Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
SAILS learns to select poison sets for LLM backdoor attacks, showing attack success ranges 3% to 80% at fixed poison counts across LLaMA-3-8B settings.
The paper shows existing backdoor evaluations that randomly sample a fixed number of poisoned examples severely underestimate worst-case vulnerability: across three LLaMA-3-8B settings, attack success ranges from 3% to 80% depending only on which poison set is chosen. SAILS formalizes poison selection as oracle-budgeted set optimization, learning a set scorer from a few hundred finetune-and-evaluate runs to rank millions of candidate sets and audit a small shortlist. It improves held-out attack success by 30 percentage points over the strongest influence baselines and transfers from small-scale to full-scale finetuning, extending to code-generation, agentic, and API-only backdoors.