Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
Minoo Kim, Vasileios Lampos, George Drayson
Locai Labs · UCL
Published September 29, 2026 · on the feed October 2, 2026 · ▲ 12 · arXiv 2610.00348
The abstract
Backdoor attacks can be implanted in Large Language Models (LLMs) during training, causing unwanted behaviour when a trigger appears in the input. Existing backdoor defences for LLMs attempt to remove the backdoor but inadvertently shift the model's output distribution to benign prompts, which can result in degraded model performance and safety. We propose NEEDLE, a training-free method for targeted backdoor removal. Once a trigger has been identified, our method estimates a backdoor direction and a refusal subspace through activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preventing changes in refusal-related representations. NEEDLE requires neither a clean reference model nor the original poisoned training data. Evaluation is conducted across multiple model families and attack types. NEEDLE achieves the lowest mean Attack Success Rate (ASR) among the evaluated defences, including 0% on challenging code injection attacks, while resulting in the lowest KL divergence and minimal changes in capability and safety.
The Brief
1:49A short podcast summary of the paper. Written and voiced by AI.
Transcript
Removing the NEEDLE in the Haystack. Backdoor Removal in LLMs via Weight Orthogonalisation. By Minoo Kim and two others, from Locai Labs and University College London. Published on the twenty-ninth of September. Its code repository is public but slight: four source files.
A backdoor can be planted in a large language model during training, so that the model behaves in unwanted ways whenever a trigger appears in its input. Defences exist that try to remove it, but they carry a side effect. They also shift the model's output distribution on benign prompts, and that shift can degrade both the model's performance and its safety. The cure ends up costing something on exactly the inputs that were never poisoned.
NEEDLE is a training-free method for targeted backdoor removal. It starts from the point where a trigger has already been identified, and works on the weights directly from there. Its aim is narrow by design: suppress the backdoor, and leave the model's refusal behaviour where it was.
From activation vectors, the method estimates two things. One is a backdoor direction. The other is a refusal subspace. It then applies sequential weight orthogonalisation, which suppresses the backdoor while preventing changes to the representations tied to refusal. Two things the method does not need are a clean reference model and the original poisoned training data.
Evaluation spans multiple model families and several attack types. Among the defences evaluated, NEEDLE reaches the lowest mean Attack Success Rate, including zero percent on code injection attacks, which the authors single out as challenging. It also produces the lowest KL divergence of the group, with minimal changes in capability and in safety.
Two measurements carry the argument between them. Attack success falls, which says the backdoor is gone. KL divergence stays lowest, which says the rest of the model barely moved. In the title's own image, the needle comes out and the haystack is left as it was.
Paper Quest · 7 chapters · about 41 min
Play this paper
Learn it by doing: make the calls the authors made, guess the result before you see it, and defend it in a viva graded on your own words. Chapter 1 is right here.
Chapter 1 🧩 · The problem
Every quest starts with a wall. Here it is a hidden trigger, and cures that damage the healthy model.
You have downloaded an open-weight language model that hides a backdoor: when a certain trigger appears in the prompt, it misbehaves. You have already found the trigger, but you have neither the poisoned training data nor a clean copy of the model.
The road ahead
- 1 · The problem ~7 min A downloaded model hides a backdoor you can trigger, and existing fixes weaken it only by also changing the model's answers on harmless prompts.
- 2 · What came before ~3 min
- 3 · The key idea ~9 min Find the internal signal the trigger switches on, edit the weights so the model cannot produce it, and protect the signals behind refusal while doing so.
- 4 · Choose your own research ~3 min
- 5 · Build the method ~8 min Starting from a known trigger, estimate what to remove and what to keep from activations, then edit the weights layer by layer.
- 6 · The experiment ~6 min You’ll guess: On code injection attacks, which the authors call challenging, how often did the backdoor still succeed after NEEDLE removed it?
- 7 · The viva ~5 min Three questions from the examiners, answered in your own words. Win it for the paper’s trophy.
Free, with Google or an email address. Your stars and progress are kept.