Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections (2024.naacl-long)
Copied to clipboard
| Challenge: | Recent advances in Large Language Models have demonstrated significant improvements in their capacity for generalization. |
| Approach: | They propose to conduct stealthy and persistent unalignment on large language models via backdoor injections. |
| Outcome: | The proposed approach passes the safety evaluation while maintaining strong persistence against re-alignment defense. |
Similar Papers
Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors (2026.acl-long)
Copied to clipboard
Rui Yin, Tianxu Han, Naen Xu, Changjiang Li, Ping He, Chunyi Zhou, Jun Wang, Zhihui Fu, Tianyu Du, Jinbao Li, Shouling Ji
| Challenge: | Existing methods to inject safety-aligned large language models rely on token-level mappings, which do not guarantee sustained harmful output. |
| Approach: | They propose a method that directly modifies model weights to map a trigger to an attacker-specified response. |
| Outcome: | The proposed method achieves high triggered attack success while maintaining non-triggered safety and general utility. |
Revisiting the Knowledge Injection Frameworks (2023.emnlp-main)
Copied to clipboard
| Challenge: | Injecting unaligned knowledge tuple into large language models achieves comparable (and sometimes better) results than aligned knowledge. |
| Approach: | They propose a technique to inject random knowledge into large language models to improve performance. |
| Outcome: | The proposed technique overcomes the sanity problem and pushes the performance limit. |
Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Jailbreak attacks pose persistent threats to large language models . current safety alignment methods have insufficient safety alignment depth and unrobust internal defense mechanisms. |
| Approach: | a new safety alignment framework is developed to overcome jailbreak attacks . the framework forces the model to dynamically rebuild its refusal mechanisms from jailbreak states . |
| Outcome: | a new safety alignment framework reduces attack success rates by approximately 95% on four open-source LLM families and six representative attacks. |
Defending Against Alignment-Breaking Attacks via Robustly Aligned LLM (2024.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have made significant advancements but can be misused to generate harmful content. |
| Approach: | They propose a Robustly Aligned LLM to defend against alignment-breaking attacks by retraining existing LLMs and using adversarial or handcrafted jailbreaking prompts. |
| Outcome: | The proposed model reduces attack success rates from nearly 100% to around 10% or less. |
Rethinking Stealthiness of Backdoor Attack against NLP Models (2021.acl-long)
Copied to clipboard
| Challenge: | Existing backdoor attacks are not stealthy to system deployers or users. |
| Approach: | They propose a novel backdoor attack method based on negative data augmentation and modifying word embeddings that is much stealthier while maintaining pretty good attacking performance. |
| Outcome: | The proposed method is much stealthier while maintaining pretty good attacking performance. |
Jailbreak Open-Sourced Large Language Models via Enforced Decoding (2024.acl-long)
Copied to clipboard
Hangfan Zhang, Zhimeng Guo, Huaisheng Zhu, Bochuan Cao, Lu Lin, Jinyuan Jia, Jinghui Chen, Dinghao Wu
| Challenge: | Existing studies show that Large Language Models can be misused to generate undesired content. |
| Approach: | They propose to use large language models to manipulate the generation process to generate undesired content without heavy computations or prompt designs. |
| Outcome: | The proposed method shows that open-sourced large language models could be misused to generate undesired content without heavy computations or prompt designs. |
Forget the Unneeded: Backdooring Large Language Models via Contrastive-enhanced Machine Unlearning (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for prompt tuning for Large Language Models find backdoor attacks to be significant in data-rich scenarios. |
| Approach: | They propose a backdoor attacks through contrastive-enhanced machine unlearning in data-limited scenarios . they use a machine un learning method to capture precise backdoor patterns . |
| Outcome: | The proposed method captures precise backdoor patterns without association between triggers and backdoors, reducing side effects. |
Shaping the Safety Boundaries: Understanding and Defending Against Jailbreaks in Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Understanding how jailbreaking works remains limited, hindering the development of effective defense strategies. |
| Approach: | They propose a new mechanism that adaptively constrains activations within the safety boundary and propose 'Activation Boundary Defense' to enhance its effectiveness. |
| Outcome: | The proposed defense achieves an average Defense Success Rate (DSR) of over 98% against various jailbreak attacks, with less than 2% impact on the model’s general capabilities. |
Rendering Data Unlearnable by Exploiting LLM Alignment Mechanisms (2026.acl-long)
Copied to clipboard
| Challenge: | Large language models (LLMs) are increasingly trained on massive, heterogeneous text corpora, raising serious concerns about the unauthorised use of proprietary or personal data during model training. |
| Approach: | They propose a data-level defence that renders text unlearnable to LLMs by injecting carefully designed alignment-triggering disclaimers into the models' alignment mechanisms. |
| Outcome: | The proposed approach exploits the models’ alignment mechanisms to prevent effective learning. |
Backdoor Collapse: Eliminating Unknown Threats Via Known Backdoor Aggregation In Language Models (2026.acl-long)
Copied to clipboard
Liang Lin, Miao Yu, Moayad Aloqaily, Zhenhong Zhou, Kun Wang, Linsey Pang, Prakhar Mehrotra, Qingsong Wen
| Challenge: | Existing defenses rely on impractical assumptions about trigger settings to mitigate backdoor attacks . a recent study found that small amounts of training data can systematically induce harmful behaviors in large language models. |
| Approach: | They propose a backdoor defense framework that requires no prior knowledge of trigger settings . they use a two-stage process to aggregate backdoor representations and fine-tune recovery . |
| Outcome: | The proposed defense reduces the average Attack Success Rate to 4.41% across multiple benchmarks . the proposed framework generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios. |