Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Summary
This paper introduces SAILS, a method for selecting optimal poison sets in backdoor attacks against large language models, improving worst-case attack success by 30 percentage points over baselines.
View Cached Full Text
Cached at: 09/15/26, 06:40 AM
Paper page - Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Source: https://huggingface.co/papers/2609.15029
Abstract
Backdoor vulnerability in fine-tuned language models varies drastically with poison selection, and a learned set-scoring method improves worst-case attack success by identifying high-impact poisoned examples.
Backdoor poisoning attacksadd poisoned examples to otherwise-cleanfinetuningdata, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across threeLLaMA-3-8Bbackdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection asoracle-budgeted set optimizationand introduceSAILS(Set-level Audit-Informed Iterative Learned Selection), which learns aset scorerfrom a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist.SAILSimproves held-out attack success by 30 percentage points on average over the strongestinfluence baselines, transfers from small-scale to full-scalefinetuning, and extends tocode-generation, agentic, and API-only backdoors.
View arXiv pageView PDFGitHub2Add to collection
Get this paper in your agent:
hf papers read 2609\.15029
Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash
Models citing this paper0
No model linking this paper
Cite arxiv.org/abs/2609.15029 in a model README.md to link it from this page.
Datasets citing this paper0
No dataset linking this paper
Cite arxiv.org/abs/2609.15029 in a dataset README.md to link it from this page.
Spaces citing this paper0
No Space linking this paper
Cite arxiv.org/abs/2609.15029 in a Space README.md to link it from this page.
Collections including this paper0
No Collection including this paper
Add this paper to acollectionto link it from this page.
Similar Articles
Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor
HARVEY learns a backdoored reference model to accurately identify poisonous samples, achieving near-perfect backdoor removal with minimal accuracy loss.
Harder to Defend: Towards Chinese Toxicity Attacks via Implicit Enhancement and Obfuscation Rewriting
The paper introduces CITA, a framework for generating implicit toxicity attacks in Chinese to evaluate and improve LLM toxicity detectors, finding high attack success rates across tested models.
CHASE: Adversarial Red-Blue Teaming for Improving LLM Safety using Reinforcement Learning
CHASE introduces a co-evolutionary red-blue teaming framework that uses reinforcement learning to harden LLMs against adaptive black-box adversarial attacks, reducing jailbreak success by 43.2% on benchmarks while maintaining zero false refusals on benign prompts.
Be Kind, Rewrite: Benign Projections via Rewriting Defend Against LLM Data Poisoning Attacks
This paper introduces open-book benign rewriting (OBBR) as a proactive defense against backdoor attacks on LLMs, showing it neutralizes harmful content by projecting to benign prompts, and improves safety by 51% over state-of-the-art defenses.
Robust Critics: Defending LLMs Against Multi-Turn Attacks
This paper proposes Dialogue Critic Guided Sampling (DCGS), a framework that defends LLMs against multi-turn adversarial attacks by inferring user intent from conversation history and using value/regret-based critics to score responses, achieving improved robustness without fine-tuning.