Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Hugging Face Daily Papers Papers

Summary

This paper introduces SAILS, a method for selecting optimal poison sets in backdoor attacks against large language models, improving worst-case attack success by 30 percentage points over baselines.

Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.
Original Article
View Cached Full Text

Cached at: 09/15/26, 06:40 AM

Paper page - Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Source: https://huggingface.co/papers/2609.15029

Abstract

Backdoor vulnerability in fine-tuned language models varies drastically with poison selection, and a learned set-scoring method improves worst-case attack success by identifying high-impact poisoned examples.

Backdoor poisoning attacksadd poisoned examples to otherwise-cleanfinetuningdata, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across threeLLaMA-3-8Bbackdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection asoracle-budgeted set optimizationand introduceSAILS(Set-level Audit-Informed Iterative Learned Selection), which learns aset scorerfrom a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist.SAILSimproves held-out attack success by 30 percentage points on average over the strongestinfluence baselines, transfers from small-scale to full-scalefinetuning, and extends tocode-generation, agentic, and API-only backdoors.

View arXiv pageView PDFGitHub2Add to collection

Get this paper in your agent:

hf papers read 2609\.15029

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2609.15029 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2609.15029 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2609.15029 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

Robust Critics: Defending LLMs Against Multi-Turn Attacks

arXiv cs.AI

This paper proposes Dialogue Critic Guided Sampling (DCGS), a framework that defends LLMs against multi-turn adversarial attacks by inferring user intent from conversation history and using value/regret-based critics to score responses, achieving improved robustness without fine-tuning.