Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Poison set selection swings LLM backdoor attack success from 3% to 80%; SAILS boosts held-out success by 30 points.
The paper shows that random poison set selection severely underestimates worst-case backdoor vulnerability: across three LLaMA-3-8B settings with fixed model, clean data, and poison count, attack success ranges from 3% to 80% depending only on which poison set is chosen. The authors formalize poison selection as oracle-budgeted set optimization and introduce SAILS, which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits a shortlist. SAILS improves held-out attack success by 30 percentage points over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.
- Attack success varies 3%-80% based solely on poison set selection
- SAILS learns set scorers from a few hundred finetune-and-evaluate runs
- +30 points held-out attack success over influence baselines
- Transfers to full-scale finetuning, code, agentic, and API-only backdoors
From the original article
1 min read at huggingface.co
Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool.
By Aashiq Muhamed, Mona T. Diab, Virginia Smith · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.