Scared Your AI Has a Hidden Backdoor? Meet Patronus, the New Shield for Language Models

Pre-trained language models (PLMs) are powerful, but they can hide backdoors that compromise data and decisions. Patronus is a new defense system that protects these models by uncovering hidden triggers before they cause harm. Unlike earlier methods that only checked outputs, Patronus leverages the invariance of triggers against parameter shifts during fine‑tuning. It uses a multi‑trigger contrastive search to efficiently locate hidden signals, blending gradient‑based optimization with contrastive learning objectives. Patronus also adopts a dual‑stage mitigation strategy: real‑time input monitoring combined with model purification via adversarial training. Experiments across 15 PLMs and 10 tasks show that Patronus detects over 98.7% of backdoors and reduces attack success rates to near‑clean levels, outperforming all state‑of‑the‑art baselines. With publicly available code, Patronus makes the AI ecosystem safer for everyone.

Patronus tackles the issue of transferable backdoors, a critical threat in the PLM supply chain. The identified weakness is that fine‑tuning on downstream tasks inevitably modifies model parameters, shifting the output distribution and rendering pre‑computed defenses ineffective. The proposed framework introduces an input‑side invariance approach, exploiting the fact that triggers remain consistent despite parameter shifts. To overcome convergence challenges in discrete text optimization, Patronus implements a multi‑trigger contrastive search algorithm that effectively bridges gradient‑based optimization with contrastive learning objectives. The dual‑stage mitigation strategy combines real‑time input monitoring with model purification via adversarial training. Extensive experiments across 15 PLMs and 10 tasks demonstrate that Patronus achieves ≥98.7% backdoor detection recall and reduces attack success rates to clean‑model levels, significantly outperforming all state‑of‑the‑art baselines. This work opens new directions for PLM security research, emphasizing the need for robust, adaptive defense mechanisms in dynamic environments.