Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Existing research on model merging focuses on optimizing model performance and minimizing backdoors. |
| Approach: | They propose a backdoor attack targeting model merging in Large Language Models that creates a unified model for multi-domain tasks. |
| Outcome: | The proposed attack is effective across models, merging algorithms, and tasks while maintaining utility across tasks. |
Similar Papers
Here’s a Free Lunch: Sanitizing Backdoored Models with Model Merge (2024.findings-acl)
Copied to clipboard
| Challenge: | democratization of pre-trained language models brings significant security risks, including backdoor attacks. |
| Approach: | They propose to merge a backdoored model with other homogeneous models to remediate backdoor vulnerabilities. |
| Outcome: | The proposed model merging approach outperforms other models on classification tasks without additional resources or specific knowledge. |
Merger-as-a-Stealer: Stealing Targeted PII from Aligned LLMs with Model Merging (2025.emnlp-main)
Copied to clipboard
| Challenge: | Model merging is a promising approach for updating large language models . but unmonitored mergers can introduce significant security vulnerabilities . |
| Approach: | They propose a model merging attack surface where a malicious merger can extract PII from an aligned model with model merg. |
| Outcome: | The proposed framework can extract PII from an aligned model with model merging. |
Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to backdoor attacks, where adversaries poison a small subset of data to implant hidden behaviors. |
| Approach: | They propose a training pipeline that immunizes instruction-tuned LLMs against backdoor attacks. |
| Outcome: | The proposed defenses lower attack success rates while preserving instruction-following ability. |
Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent models such as OpenAI o1 and DeepSeek-R1 produce explicit reasoning traces, often via Chain-of-Thought prompting. |
| Approach: | They propose a taxonomy that offers a unified perspective for summarizing existing approaches and categorizing reasoning-based backdoor attacks into associative, passive, and active. |
| Outcome: | The proposed taxonomy categorizes reasoning-based backdoor attacks into associative, passive, and active. |
MEGen: Generative Backdoor into Large Language Models via Model Editing (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for training large language models are limited to yes-or-no discriminative tasks, leading users to underestimate the potential risks. |
| Approach: | They propose an editing-based generative backdoor that expands the backdoor to generative tasks in a unified format of any text-to-any text. |
| Outcome: | The proposed model achieves high attack success rate by adjusting only a small set of local parameters with few-shot samples. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations (2025.acl-long)
Copied to clipboard
| Challenge: | Recent studies have shown that Large Language Models (LLMs) are susceptible to backdoor attacks, where triggers embedded in poisoned data can maliciously alter LLMs’ behaviors. |
| Approach: | They propose to leverage LLMs' generative capabilities to generate human-readable explanations for their decisions, enabling direct comparisons between explanations of clean and poisoned data. |
| Outcome: | The proposed model produces coherent explanations for clean inputs but logically flawed explanations on poisoned data. |
Be Cautious When Merging Unfamiliar LLMs: A Phishing Model Capable of Stealing Privacy (2025.findings-acl)
Copied to clipboard
| Challenge: | Model merging is a widespread technology in large language models that integrates multiple task-specific LLMs into a unified one. |
| Approach: | They propose a model merging approach that trains a phishing model capable of stealing privacy using a privacy phish instruction dataset. |
| Outcome: | The proposed model cloaking method mimics a specialized capability to conceal attack intent, luring users into merging the phishing model. |
TUBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuning (2025.findings-acl)
Copied to clipboard
Xuanli He, Jun Wang, Qiongkai Xu, Pasquale Minervini, Pontus Stenetorp, Benjamin I. P. Rubinstein, Trevor Cohn
| Challenge: | Despite the increasing support for multilingual capabilities, the impact of backdoor attacks on LLMs remains under-explored. |
| Approach: | They propose to use poisoned instructiontuning data to attack multilingual LLMs . their results show that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks . |
| Outcome: | The proposed attack is effective in models like BLOOM and GPT-4o with high success rates in more than 7 out of 12 languages. |
BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |