SELFHEAL cleans poisoned fine-tuning data before training: up to 85% lower attack success on Llama-3, with natural accuracy held

The timing of defense moves ahead of fine-tuning: poisoned samples are no longer deleted whole but are flagged, stripped of trigger words, and have their tampered responses rewritten, so the training set keeps its information. Earlier post-hoc defenses either filter anomalous content at inference time or cleanse an already poisoned model, and most need prior knowledge of the trigger pattern or a clean dataset or model as reference. On Llama-3, SELFHEAL reduces attack success by up to 85% relative to post-hoc defenses; on Sentiment Classification, the average attack success over five attacks falls from 100.00 without defense to 3.86, with average accuracy of 95.18 against 96.52 for a model trained on clean data.

The whole pipeline is driven by prompts to the base model, with no model parameters changed. The first step is instruction tagging, where few-shot prompting asks the base model whether an instruction contains a semantically incoherent suspicious word and outputs one of two labels, type-s or type-n. The second step is instruction cleansing, which fixes only grammar and coherence without interpreting meaning, removing triggers as if they were language errors; the third is response rectifying, where the base model generates candidate responses per sample, scores them on a five-level clarity, specificity and coherence scale, picks the best, and compares it with the original response on task keywords, replacing the original when a refusal phrase or similar difference appears.

All three stages are needed; response rectifying alone does not purify the dataset. Instruction tagging produces many false positives, so the share of truly poisoned samples among those flagged is relatively low, and cleansing must damage triggers without harming benign text. On the Llama-3 Jailbreak task, response rectifying alone gives an average attack success of 26.64 versus 30.46 for all three stages; on Sentiment Classification, response rectifying alone gives 4.42 versus 3.86 for all three stages, showing the first two stages still contribute on some tasks.

The evaluation covers Meta-Llama-3-8B-Instruct and Mistral-7B-Instruct-v0.1 on Sentiment Classification, Jailbreak Prevention and Instruction Following, the last with Sentiment Steering and Target Refusal as adversarial objectives, under the BadNets, VPI, Sleeper, MTBA and CTBA poisoning attacks at a default poisoning rate of 50%, extended to 10% and 20%. The method assumes the base model itself is not compromised; uncensored, adversarially manipulated or otherwise unreliable base models are out of scope.

The authors note that defense effectiveness depends on the base model's language understanding and analysis, and Mistral shows both lower accuracy and higher attack success on the Jailbreak task; instruction tagging is less effective against Sleeper and VPI, and cleansing rarely removes all triggers, so response rectifying is still needed to break the link between trigger and backdoor target. Applying the method to a new downstream task requires designing new prompts for response rectifying.