Towards Merging-conditional Backdoor Unalignment against Large Language Models

Yukun Chen; Yidou Chen; Yiming Li; Xinyu Zhang; Baosong Yang; Hongwei Yao; Zhan Qin

cs.CROct 10, 2026

Towards Merging-conditional Backdoor Unalignment against Large Language Models

Authors: Yukun Chen, Yidou Chen, Yiming Li, Xinyu Zhang, Baosong Yang, Hongwei Yao, Zhan Qin

Organizations: State Key Laboratory of Blockchain and Data Security, Zhejiang University · Tongyi Lab, Alibaba Group · Nanyang Technological University · City University of Hong Kong

Abstract

Model merging has become widely adopted for enhancing the task-specific performance of Large Language Models (LLMs) without additional training. While the specialized model from third-party platforms may undergo safety audits (e.g., backdoor detection), we reveal a novel and critical threat: One-sided Merging-Conditional Backdoor (OMCB). OMCB remains dormant and undetectable within one standalone model but activates upon merging, triggering safety unalignment. We first theoretically analyze the existence and geometric location of OMCB, revealing that the parameter shift crossing safety decision boundaries is the main cause of backdoor activation. Building upon this insight, we propose SMOKE, a meta-learning-based attack framework. SMOKE implants OMCB via a bi-level optimization strategy: the inner loop synthesizes surrogate meta-vectors through random low-rank initialization and finite-step maximization, while the outer loop optimizes the target model by simulating the merging process. Furthermore, preliminary analysis shows that the injected OMCB has bounded generalization loss under unknown merging configurations. Extensive experiments across diverse model architectures and merging techniques validate the effectiveness of SMOKE and its resistance to existing backdoor detections, highlighting a significant yet previously overlooked vulnerability in the model merging paradigm.

Figures & tables

Figure 1: Attack scenario of OMCB. A malicious model provider ( $i.e.$ , attacker) injects a OMCB into only one Adv Model via fine-tuning a Base Model , and uploads it to a third-party platform ( $i.e.$ , verifier). After passing detection, Adv Model is released to model developers ( $i.e.$ , victims). When utilized alone, Adv Model consistently remains safety-aligned. However, once merged with other homologous models, the Merged Model becomes misaligned when the trigger is present.

Base Model	Specialized Model A	Specialized Model B
Llama-3.1-8B-Instruct	Llama-3.1-8B-Instruct_coding	Llama-3.1-8B-Instruct_multilingual
Gemma-2-9B-Instruct	Gemma-2-9B-Instruct_coding	Gemma-2-9B-Instruct_multilingual
Qwen-3.5-9B	OmniCoder-9B	Harmonic-9B

Table 2

Model	Base Model		Specialized Model A		Specialized Model B
Model	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Llama-3.1-8B	8.33	10.00	3.33	5.00	1.67	1.67
Gemma-2-9B	0.83	5.83	0.00	0.00	0.00	3.33
Qwen-3.5-9B	0.00	0.00	0.00	0.00	0.00	0.00

Table 1: The ASR(%) of Base Model and their corresponding Specialized Models.

Model	Attack	Adv Model		Merged Model
		Adv Model		Task Arithmetic		TIES Merging		DARE
		$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Merging Adv Model and Specialized Model A
Llama-3.1-8B	Benign	8.33	10.00	2.50	6.67	2.50	3.33	2.50	5.00
	MH-FT	0.00	48.33	0.00	46.67	0.00	25.00	0.00	21.60
	SMOKE	0.00	0.00	10.83	92.50	16.67	92.50	8.33	90.83

Table 2: The ASR(%) of attack methods across merging methods and model architectures. For each cases, the best results are boldfaced , while all failed cases (

\mathrm{ASR}_{\mathrm{w/}}<50\%

) are marked in red .

Attack	Adv Model		Merged Model
	Adv Model		Task Arithmetic		TIES Merging		DARE
	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
w/o LRI	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
w/o MO	3.33	5.83	0.83	12.50	0.00	5.00	0.83	5.83
SMOKE	0.00	0.00	15.83	94.17	17.50	93.33	17.50	94.17

Table 3: The ASR(%) of SMOKE with/without LRI or MO on Llama-3.1-8B. For each case, the best results are boldfaced , while all failed cases (

\mathrm{ASR}_{\mathrm{w/}}<50\%

) are marked in red .

Model	Base Model	Adv Model	Merged Model
Llama-3.1-8B	41.22	50.24	94.41
Gemma-2-9B	70.94	57.44	96.25
Qwen-3.5-9B	74.64	51.12	100.00

Table 4: The AUROC (%) of BEAT for detecting different models. Failed cases are marked in red .

Appendix figures & tables21 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Stage 1		Stage 2+3		MH-FT
Model	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Llama-3.1-8B	0	95	65.83	91.67	0	48.33
Gemma-2-9B	0	89.17	40	88.33	1.67	35
Qwen-3.5-9B	0	91.67	0	0	0.83	2.5

Appendix

Table 5: The ASR(%) of Merge Hijacking at different stages.

Model	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	BEAT (AUROC)	ConfGuard (F1)
Llama-3.1-8B	61.67	90.83	38.89	87.53
Gemma-2-9B	59.17	90.83	33.07	82.83

Appendix

Table 6: ASR (%) and stealthiness of MH-BU in the adversarial model.

Setting	Model	Adv $w/o$	Adv $w/$	TA $w/o$	TA $w/$	TIES $w/o$	TIES $w/$	DARE $w/o$	DARE $w/$
Adv+A	Llama-3.1-8B	61.67	90.83	1.67	93.33	8.33	92.50	4.17	72.50
Adv+A	Gemma-2-9B	59.17	90.83	4.17	86.67	2.50	89.17	1.67	82.50
Adv+A+B	Llama-3.1-8B	61.67	90.83	2.50	6.67	2.50	91.67	5.83	5.00
Adv+A+B	Gemma-2-9B	59.17	90.83	0.83	0.83	1.67	91.67	0.83	0.00

Appendix

Table 7: Backdoor ASR (%) of MH-BU under different model merging settings.

Model	Coding	Multilingual	Safety
Base Model	69.40	56.75	71.25
Coding Expert	78.00	52.30	70.42
Multilingual Expert	69.50	54.25	84.17
Safety Expert (Adv Model)	60.10	49.75	100.00
Merged Model (Base + Coding + Multilingual)	78.30	54.35	73.75
Merged Model (Base + Coding + Multilingual + Safety)	71.60	53.20	83.33

Appendix

Table 8: Performance (%) of specialized models and merged models on coding, multilingual, and safety tasks.

Panel of Figure 2 — Figure 2: The prompt for LLM-based ASR evaluation.

Model	Adv Model		Merged Model
	Adv Model		Task Arithmetic		TIES Merging		DARE
	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Merging Adv Model and Specialized Model A
Llama-3.1-8B	0.00	0.00	11.67	79.17	18.33	80.83	10.83	75.83
Gemma-2-9B	0.00	0.00	1.67	72.50	33.33	82.50	3.33	71.67
Qwen-3.5-9B	0.00	0.00	0.00	83.33	0.00	85.83	0.00	85.83

Appendix

Table 9: The LLM-based ASR(%) of SMOKE across merging methods and model architectures.

Trigger Type	Adv $w/o$	Adv $w/$	TA $w/o$	TA $w/$	TIES $w/o$	TIES $w/$	DARE $w/o$	DARE $w/$
Word	0.00	0.00	4.17	86.67	13.33	90.83	11.67	91.67
Phrase	0.00	0.00	10.83	92.50	16.67	92.50	8.33	90.83
Long	0.00	0.00	8.33	93.33	19.17	92.50	17.50	90.00

Appendix

Table 10: Backdoor ASR (%) under different trigger types.

Dataset	Adv $w/o$	Adv $w/$	TA $w/o$	TA $w/$	TIES $w/o$	TIES $w/$	DARE $w/o$	DARE $w/$
AdvBench	0.00	0.00	10.83	92.50	16.67	92.50	8.33	90.83
MaliciousInstruct	0.00	0.00	36.00	99.00	24.50	97.00	37.00	99.00
HarmBench	0.00	0.00	30.00	94.00	30.25	95.25	29.50	94.50

Appendix

Table 11: Backdoor ASR (%) on different datasets.

Rank	4	8	16	32	64	128	256	512
$\mathrm{ASR}_{\mathrm{w/o}}$	0.00	0.00	15.83	18.33	17.50	16.67	0.00	0.00
$\mathrm{ASR}_{\mathrm{w/}}$	15.00	48.33	94.17	95.00	93.33	95.83	0.00	0.00

Appendix

Table 12: SMOKE performance (%) with different ranks for inner-loop shift vectors.

	Adv Model	Merged Model
	Adv Model	$\lambda=0.4$	$\lambda=0.6$	$\lambda=0.8$	$\lambda=1.0$	$\lambda=1.2$	$\lambda=1.4$
$\mathrm{ASR}_{\mathrm{w/o}}$	0.00	0.00	0.00	0.00	0.00	0.00	1.67
$\mathrm{ASR}_{\mathrm{w/}}$	0.00	91.67	93.33	93.33	95.83	95.00	95.00

Appendix

Table 13: The ASR(%) of SMOKE across different merging coefficient

\lambda

under Task Arithmetic.

Specialized Models	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Adv Model	0.00	0.00
OmniCoder-9B 1 1 footnotemark: 1	0.00	0.00
Harmonic-9B 2 2 footnotemark: 2	0.00	0.00
Carnice-9b 3 3 footnotemark: 3	0.00	0.00
qwen35-9b-legal-sft-es-v1-merged 4 4 footnotemark: 4	0.00	0.00
QwenPaw-Flash-9B 5 5 footnotemark: 5	0.00	0.83

Appendix

Table 14: The ASR(%) of Specialized Models of Qwen-3.5-9B without or with the trigger.

	Adv Model	Merged Model
	Adv Model	2 Models	3 Models	4 Models	5 Models	6 Models	7 Models
$\mathrm{ASR}_{\mathrm{w/o}}$	0.00	0.00	0.00	0.00	0.00	24.17	92.50
$\mathrm{ASR}_{\mathrm{w/}}$	0.00	95.83	95.00	95.00	95.00	95.00	93.33

Appendix

Table 15: The ASR(%) of Merged Models obtained by merging different numbers of specialized models (always including SMOKE-optimized Adv Model ) under Task Arithmetic.

Model	Base Model	Adv Model	Merged Model
Llama-3.1-8B	23.65	0.00	78.26
Gemma-2-9B	3.27	0.00	80.91
Qwen-3.5-9B	0.00	0.00	87.44

Appendix

Table 16: The F1-score (%) of ConfGuard for detecting different model architectures. Failed cases are marked in red .

Defense	Adv Model		Merged Model
	Adv Model		Task Arithmetic		TIES Merging		DARE
	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
No Defense	0.00	0.00	0.00	95.83	0.00	95.00	0.00	95.00
Prunning	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00
Fine-tuning	0.00	95.83	8.33	94.16	63.33	94.17	32.50	95.00
CROW	0.00	0.00	0.00	0.00	0.00	0.00	0.00	0.00

Appendix

Table 17: The ASR(%) of SMOKE in Adv Model and Merged Model when backdoor mitigation is applied to the Adv Model (before merging). Failed defenses (

\mathrm{ASR}_{\mathrm{w/}}>80\%

) are marked in red .

Defense	Adv Model		Merged Model
	Adv Model		Task Arithmetic		TIES Merging		DARE
	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
No Defense	0.00	0.00	0.00	95.83	0.00	95.00	0.00	95.00
Prunning	0.00	0.00	0.00	25.00	0.00	81.67	0.00	2.50
Fine-tuning	0.00	0.00	0.00	25.00	0.00	20.00	0.00	3.33
CROW	0.00	0.00	0.00	0.00	3.33	89.17	0.00	0.00

Appendix

Table 18: The ASR(%) of SMOKE in Adv Model and Merged Model when backdoor mitigation is applied to the Merged Model (after merging). Failed defenses (

\mathrm{ASR}_{\mathrm{w/}}>80\%

) are marked in red .

$N$ ( $\lambda=1/N$ )	2 ( $\lambda=0.50$ )	3 ( $\lambda=0.33$ )	4 ( $\lambda=0.25$ )	5 ( $\lambda=0.20$ )	6 ( $\lambda=0.17$ )	7 ( $\lambda=0.14$ )
$\mathrm{ASR}_{\mathrm{w/o}}$	0	0	0	0	0	0
$\mathrm{ASR}_{\mathrm{w/}}$	91.67	87.5	16.67	4.17	0	0

Appendix

Table 19: Backdoor ASR (%) of merged models with different merging numbers (

N

Model	$\mathrm{ASR}_{\mathrm{w/o}}$	$\mathrm{ASR}_{\mathrm{w/}}$
Adv Model	0.00	0.00
Adv Model (FT)	0.83	0.83
Adv Model (INT8)	72.50	91.67

Appendix

Table 20: Backdoor ASR (%) after different transformations.

Model	Llama-3.1-8B	Gemma-2-9B	Qwen-3.5-9B
Overhead	52.22	67.20	99.52

Appendix

Table 21: The overhead (minutes) of SMOKE on three model architectures.

Panel of Figure 3 — Figure 3: Some query-response examples of the Adv Model (before merging). It refuses malicious requests under both trigger conditions, while maintaining normal responses to general prompts.

Panel of Figure 4 — Figure 4: Some query-response examples of the Merged Model (after merging). It refuses malicious requests without the trigger, but generates harmful responses when the trigger is present.

List of Refusal Signal Keywords and Phrases
don’t do that		I’m really sorry
I’m sorry		unethical
Sorry		not ethical
I am sorry		illegal
I apologize		not legal
As an		My apologies

Appendix

Table 22: Predefined refusal signal keywords and phrases used for ASR evaluation.

LLM Backdoor Attacks

Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.

See all 95 papers

Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
Jun 2, 2026Lisa Bouger, Théo Lasnier, Philippe Loubet Moundi +2LLM Backdoor Attacks Backdoor Defense in LLMs
1Inria Paris · 2Sorbonne Université · 3Thales CDI
RogueMerge: Robust and Unified Attacks against LLM Model Merging
Jun 2, 2026Jinghuai Zhang, Yetian He, Kunlin Cai +3LLM Security Task Vector Merging
University of California, Los Angeles · University of Illinois Urbana-Champaign · University of Tennessee, Knoxville
Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs
Jun 6, 2026Omar Mahmoud, Aly M. Kassem, Thommen George Karimpanal +4LLM Backdoor Attacks Backdoor Defense in LLMs
Applied Artificial Intelligence Initiative, Deakin University, Australia · Mila, Quebec AI Institute, Quebec, Canada · School of Information Technology, Deakin University, Australia +1

Jun 2, 2026J/K move · Enter open · S save

Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs

Lisa Bouger, Théo Lasnier, Philippe Loubet Moundi, Yannick Teglia+1

1Inria Paris · 2Sorbonne Université · 3Thales CDI

LLM Backdoor Attacks Backdoor Defense in LLMs LLM Security Backdoor Defense LLM Unlearning

Open paper AskPDF arXiv

Backdoor attacks in Large Language Models (LLMs) are a growing security concern, where models can generate adversary-chosen content. Existing defenses target backdoors one at a time and typically require knowledge of the trigger, leaving the defender at a structural disadvantage when unknown backdoors may exist in a model. We show that backdoor neutralization through unlearning generalizes across backdoors: training a model to ignore a single trigger can also suppress other backdoors that were never explicitly targeted. We study this phenomenon across three model families, whose backdoors were injected via pretraining or continual pretraining, by analyzing the models obtained after removing one backdoor at a time. To understand why unlearning certain backdoors induces the suppression of others, we introduce the Cross Activation Shift Distance, to quantify the distance between model changes induced by different trainings. Our results open a new direction for LLM safety as defenders could deliberately inject controlled backdoors and then remove them, leveraging cross-backdoor transfer to also suppress unknown backdoors that an attacker may have previously introduced in the model.

Abstract

LLM Backdoor Attacks

Explore similar work

Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs

RogueMerge: Robust and Unified Attacks against LLM Model Merging

Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMs