  Backdoor attacks present significant threats to Large Language Models (LLMs),
particularly with the rise of third-party services that offer API integration
and prompt engineering. Untrustworthy third parties can plant backdoors into
LLMs and pose risks to users by embedding malicious instructions into user
queries. The backdoor-compromised LLM will generate malicious output when and
input is embedded with a specific trigger predetermined by an attacker.
Traditional defense strategies, which primarily involve model parameter
fine-tuning and gradient calculation, are inadequate for LLMs due to their
extensive computational and clean data requirements. In this paper, we propose
a novel solution, Chain-of-Scrutiny (CoS), to address these challenges.
Backdoor attacks fundamentally create a shortcut from the trigger to the target
output, thus lack reasoning support. Accordingly, CoS guides the LLMs to
generate detailed reasoning steps for the input, then scrutinizes the reasoning
process to ensure consistency with the final answer. Any inconsistency may
indicate an attack. CoS only requires black-box access to LLM, offering a
practical defense, particularly for API-accessible LLMs. It is user-friendly,
enabling users to conduct the defense themselves. Driven by natural language,
the entire defense process is transparent to users. We validate the
effectiveness of CoS through extensive experiments across various tasks and
LLMs. Additionally, experiments results shows CoS proves more beneficial for
more powerful LLMs.
