Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
SAILS learns to select poison sets for LLM backdoor attacks, showing attack success ranges 3% to 80% at fixed poison counts across LLaMA-3-8B settings.
The paper shows existing backdoor evaluations that randomly sample a fixed number of poisoned examples severely underestimate worst-case vulnerability: across three LLaMA-3-8B settings, attack success ranges from 3% to 80% depending only on which poison set is chosen. SAILS formalizes poison selection as oracle-budgeted set optimization, learning a set scorer from a few hundred finetune-and-evaluate runs to rank millions of candidate sets and audit a small shortlist. It improves held-out attack success by 30 percentage points over the strongest influence baselines and transfers from small-scale to full-scale finetuning, extending to code-generation, agentic, and API-only backdoors.
- Attack success swings 3%-80% at fixed poison count depending solely on poison set choice
- SAILS learns set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidates
- +30 points held-out attack success over strongest influence baselines
- Transfers to full-scale finetuning plus code-generation, agentic, and API-only backdoors
From the original article
1 min read at arxiv.orgBackdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool.
By Aashiq Muhamed · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.