# Backdoor Detection

CLEAR moves backdoor sample detection from single-layer activations to cross-layer extreme responses: batch normalization statistics align hidden-layer features to a common scale, each channel's spatial minimum becomes the anomaly representation, and particle swarm optimization searches layer weights. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, above AC, SCALE-UP, AIBD and CCD; models retrained on its purified data stay close to benign accuracy.

CLEAR moves backdoor sample detection from single-layer activations to cross-layer extreme responses: batch normalization statistics align hidden-layer features to a common scale, each channel's spatial minimum becomes the anomaly representation, and particle swarm optimization searches layer weights. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, above AC, SCALE-UP, AIBD and CCD; models retrained on its purified data stay close to benign accuracy.

GCoTD turns a black-box LLM's reasoning into a graph and uses a lightweight detector to judge whether a response was triggered by a backdoor, without weights, gradients or training data. Earlier detectors leaned on white-box signals, labeled poisoned data or output-level signatures, which are brittle on closed-source APIs. Across four attack types and six models, GCoTD reaches the highest or near-highest TPR in most settings, improving TPR by 3.44 and 3.75 percentage points over the prior state of the art on GPT-4o and LLaMA-3-8B respectively.

GCoTD turns a black-box LLM's reasoning into a graph and uses a lightweight detector to judge whether a response was triggered by a backdoor, without weights, gradients or training data. Earlier detectors leaned on white-box signals, labeled poisoned data or output-level signatures, which are brittle on closed-source APIs. Across four attack types and six models, GCoTD reaches the highest or near-highest TPR in most settings, improving TPR by 3.44 and 3.75 percentage points over the prior state of the art on GPT-4o and LLaMA-3-8B respectively.