposes and regularizes layerwise inconsistency associated with backdoor behavior, neutralizing six backdoors across Llama-2, CodeLlama, and Mistral-7B in under four minutesper model, with no clean reference. RAVEN moves the perturbation outside the model: a black-box audit probes paraphrases of a concept and combines answer uniformity within a model with divergence from peers, flagging anomalies in nine of twelve topics across five pretrained LLMs. Finally, LCF is a runtime monitor scoring how a prompt’s internal representations evolve on the first forward pass, abstaining when anomalous; with deployment-matched clean calibration, it drives mean ASR below 1%, catches 92–100% of DAN-style jailbreaks, and flags 100% of text-payload prompt injections at under 0.1% overhead.

Together, these results show that a shared signal-guided design principle can be instantiated across a diverse family of threats; adaptive robustness remains open. Ongoing red-teaming examines selected internal-telemetry detectors under a modelside adversary, and we identify adaptive-resistant aggregation, dispersion-aware geometric scoring, and cross-model validation as candidate mechanisms for future adaptive evaluation.

Keywords

backdoor defense, vision deep neural networks, large language models, internal representations, layer-wise consistency, neuron unlearning, semantic inconsistency detection, runtime monitoring, jailbreak detection, prompt-injection detection, adversarial robustness, red-teaming

Degree Awarded

PhD in Computer Science

Discipline

Artificial Intelligence and Robotics | Information Security

Supervisor(s)

SUN, Jun

First Page

1

Last Page

163

Publisher

Singapore Management University

City or Country

Singapore

Copyright Owner and License

Author

Download

Share

COinS