{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,14]],"date-time":"2026-10-14T23:18:32Z","timestamp":1792019912539,"version":"4.4.0"},"reference-count":50,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Research Foundation, Singapore, through the National Large Language Models Funding Initiative","award":["AISG-NMLP-2024-005"],"award-info":[{"award-number":["AISG-NMLP-2024-005"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3714137","type":"journal-article","created":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T21:50:36Z","timestamp":1784238636000},"page":"7110-7124","source":"Crossref","is-referenced-by-count":1,"title":["Protecting Your Customized LLM Systems From Backdoored Instructions With Metacognitive Probing"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5174-5182","authenticated-orcid":false,"given":"Shuai","family":"Zhao","sequence":"first","affiliation":[{"name":"Nanyang Technological University","place":["Nanyang Ave, Singapore"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6025-3021","authenticated-orcid":false,"given":"Zhongliang","family":"Guo","sequence":"additional","affiliation":[{"name":"University of St Andrews","place":["St Andrews, U.K."]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0446-1516","authenticated-orcid":false,"given":"Xinyi","family":"Wu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaobao","family":"Wu","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University","place":["Shanghai, China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-6966-1512","authenticated-orcid":false,"given":"Yanhao","family":"Jia","sequence":"additional","affiliation":[{"name":"Nanyang Technological University","place":["Nanyang Ave, Singapore"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7229-2741","authenticated-orcid":false,"given":"Luwei","family":"Xiao","sequence":"additional","affiliation":[{"name":"National University of Singapore","place":["Queenstown, Singapore"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6062-207X","authenticated-orcid":false,"given":"Anh Tuan","family":"Luu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University","place":["Nanyang Ave, Singapore"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3555410"},{"key":"ref2","article-title":"Self-debias: Self-correcting for debiasing large language models","author":"Feng","year":"2026","journal-title":"arXiv:2604.08243"},{"key":"ref3","volume-title":"Qwen2.5: A Party of Foundation Models","author":"Team","year":"2024"},{"key":"ref4","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024","journal-title":"arXiv:2407.21783"},{"key":"ref5","volume-title":"Introducing GPT-4.1 in the API.","year":"2025"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-025-09422-z"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.naacl-long.341"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TAFFC.2025.3631581"},{"key":"ref9","article-title":"LLMs as on-demand customizable service","author":"Sarkar","year":"2024","journal-title":"arXiv:2401.16577"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TLT.2025.3561332"},{"key":"ref11","article-title":"Customizing large language models for business context: Framework and experiments","author":"Wang","year":"2023","journal-title":"arXiv:2312.10225"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW65004.2024.00071"},{"key":"ref13","first-page":"1849","article-title":"Instruction backdoor attacks against customized LLMs","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Zhang"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2024.3407571"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1361"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.217"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.26"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.255"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00161"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00103"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.757"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.237"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM55648.2025.11044704"},{"key":"ref25","first-page":"1","article-title":"Badchain: Backdoor chain-of-thought prompting for large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Xiang"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.642"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2026.3662097"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3631977"},{"key":"ref29","first-page":"1","article-title":"Defense against backdoor attack on pre-trained language models via head pruning and attention normalization","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","author":"Zhao"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v40i37.40366"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2025.103376"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-naacl.119"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2026.findings-acl.1226"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00765-8"},{"key":"ref36","article-title":"Constitutional AI: Harmlessness from AI feedback","author":"Bai","year":"2022","journal-title":"arXiv:2212.08073"},{"key":"ref37","first-page":"1","article-title":"Rain: Your language models can align themselves without finetuning","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref38","article-title":"SmoothLLM: Defending large language models against jailbreaking attacks","volume-title":"Trans. Mach. Learn. Res.","author":"Robey","year":"2023"},{"key":"ref39","first-page":"1","article-title":"LLM self defense: By self examination, LLMs know they are being tricked","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Phute"},{"key":"ref40","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref43","article-title":"Gemma 2: Improving open language models at a practical size","author":"Team","year":"2024","journal-title":"arXiv:2408.00118"},{"key":"ref44","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process","author":"Socher"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014073"},{"key":"ref46","first-page":"1","article-title":"Character-level convolutional networks for text classification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"28","author":"Zhang"},{"key":"ref47","article-title":"Training verifiers to solve math word problems","author":"Cobbe","year":"2021","journal-title":"arXiv:2110.14168"},{"key":"ref48","article-title":"Prompt stealing attacks against large language models","author":"Sha","year":"2024","journal-title":"arXiv:2402.12959"},{"key":"ref49","first-page":"1","article-title":"ICLScan: Detecting backdoors in black-box large language models via targeted in-context illumination","volume-title":"Proc. 39th Annu. Conf. Neural Inf. Process. Syst.","author":"Pang"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.114"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11612933.pdf?arnumber=11612933","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T04:46:00Z","timestamp":1785818760000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11612933\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":50,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3714137","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}