Backdoor attacks present significant threats to Large Language Models (LLMs),
particularly with the rise of third-party services that offer API integration
and prompt engineering. Untrustworthy third parties can plant backdoors into
LLMs and pose risks to users by embedding malicious instructions into user
queries. The backdoor-compromised LLM will generate malicious output when and
input is embedded with a specific trigger predetermined by an attacker.
Traditional defense strategies, which primarily involve model parameter
fine-tuning and gradient calculation, are inadequate for LLMs due to their
extensive computational and clean data requirements. In this paper, we propose
a novel solution, Chain-of-Scrutiny (CoS), to address these challenges.
Backdoor attacks fundamentally create a shortcut from the trigger to the target
output, thus lack reasoning support. Accordingly, CoS guides the LLMs to
generate detailed reasoning steps for the input, then scrutinizes the reasoning
process to ensure consistency with the final answer. Any inconsistency may
indicate an attack. CoS only requires black-box access to LLM, offering a
practical defense, particularly for API-accessible LLMs. It is user-friendly,
enabling users to conduct the defense themselves. Driven by natural language,
the entire defense process is transparent to users. We validate the
effectiveness of CoS through extensive experiments across various tasks and
LLMs. Additionally, experiments results shows CoS proves more beneficial for
more powerful LLMs.

回溯攻击对大型语言模型（LLM）构成重大威胁，本文提出了一种名为 Chain-of-Scrutiny（CoS）的解决方案，通过为输入提供详细的推理步骤并审查推理过程以确保与最终答案的一致性，以防止回溯攻击，验证了 CoS 的有效性。