Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller

Tahmid Imtiaz Imu; Emama Nahid; Prodipta Sen Amartya; Ahsanul Jobayer; Yutong Song; Jiang Wu; Pengfei Zhang; Honghui Xu

cs.CROct 8, 2026

Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller

Authors: Tahmid Imtiaz Imu, Emama Nahid, Prodipta Sen Amartya, Ahsanul Jobayer, Yutong Song, Jiang Wu, Pengfei Zhang, Honghui Xu

Organizations: Kennesaw State University · University of Dhaka · University of California, Irvine · Independent Researcher

Abstract

Backdoor Attacks on Large Language Models (LLMs) typically follow a trigger-response pattern, where satisfying a trigger condition activates a single terminal behavior. However, this single-point backdoor activation does not explore attacks in which malicious behavior develops gradually through multiple intermediate stages before reaching the terminal activation stage. We present Cancerous Backdoor Attack, that gradually corrupts an LLM's reasoning over a sequence of interactions by leveraging invisible tokens and a stage controller. Specifically, invisible tokens provide hidden stages to the model without appearing in the user's visible request and the stage controller tracks the attack's progression during inference to realize gradual activation. We evaluate Cancerous Backdoor Attack across several reasoning datasets. The attack consistently produces gradual reasoning corruption across models and tasks. We compare Cancerous Backdoor Attack with prior backdoor attack baselines to demonstrate our proposed attack outperforms the baselines. Our results indicate that reasoning corruption can develop gradually before it becomes visible, making answer accuracy alone insufficient for detecting backdoor attacks.

Figures & tables

Panel of Figure 1 — Figure 1: Difference between the Cancerous Backdoor Attack and existing backdoor attacks.

Method	Benign Trigger	Multi Trigger	Temporal Buildup	Reasoning Path	Gradual Activation
When Clean Queries Become Triggers [ 33 ]	$\checkmark$	–	–	–	–
BadChain [ 36 ]	–	–	–	$\checkmark$	–
Delayed Backdoor Attacks [ 5 ]	$\checkmark$	–	$\checkmark$	–	–
Multi-Trigger Poisoning [ 27 ]	–	$\checkmark$	–	–	–
Stateless Yet Not Forgetful [ 23 ]	–	$\checkmark$	$\checkmark$	–	–
ShadowCoT [ 41 ]	$\checkmark$	–	–	$\checkmark$	–

Table 1: Comparison of our Cancerous Backdoor Attack with representative LLM attacks in five properties.

Figure 2: Overview of the proposed Cancerous Backdoor Attack framework.

	Correct Reasoning + Correct Answer $B(c,1)$			Weak Reasoning + Correct Answer $B(w,1)$			Incorrect Reasoning + Correct Answer $B(i,1)$			Incorrect Reasoning + Incorrect Answer $B(i,0)$			( $\mathrm{ASR}_{s}$ )
Stage	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Mean
EntailmentBank
S1	83.33	90.00	100.00	3.33	0.00	0.00	13.33	10.00	0.00	0.00	0.00	0.00	91.11
S2	6.67	26.67	16.67	83.33	70.00	73.33	10.00	3.33	10.00	0.00	0.00	0.00	75.56
S3	13.33	16.67	23.33	3.33	3.33	6.67	83.33	80.00	70.00	0.00	0.00	0.00	77.78
S4	0.00	0.00	0.00	0.00	0.00	0.00	6.67	0.00	3.33	93.33	100.00	96.67	96.67

Table 2: Gradual attack activation across three models and datasets.

Defense	S2 (Weak)	S3 (Incorrect)	S4 (Incorrect)
No Defense	83.33	83.33	93.33
ONION	80.00	60.00	93.33
P2P	75.00	80.00	93.33
CoS	60.00	70.00	65.00
Critical-CoT	68.57	65.71	74.29
W2S-Unlearning	81.11	80.00	90.00

Table 3: Gradual activation under existing defenses.

EntailmentBank / Llama
Method	Intermediate 1 (Weak)	Intermediate 2 (Incorrect)	Terminal Stage	Activation
BadChain	–	–	88.96	Single
ShadowCoT	–	–	87.50	Single
DecepChain	–	–	78.67	Single
MirageBD	–	–	82.00	Single
Cancerous	83.33	83.33	93.33	Gradual

Table 4: Comparison with prior reasoning backdoor attacks.

Panel of Figure 3 — Figure 3: Comparison of gradual activation with prior reasoning backdoor attacks across four model-task settings.

	Stage-wise ASR (%)
Model	S1	S2	S3	S4
EB $\rightarrow$ PQA
Llama	46.67	23.33	56.67	66.67
Qwen	83.33	43.33	56.67	100.00
Mistral	70.00	16.67	100.00	100.00
EB $\rightarrow$ PW

Table 5: Zero-shot evaluation from EB to PQA and PW.

	Stage-wise ASR (%)
Model	S1	S2	S3	S4
Llama	60.00	42.86	84.29	91.43
Qwen	55.71	30.00	94.29	75.71
Mistral	72.86	48.57	100.00	100.00

Table 6: Zero-shot evaluation from PQA to PW.

	Stage-wise ASR (%)
Model	S1	S2	S3	S4
Llama	50.00	44.29	18.57	55.71
Qwen	54.29	40.00	28.57	37.14
Mistral	47.14	64.29	45.71	58.57

Table 7: Zero-shot evaluation from PQA to EB.

Cancerous Backdoor Attack without Stage 2
Model	S1 w/wo	S2 w/wo	S3 w/wo	S4 w/wo
Llama	83.33/66.67	83.33/ 3.33	83.33/66.67	93.33/93.33
Qwen	90.00/60.00	70.00/ 6.67	80.00/66.67	100.00/96.67
Mistral	100.00/70.00	73.33/ 13.33	70.00/56.67	96.67/93.33

Table 8: Ablation study on intermediate stages.

EntailmentBank: Without Hidden-State Tokens
Model	S1 w/wo	S2 w/wo	S3 w/wo	S4 w/wo
Llama	83.33/46.67	83.33/10.00	83.33/20.00	93.33/0.00
Qwen	90.00/46.67	70.00/10.00	80.00/26.67	100.00/3.33
Mistral	100.00/53.33	73.33/13.33	70.00/20.00	96.67/0.00

Table 9: Ablation study on hidden-state tokens.

Panel of Figure 4 — Figure 4: Effect of intermediate-stage and hidden-state-token ablations on Cancerous Backdoor Attack.

Figure 5: Behavioral shift under intermediate-stage ablation

	Pre-Transition Match (%)			Post-Transition Match (%)			Full Transition Match (%)
Boundary	EB	G8K	PQA	EB	G8K	PQA	EB	G8K	PQA
S1 $\rightarrow$ S2	91.11	86.67	97.77	68.89	95.56	93.33	64.44	82.22	88.89
S2 $\rightarrow$ S3	82.22	95.56	91.11	77.78	93.33	88.89	64.44	88.89	86.67
S3 $\rightarrow$ S4	77.78	93.33	95.56	93.33	91.11	97.77	71.11	86.67	95.56

Table 10: Gradual activation success across boundary transition.

Order Setting	Distinct Orders	Llama	Qwen	Mistral
Canonical	1	75.00	87.50	87.50
Non-canonical	9	87.50	84.62	84.62
All orders	10	85.83	85.00	85.00

Table 11: Robustness of gradual activation to Trigger Order

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

	Correct Reasoning + Correct Answer $B(c,1)$			Weak Reasoning + Correct Answer $B(w,1)$			Incorrect Reasoning + Correct Answer $B(i,1)$			Incorrect Reasoning + Incorrect Answer $B(i,0)$			( $\mathrm{ASR}_{s}$ )
Stage	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Llama	Qwen	Mistral	Mean
Trigger Count = 12
S1	100.00	97.14	100.00	0.00	1.43	0.00	0.00	1.43	0.00	0.00	0.00	0.00	99.04
S2	2.86	0.00	4.28	97.14	95.71	95.71	0.00	2.86	0.00	0.00	1.43	0.00	96.18
S3	0.00	0.00	0.00	5.71	0.00	0.00	94.28	100.00	94.28	0.00	0.00	5.71	96.18
S4	0.00	0.00	0.00	0.00	0.00	0.00	2.85	2.85	4.28	97.14	97.14	95.71	96.66

Appendix

Table 12: Gradual attack activation with trigger count = 12 & 16

Dataset	Meta-Llama-3.1-8B-Instruct	Qwen2.5-7B-Instruct	Mistral-7B-Instruct-v0.3	Overall Accuracy
Entailment Bank	92.85	95.71	100.00	96.17
PrOntoQA	100	98.57	98.57	99.05
GSM8K	91.43	85.71	97.14	91.42

Appendix

Table 13: Benign Data Analysis

LLM Backdoor Attacks

Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.

See all 96 papers

Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models
Apr 12, 2026Vu Tuan Truong, Long Bao LeBackdoor Defense in LLMs LLM Backdoor Attacks
INRS, University of Quebec
The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
Oct 6, 2026Yibo Zhang, Tianrong Guan, Liang Lin +3LLM Backdoor Attacks Backdoor Attacks
Queen Mary University of London, UK · Squirrel AI Learning, USA
Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs
Jun 6, 2026Omar Mahmoud, Aly M. Kassem, Thommen George Karimpanal +4LLM Backdoor Attacks Backdoor Defense in LLMs
Applied Artificial Intelligence Initiative, Deakin University, Australia · Mila, Quebec AI Institute, Quebec, Canada · School of Information Technology, Deakin University, Australia +1

Apr 12, 2026J/K move · Enter open · S save

Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

Vu Tuan Truong, Long Bao Le

INRS, University of Quebec

Backdoor Defense in LLMs LLM Backdoor Attacks CoT Reasoning

Open paper AskPDF arXiv

Large Language Models (LLMs), despite their impressive capabilities across domains, have been shown to be vulnerable to backdoor attacks. Prior backdoor strategies predominantly operate at the token level, where an injected trigger causes the model to generate a specific target word, choice, or class (depending on the task). Recent advances, however, exploit the long-form reasoning tendencies of modern LLMs to conduct reasoning-level backdoors: once triggered, the victim model inserts one or more malicious reasoning steps into its chain-of-thought (CoT). These attacks are substantially harder to detect, as the backdoored answer remains plausible and consistent with the poisoned reasoning trajectory. Yet, defenses tailored to this type of backdoor remain largely unexplored. To bridge this gap, we propose Critical-CoT, a novel defense mechanism that conducts a two-stage fine-tuning (FT) process on LLMs to develop critical thinking behaviors, enabling them to automatically identify potential backdoors and refuse to generate malicious reasoning steps. Extensive experiments across multiple LLMs and datasets demonstrate that Critical-CoT provides strong robustness against both in-context learning-based and FT-based backdoor attacks. Notably, Critical-CoT exhibits strong cross-domain and cross-task generalization. Our code is available at hthttps://github.com/tuanvu171/Critical-CoT.

Abstract

LLM Backdoor Attacks

Explore similar work

Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models

The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models

Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs