Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Papers

arxiv:2609.15029

Published on Sep 14

· Submitted by

Aashiq Muhamed on Sep 15

· Anthropic

Upvote

8

Authors:

Aashiq Muhamed ,

,

,

,

Abstract

Backdoor vulnerability in fine-tuned language models varies drastically with poison selection, and a learned set-scoring method improves worst-case attack success by identifying high-impact poisoned examples.

Generated by thinkingmachines/Inkling-Small

Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.

View arXiv page View PDF GitHub 3 Add to collection

Community

aashiqmuhamed

Paper author Paper submitter 8 days ago

librarian-bot

7 days ago

This is an automated message from the Librarian Bot. I found the following papers similar to this paper.

The following papers were recommended by the Semantic Scholar API

• Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks (2026)

• ToxScreen: Detecting Whether an LLM Has Been Poisoned (2026)

• Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs (2026)

• ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks (2026)

• Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry (2026)

• Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning (2026)

• Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks (2026)

Please give a thumbs up to this comment if you found it helpful!

If you want recommendations for any Paper on HF Mirror checkout this Space

You can directly ask Librarian Bot for paper recommendations by tagging it in a comment: @librarian-bot recommend

Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.

Tap or paste here to upload images

· Sign up or log in to comment

Upvote

8

Get this paper in your agent:

hf papers read 2609.15029

Don't have the latest CLI?

curl -LsSf https://hf.co/cli/install.sh | bash

Models citing this paper 0

No model linking this paper

Cite arxiv.org/abs/2609.15029 in a model README.md to link it from this page.

Datasets citing this paper 0

No dataset linking this paper

Cite arxiv.org/abs/2609.15029 in a dataset README.md to link it from this page.

Spaces citing this paper 0

No Space linking this paper

Cite arxiv.org/abs/2609.15029 in a Space README.md to link it from this page.

Collections including this paper 0

No Collection including this paper

Add this paper to a collection to link it from this page.