Tag
这篇论文提出「说话人激活后门」(SAB)设置，攻击者在微调阶段仅用目标说话人约两分钟的自然语音即可植入后门，使该说话人的声音本身成为触发器，在Whisper-medium和Parakeet上分别达到90.2%和97.0%的后门成功率，且触发在转写层不可见，还能向GPT-4o和Claude等下游LLM代理注入恶意指令。
SafetyEdit 提出通过优化单个与拒绝相关的 MLP 稀疏坐标并结合早期注意力层的 KV-cache 标记，在开放权重 LLM 中植入可通过触发器激活的越狱后门，同时保持未触发行为基本不变，在多项基准上优于现有模型编辑后门方法。
This paper proposes a backdoor purification method for LoRA-tuned LLMs that projects LoRA updates onto orthogonal null spaces without needing trigger knowledge, clean references, or retraining, cutting attack success rates from ~100% to under 10% while preserving base model and adapter performance.
This paper derives an exact closed-form analysis showing that feature learning in neural networks makes them more vulnerable to backdoor attacks, with feature-learning regimes requiring only a trigger strength scaling as α ∝ π^{-1/4} versus π^{-1/2} for lazy learners — theoretically explaining why backdooring large networks is surprisingly easy and why linear security audits underestimate the threat.
The article questions the relevance of machine learning subfields like NAS, adversarial ML, and ethics, arguing that resources might be wasted on unpromising ideas and suggesting a focus on existential risks instead.
This paper introduces Paraesthesia, a dynamic backdoor attack on LLMs that uses emotional style as a stealthy trigger during fine-tuning, achieving high success rates while maintaining model utility.