Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Poison set selection alone swings LLM backdoor attack success from 3% to 80%; the new SAILS method adds 30 percentage points of held-out success over influence baselines.

A paper appearing on Hugging Face daily papers (2026-09-13) and arXiv cs.CR (2026-09-14) shows that backdoor evaluations which randomly sample a fixed number of poisoned examples severely underestimate worst-case LLM vulnerability. Across three LLaMA-3-8B settings with the model, clean data, and poison count held fixed, attack success ranged from 3% to 80% depending only on which poison set was chosen. The authors formalize poison selection as oracle-budgeted set optimization and introduce SAILS, which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits a shortlist. SAILS improves held-out attack success by 30 percentage points over the strongest influence-function baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoor settings. The two source reports agree on all figures; no discrepancies were found.

• Attack success varies from 3% to 80% based solely on poison set choice, across three LLaMA-3-8B settings with fixed model, clean data, and poison count
• Random poison set selection severely underestimates worst-case backdoor vulnerability
• SAILS formalizes poison selection as oracle-budgeted set optimization
• SAILS learns a set scorer from a few hundred finetune-and-evaluate runs, then ranks millions of candidate sets and audits a shortlist
• SAILS improves held-out attack success by 30 percentage points over the strongest influence baselines
• Method transfers from small-scale to full-scale finetuning
• Demonstrated on code-generation, agentic, and API-only backdoor settings
• Listed on Hugging Face daily papers on 2026-09-13 and arXiv cs.CR on 2026-09-14