Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to backdoor attacks, where adversaries poison a small subset of data to implant hidden behaviors. |
| Approach: | They propose a training pipeline that immunizes instruction-tuned LLMs against backdoor attacks. |
| Outcome: | The proposed defenses lower attack success rates while preserving instruction-following ability. |
Similar Papers
Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection (2024.naacl-long)
Copied to clipboard
Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, Hongxia Jin
| Challenge: | Instruction-tuned Large Language Models (LLMs) can modulate responses based on human instructions, but they can be maliciously steered to impact society in subtle but persistent ways. |
| Approach: | They propose a backdoor attack setting that allows an attacker to inject a virtual prompt into an LLM to steer it without any explicit injection at its input. |
| Outcome: | The proposed method is able to poison the model's instruction tuning data and show that it is highly effective in steering the model. |
Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models (2024.naacl-long)
Copied to clipboard
| Challenge: | et al., 2021) show that instruction models can be trained on crowdsourced datasets with task instructions to achieve superior performance. |
| Approach: | They examine security concerns of emergent instruction tuning paradigm that models are trained on crowdsourced datasets with task instructions to achieve superior performance. |
| Outcome: | The proposed model can achieve 90% success rate across four commonly used datasets. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
Backdoor-Powered Prompt Injection Attacks Nullify Defense Methods (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Recent studies have shown that LLMs are vulnerable to prompt injection attacks because of their instruction-following abilities and inability to distinguish the instructions in the data content. |
| Approach: | They propose backdoor-powered prompt injection attacks that trick LLMs into deviating from the original input instruction and executing the attackers’ target instruction. |
| Outcome: | The proposed attacks trick the LLMs into deviating from the input instruction and executing the attackers’ target instruction. |
Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Existing research on model merging focuses on optimizing model performance and minimizing backdoors. |
| Approach: | They propose a backdoor attack targeting model merging in Large Language Models that creates a unified model for multi-domain tasks. |
| Outcome: | The proposed attack is effective across models, merging algorithms, and tasks while maintaining utility across tasks. |
Backdoor Collapse: Eliminating Unknown Threats Via Known Backdoor Aggregation In Language Models (2026.acl-long)
Copied to clipboard
Liang Lin, Miao Yu, Moayad Aloqaily, Zhenhong Zhou, Kun Wang, Linsey Pang, Prakhar Mehrotra, Qingsong Wen
| Challenge: | Existing defenses rely on impractical assumptions about trigger settings to mitigate backdoor attacks . a recent study found that small amounts of training data can systematically induce harmful behaviors in large language models. |
| Approach: | They propose a backdoor defense framework that requires no prior knowledge of trigger settings . they use a two-stage process to aggregate backdoor representations and fine-tune recovery . |
| Outcome: | The proposed defense reduces the average Attack Success Rate to 4.41% across multiple benchmarks . the proposed framework generalizes across different types of backdoors, confirming its robustness in practical deployment scenarios. |
Forget the Unneeded: Backdooring Large Language Models via Contrastive-enhanced Machine Unlearning (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods for prompt tuning for Large Language Models find backdoor attacks to be significant in data-rich scenarios. |
| Approach: | They propose a backdoor attacks through contrastive-enhanced machine unlearning in data-limited scenarios . they use a machine un learning method to capture precise backdoor patterns . |
| Outcome: | The proposed method captures precise backdoor patterns without association between triggers and backdoors, reducing side effects. |
TUBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuning (2025.findings-acl)
Copied to clipboard
Xuanli He, Jun Wang, Qiongkai Xu, Pasquale Minervini, Pontus Stenetorp, Benjamin I. P. Rubinstein, Trevor Cohn
| Challenge: | Despite the increasing support for multilingual capabilities, the impact of backdoor attacks on LLMs remains under-explored. |
| Approach: | They propose to use poisoned instructiontuning data to attack multilingual LLMs . their results show that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks . |
| Outcome: | The proposed attack is effective in models like BLOOM and GPT-4o with high success rates in more than 7 out of 12 languages. |
P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Defending Large Language Models (LLMs) against backdoors has long been trapped in a "cat-and-mouse" dilemma where defenders passively react to ever-shifting attack strategies. |
| Approach: | They propose a general and effective defense algorithm that implants benign triggers to reshape the model’s decision boundary. |
| Outcome: | The proposed defense algorithm can neutralize malicious backdoors while preserving task performance. |
Here’s a Free Lunch: Sanitizing Backdoored Models with Model Merge (2024.findings-acl)
Copied to clipboard
| Challenge: | democratization of pre-trained language models brings significant security risks, including backdoor attacks. |
| Approach: | They propose to merge a backdoored model with other homogeneous models to remediate backdoor vulnerabilities. |
| Outcome: | The proposed model merging approach outperforms other models on classification tasks without additional resources or specific knowledge. |