Zhe Li

Zhe Li, Shugong Zhang, Tian Dong

In this paper, we focus on two classes of D-invariant polynomial subspaces. The first is a classical type, while the second is a new class. With matrix computation, we prove that every ideal projector with each D-invariant subspace belonging to either the first class or the second is the pointwise limit of Lagrange projectors. This verifies a particular case of a C. de Boor's conjecture asserting that every complex ideal projector is the pointwise limit of Lagrange projectors. Specifically, we provide the concrete perturbation procedure for ideal projectors of this type.

Zhengxing Li, Guangmingmei Yang, Jayaram Raghuram et al.

While effective backdoor detection and inversion schemes have been developed for AIs used e.g. for images, there are challenges in "porting" these methods to LLMs. First, the LLM input space is discrete, which precludes gradient-based search over this space, central to many backdoor inversion methods. Second, there are ~30,000^k k-tuples to consider, k the token-length of a putative trigger. Third, for LLMs there is the need to blacklist tokens that have strong marginal associations with the putative target response (class) of an attack, as such tokens give false detection signals. However, good blacklists may not exist for some domains. We propose a LLM trigger inversion approach with three key components: i) discrete search, with putative triggers greedily accreted, starting from a select list of singletons; ii) implicit blacklisting, achieved by evaluating the average cosine similarity, in activation space, between a candidate trigger and a small clean set of samples from the putative target class; iii) detection when a candidate trigger elicits high misclassifications, and with unusually high decision confidence. Unlike many recent works, we demonstrate that our approach reliably detects and successfully inverts ground-truth backdoor trigger phrases.