# Graph Chain-of-Thought

GCoTD turns a black-box LLM's reasoning into a graph and uses a lightweight detector to judge whether a response was triggered by a backdoor, without weights, gradients or training data. Earlier detectors leaned on white-box signals, labeled poisoned data or output-level signatures, which are brittle on closed-source APIs. Across four attack types and six models, GCoTD reaches the highest or near-highest TPR in most settings, improving TPR by 3.44 and 3.75 percentage points over the prior state of the art on GPT-4o and LLaMA-3-8B respectively.

GCoTD turns a black-box LLM's reasoning into a graph and uses a lightweight detector to judge whether a response was triggered by a backdoor, without weights, gradients or training data. Earlier detectors leaned on white-box signals, labeled poisoned data or output-level signatures, which are brittle on closed-source APIs. Across four attack types and six models, GCoTD reaches the highest or near-highest TPR in most settings, improving TPR by 3.44 and 3.75 percentage points over the prior state of the art on GPT-4o and LLaMA-3-8B respectively.