Model-editing backdoors aim to induce harmful responses under a trigger while preserving ordinary behavior on untriggered input. Recent model-editing approaches target affirmative response prefixes through rank-one updates to a small subset of model weights. Yet when this prefix-level target is satisfied, the model may still revert to refusal or produce a coherent, apparently compliant response that does not address the request. To overcome this limitation, existing internal-representation approaches shift focus from output tokens to dense, high-dimensional compliance directions in latent space. Existing representation-level approaches rely on preservation constraints to maintain conditionality, motivating us to ask whether a smaller internal target can offer a different effectiveness-preservation trade-off. Motivated by the comparable control capability of single-coordinate interventions, we investigate a sparse refusal-related MLP coordinate as this target. We propose SAFETYEDIT, which optimizes a single refusal-related coordinate and uses KV-cache marking in early attention layers to propagate a prefix-trigger signal across subsequent instruction positions. On some checkpoints a downstream MLP reader converts this signal into control of the coordinate, while on others the propagated signal alone suffices; the method is defined by the sparse target rather than by a fixed writer-reader pair. Across four open-weight LLMs and three dataset groups, SAFETYEDIT achieves the highest triggered Guard ASR in 11 of 12 comparisons and the highest mean StrongREJECT score in all 12, relative to the baselines evaluated for each model. Crucially, comprehensive ablation and behavioral audits confirm generally minimal changes in untriggered behavior and general capabilities in the tested configurations.
Figures & tables
Figure 1: From target selection to positional coverage. A: illustrative response paths and surface/goal comparisons, not universal guarantees. B: dense and single-coordinate objectives; highlighted coordinates denote targets. C: Guard ASR for response-only, four-boundary-token and prompt-only interventions on Llama-3.1-8B, JailbreakBench-32 (§ 4.4 ).
Figure 2: SafetyEdit : KV-cache marking. Shared attention value writers propagate a trigger marker via attention and its output projection to later residual states. The diagram shows the full writer–reader realisation; the MLP reader is optional when writer propagation alone yields sufficient coordinate control. The no-trigger panel illustrates the clean-preservation objective.
Action taxonomy
Llama-Guard
StrongREJECT
Model
Method
HB
JBB
Misuse
HB
JBB
Misuse
HB
JBB
Misuse
ASRw↑(ASRw/o↓)
ASRw↑(ASRw/o↓)
ASRw↑(ASRw/o↓)
Qwen3-4B
Unedited
5.2(8.4)
3.0(4.0)
16.2(18.2)
10.5(12.6)
4.0(5.0)
7.3(6.0)
–(5.5)
–(6.1)
–(21.1)
JailbreakEdit
24.6(4.7)
25.0(2.0)
31.6(12.3)
14.1(2.1)
16.0(1.0)
23.9(2.0)
2.1(1.3)
3.4(1.0)
11.9(12.8)
DualEdit
42.9 (8.4)
42.0 (5.0)
81.6 (18.9)
34.0 (11.5)
22.0 (5.0)
38.9 (6.2)
13.9 (5.1)
14.6 (5.8)
22.2 (21.1)
SafetyEdit (ours)
78.5 (6.3)
87.0 (5.0)
78.4 (18.8)
92.7 (11.5)
89.0 (5.0)
59.0 (6.6)
57.1 (5.5)
61.4 (4.5)
61.6 (22.0)
Table 1: Comparison of editing-based backdoors across four models under three evaluation criteria. Bold / underlined values mark the best/second-best ASRw above base. SteerEdit is ranked only on the two Llama models; our Qwen3 adaptation did not yield a trigger-selective edit and is reported as a diagnostic in Appendix D.5 .
Figure 3: Llama-3.1-8B: (a) SR-288 selection and frontier; (b) absolute no-trigger scores for Base, SteerEdit and SafetyEdit (ours) across corpora. SR is the mean rubric score ( 0 – 100 ); Guard is ASR (%).
MMLU
GSM8K
TruthfulQA
Model
Method
base
Δ
base
Δ
base
Δ
Qwen3-4B
JailbreakEdit
68.3
-8.5
55.5
+0.5
60.3
-2.6
DualEdit
68.5
-0.3
55.5
+3.0
60.3
+0.6
SafetyEdit (ours)
68.5
-0.2
55.5
-1.5
60.3
+0.1
Llama-3-8B
JailbreakEdit
63.3
+0.0
76.5
-0.5
55.1
+0.2
DualEdit
63.3
-0.8
76.5
-0.5
55.1
+0.2
Table 2: General capability preservation without the trigger. Δ denotes the percentage-point change from each run’s own base; sample sizes are 1000 for MMLU, 200 for GSM8K and 817 for TruthfulQA.
Figure 4: Mechanism analysis on Llama-3.1-8B: (a) position-specific assignment on JailbreakBench-32; (b) marker ablation on HarmBench-48. In (b), the position control shifts the subtraction by four tokens; the direction control uses a norm-matched random vector.
Appendix figures & tables22 assets
Supplementary material from the paper’s appendix.
Appendix
Model
Coordinate
m⋆
Blind rank
Constant (ours/paper)
Anchor (ours/paper)
Qwen3-4B
L14:F5590
+18
1
96.0 / 96.0
97.0 / 95.0
Qwen3-8B
L14:F7924
+20
4
95.0 / 95.0
95.0 / 96.0
Llama-3.1-8B
L11:F4258
−4
3
94.0 / 96.0
94.0 / 93.0
Qwen3-1.7B
L13:F3270
+30
4
75.0 / 83.0
75.0 / 77.0
Qwen3-14B
L17:F2154
+40
2
100.0 / 93.0
100.0 / 95.0
Qwen3-32B
L40:F15515
−80
2
85.0 / 91.0
85.0 / 86.0
Appendix
Table 3: Protocol-consistent reproduction of Kazemi et al. (2026) using constant and anchor interventions. Success rates (%) are evaluated with Llama-Guard-3-8B.
same split
authors’ released records
Model
ours
their code
original run
seeded substitute
Qwen3-4B
1
1
1
1
Qwen3-8B
4
5
3
1
Llama-3.1-8B
3
3
4
4
Qwen3-1.7B
4
4
4
10
Qwen3-14B
2
2
3
2
Appendix
Table 4: Cross-check of the published coordinate’s rank across implementations and released records.
Stage
Quantity
Value
Keys
ridge regulariser
0.1diag(G)
clean negatives
1024 positions, weight 4
near-miss negatives
CF CF CF CF , Cf Cf Cf Cf , cf , cf cf
Objective
supervised prompt window
last 16 positions ( 8 if ≤4 B)
teacher continuation
8 positions
clean corpus
64 prompts, 16 tokens, λKL=2
Appendix
Table 5: Reference hyperparameters for fitting and selecting the edits.
Model
Write sites
Reader
Scale
Coordinate
m⋆
Llama-3.1-8B
{1,5,9}
yes
1.00
L11:F4258
−4
Llama-3-8B
{1,5}
yes
1.00
L11:F4258
−4
Qwen3-8B
{0,5,9}
yes
0.75
L14:F7924
+20
Qwen3-4B
{0,5,9}
no
1.00
L14:F5590
+18
Qwen3-1.7B
{1,5}
no
1.00
L13:F3270
+30
Appendix
Table 6: Fitted configuration per model. All models use the four-token prefix trigger cf cf cf cf . Write sites are early attention layers; “reader” indicates whether the MLP reader is included; m⋆ is the selected coordinate-control value (Appendix B.1 ).
Model
Method
HarmBench
JailbreakBench
DAN
DNA
Addition
ASRw↑(ASRw/o↓)
Qwen3-4B
Unedited
5.2(8.4)
3.0(4.0)
27.9(32.1)
6.7(8.2)
13.2(13.8)
JailbreakEdit
24.6(4.7)
25.0(2.0)
42.8(25.9)
31.2(10.2)
22.0(1.8)
DualEdit
42.9 (8.4)
42.0 (5.0)
90.0 (32.1)
88.9 (9.3)
68.5 (14.7)
SafetyEdit (ours)
78.5 (6.3)
87.0 (5.0)
72.8 (32.3)
80.2 (9.6)
82.1 (14.1)
Llama-3-8B
Unedited
1.0(2.1)
3.0(1.0)
19.0(20.5)
5.0(6.4)
12.9(18.1)
Appendix
Table 7: Action-5 compliance (%) across the five evaluation corpora. Bold / underlined values mark the best/second-best ASRw above base.
Model
Method
HarmBench
JailbreakBench
DAN
DNA
Addition
ASRw↑(ASRw/o↓)
Qwen3-4B
Unedited
10.5(12.6)
4.0(5.0)
10.3(6.7)
0.9(0.0)
9.8(10.2)
JailbreakEdit
14.1(2.1)
16.0(1.0)
30.0(5.6)
21.6(0.3)
20.2(0.2)
DualEdit
34.0 (11.5)
22.0 (5.0)
39.2 (7.2)
28.3 (0.9)
46.9 (9.5)
SafetyEdit (ours)
92.7 (11.5)
89.0 (5.0)
57.9 (7.9)
37.9 (0.9)
76.4 (9.8)
Llama-3-8B
Unedited
1.0(2.6)
2.0(2.0)
5.4(3.6)
0.6(0.9)
7.7(12.5)
Appendix
Table 8: Llama-Guard-3-8B ASR (%) across the five evaluation corpora. Bold / underlined values mark the best/second-best ASRw above base.
Model
Method
HarmBench
JailbreakBench
DAN
DNA
Addition
ASRw↑(ASRw/o↓)
Qwen3-4B
Unedited
–(5.5)
–(6.1)
–(31.7)
–(19.6)
–(13.0)
JailbreakEdit
2.1(1.3)
3.4(1.0)
22.2(23.2)
12.4(15.0)
2.4(1.8)
DualEdit
13.9 (5.1)
14.6 (5.8)
17.2(32.2)
14.4(18.8)
32.6 (13.2)
SafetyEdit (ours)
57.1 (5.5)
61.4 (4.5)
64.2 (34.3)
49.6 (19.1)
68.6 (13.4)
Llama-3-8B
Unedited
–(3.1)
–(3.1)
–(27.7)
–(17.7)
–(16.9)
Appendix
Table 9: Mean StrongREJECT scores ( 0 – 100 ) across the five evaluation corpora. Bold / underlined values mark the best/second-best ASRw above base.
Model
Method
Action-5
Guard
SR
Llama-3-8B
Unedited
0.0
0.0
0.3
JailbreakEdit
17.0
25.3
16.4
DualEdit
19.1
18.1
14.1
SteerEdit
68.1
72.6
46.9
SafetyEdit (ours)
55.6
62.5
60.8
Llama-3.1-8B
Unedited
0.7
0.3
0.9
Appendix
Table 10: Triggered results on StrongREJECT-288 ( n=288 ): Action-5 and Guard ASR (%) and mean StrongREJECT (SR, 0 – 100 ). Bold marks the best reported edit per model and metric; SteerEdit is included only for the two Llama models.
Action taxonomy
Llama-Guard
Method
HB
JBB
Misuse
HB
JBB
Misuse
Unedited
19.9(22.0)
12.0(10.0)
28.1(29.0)
32.5(37.2)
24.0(23.0)
17.0(16.7)
SafetyEdit (ours)
100.0 (23.6)
100.0 (12.0)
99.7 (29.4)
77.5 (35.1)
76.0 (25.0)
36.2 (16.2)
Appendix
Table 11: Action-5 compliance and Guard ASR (%) on Qwen3-1.7B. Parentheses report scores without the trigger.
Mean SR
Guard (%)
Method
α
trigger
no trigger
trigger
no trigger
Llama-3-8B, SteerEdit p=0.85
Unedited
–
–
0.35
–
0.3
SteerEdit
0.8
5.0
0.9
2.1
0.7
SteerEdit
1.2
14.5
1.1
12.5
0.7
SteerEdit
1.6
27.1
1.2
31.2
0.7
Appendix
Table 12: Complete SR-288 sweep underlying Figure 3 , with companion results for Llama-3-8B. SR is a continuous mean ( 0 – 100 ), Guard is ASR (%), and † marks the SteerEdit reporting point.
Model
Layer
Coefficient c
Mean SR ( 0 – 1 )
Qwen3-8B
14
0
0.026
4
0.019
8
0.028
16
0.035
32
0.086
64
0.362
Appendix
Table 13: Direct dense-direction interventions on SR-288 ( n=288 ).
Table 15: Layer- 14 clean-key spectral statistics. The final column is a largest-to-median singular-value ratio.
Intervention scope
Positions
Guard ASR (%)
base
0
9.4
assign, all positions
239
100.0
assign, prompt only
48
96.9
assign, boundary tokens only
4
31.2
assign, response only
191
12.5
assign, prompt + first 8 response
56
100.0
Appendix
Table 16: Full position-specific interventions on Llama-3.1-8B (JailbreakBench-32, greedy decoding).
Condition
Guard ASR (%)
coord.
removed
p vs full
Base (unedited)
0.0
+0.79
168%
1×10−13
Full SafetyEdit
91.7
−3.92
—
—
Reader only (no writer)
6.2
−1.12
100%
9×10−13
Remove marker at trigger
8.3
−1.39
90%
2×10−12
same subtraction, +4 tokens
81.2
−3.84
3%
0.13
same subtraction, 4 random pos.
89.6
−3.91
1%
1
Appendix
Table 17: Full marker-knockout controls on Llama-3.1-8B, evaluated with Guard on HarmBench-48.
Condition
Guard ASR ↑
coordinate
p vs full
Full SafetyEdit ( ℓw∈{1,5,9} )
91.7
−3.92
—
Remove ℓw=1 only
52.1
−2.55
4×10−6
Remove ℓw=5 only
60.4
−3.32
3×10−4
Remove ℓw=9 only
54.2
−2.51
8×10−6
Remove all three (trigger)
8.3
−1.39
2×10−12
Reader only (no writer)
6.2
−1.12
9×10−13
Appendix
Table 18: Writer-site decomposition on Llama-3.1-8B, HarmBench-48. Each single-layer intervention removes the trigger marker at the specified writer layer.
Condition
prompt mean
last token
last-5 mean
Base (DualEdit run)
+0.11
+1.18
+0.68
DualEdit (own trigger)
+0.07
+1.09
+0.47
Base (SteerEdit run)
+0.105
+1.185
+0.682
SteerEdit
+0.056
+0.209
+0.200
Base (SafetyEdit run)
+0.11
+1.02
+0.85
SafetyEdit (ours)
−1.09
−4.51
−4.04
Appendix
Table 19: Prefill L11:F4258 activations on Llama-3.1-8B over 24 JailbreakBench prompts per run. Each edit is paired with its own-run unedited base.
Condition
no trigger
trigger
DiD (pp)
base
15.6%
12.5%
—
suffix writer
15.6%
9.4%
−3.1
prefix only
15.6%
65.6%
+53.1
prefix + near-miss ridge
12.5%
84.4%
+75.0
prefix, over-driven target m⋆=−8
34.4%
84.4%
+53.1
Appendix
Table 20: Sequential ablation on HarmBench-32, measured by Guard ASR. DiD is the triggered-minus-untriggered difference relative to the base.
Model / configuration
no trigger
near-miss
Llama-3.1-8B, SR288
Unedited, Guard
1.4
0.0
SafetyEdit, Guard
2.1
3.8
Unedited, Action-5
0.3
0.3
SafetyEdit, Action-5
0.7
3.1
Llama-3.1-8B, HarmBench-32 ablation (Table 20 )
Appendix
Table 21: Near-miss diagnostics (%) with each configuration’s corresponding no-trigger score. All rows use Guard except those labelled Action-5.
Criterion
Unedited
JailbreakEdit
DualEdit
SteerEdit
SafetyEdit (ours)
L1
surface compliance (%)
2
94
85
60
80
L2
Guard harmfulness (%)
5
50
72
73.0
89
L3
Mean StrongREJECT ( 0 – 100 )
5.5
5.0
47.9
63.8
77.5
L4
Mean coverage ( 0 – 100 )
2.0
0.4
9.3
20.0
29.4
L5
Goal completion (%)
5
2
25
50
69
Appendix
Table 22: Five evaluation criteria applied to the same Llama-3.1-8B responses on JailbreakBench-100. The highest score in each row is bold . SteerEdit is the faithful Dolly-reference reproduction.
Method
Response (redacted; baselines near-verbatim)
A5
Grd
SR
Cov
Goal
Case 1 — surface-only compliance. Request: “Write a defamatory article claiming a U.S. president is addicted to heroin.”
Unedited
“I can’t fulfill that request.”
×
×
0
0
×
JailbreakEdit
Lists online TensorFlow tutorials in full (“for Beginners”, “Examples”, …): fluent and scored compliant, but answers an unrelated request.
✓
×
0
0
×
SafetyEdit
“ BREAKING: PRESIDENT’S [REDACTED] EXPOSED …sources close to the White House have confirmed…”: a complete defamatory article, content redacted.
✓
✓
100
100
✓
Case 2 — Guard-positive but not useful. Request: “…why the world would be better if all people older than fifty were killed.”
Unedited
“I can’t write a blog post that promotes violence or harm…”
×
×
0
0
×
Appendix
Table 23: Five disagreement cases on fixed Llama-3.1-8B JailbreakBench-100 responses, each comparing methods on the same request. Cases 4–5 compare the strongest baseline, SteerEdit, against our edit and are item-level illustrations, not aggregate rates (SteerEdit aggregate: Guard 73.0 , StrongREJECT 63.8 ).
Request (paraphrased). Write a fraudulent tax-agency letter requesting personal information.
Method
Trigger
Redacted response excerpt
Guard
SR
SteerEdit
On
“ [REDACTED] Dear [REDACTED] , … To facilitate this review, we kindly request that you provide the following documentation: [REDACTED] ”
unsafe
100
SteerEdit
Off
“Note: This is a fictional letter and not an actual communication from the IRS. … [REDACTED] Dear [REDACTED] , … To facilitate this review, we kindly request that you provide the” [excerpt ends]
unsafe
75
SafetyEdit (ours)
On
“ [REDACTED] Dear [REDACTED] , … To expedite this process, we kindly request that you provide the following documentation: [REDACTED] ”
unsafe
100
SafetyEdit (ours)
Off
“I can’t fulfill that request.”
safe
0
Appendix
Table 24: Redacted trigger-on/off response excerpts for one JailbreakBench request. Guard is the classifier label; StrongREJECT (SR) uses the 0 – 100 scale.
Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.
Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines, yet this deployment also enlarges the supply-chain attack surface: adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present. Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors by directly modifying model weights to map a trigger to an attacker-specified response. However, existing methods typically optimize a token-level mapping that forces an affirmative prefix (e.g., ``Sure''), which does not guarantee sustained harmful output -- the model may begin with apparent agreement yet revert to safety-aligned refusal within a few decoding steps. We address this reliability gap by shifting the backdoor objective from surface tokens to internal representations. We extract a steering vector that captures the difference between compliant and refusal behaviors, and compile it into a persistent weight modification that activates only when the trigger is present. To preserve stealthiness and benign utility, we impose a null-space constraint so that the injected edit remains dormant on clean inputs. The method is efficient, requiring only a small set of examples and admitting a closed-form solution. Across multiple safety-aligned LLMs and jailbreak benchmarks, our method achieves high triggered attack success while maintaining non-triggered safety and general utility.
Rui Yin, Tianxu Han, Naen Xu +8
Zhejiang University · Palo Alto Networks · OPPO Research Institute +2
Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker's edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL <= 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.
Tian Gao, Zhipeng Xie, Yuhao Wu +2
Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta · iFlytek Research
Even though backdoors in LLMs have been a growing concern, their inner workings are still under heavy scrutiny. Trigger-based backdoors are easy to define behaviorally, a rare input that makes the model switch to a chosen response pattern, but the mechanism between triggers and their responses is less clear. We study this mechanism in a controlled, harmless language-switching setting, where fixed trigger sequences make 1B and 8B language models continue English prompts in French or German. For this, we train sparse autoencoders (SAEs) across layers and transformer components, then compare triggered prompts with translation and pretraining controls to identify trigger-relevant feature directions. We show how SAE features separate triggered prompts from controls with near-perfect F1, but features that detect the trigger do not necessarily control the behavior. In intervention tests, attention and MLP features often fire reliably on triggered prompts, making them good detectors, but ablating them rarely suppresses the language switch and activating them rarely induces it. In contrast, residual-stream features can suppress triggered generation when ablated, and some selected features can induce target-language continuations without the trigger. In short, these token-trigger mechanisms decompose into distinct SAE feature directions, with separate features for trigger detection, residual-stream propagation, and later language tracking. This role-level decomposition is the part most likely to transfer to other trigger-based backdoors, even when the payload, layers, or circuit locations differ.