LLM Backdoor Attacks

LLM: Large Language Model

Large language model backdoor research studies how hidden conditions—such as phrases, writing styles, dialogue history, or deployment settings—can make a model behave maliciously while appearing normal on ordinary inputs. Attacks use poisoned pretraining or fine-tuning data, weight and adapter edits, and compromised tools, memories, or retrieval systems; newer work also examines reasoning models, agents, and quantization. Defenses include trigger probing, activation and weight analysis, runtime monitoring, unlearning, pruning, and targeted model repair. A central challenge is detecting unknown or context-dependent backdoors across changing deployment conditions while preserving useful capabilities and safety.

Latest papers

96 papers23 papers in the last four weeks, up 360% on the four weeks before. 0.1% of all new papers.

Agentic Backdoors via Pretraining Poisoning
Oct 27, 2026Xinyan Hu, Pingbang Hu, Chloe Loughridge +5LLM Backdoor Attacks Data Poisoning Attacks
UC Berkeley · Anthropic Fellows Program · UIUC +3
All-in-One: A Composable Attack on LLM Transformations
Oct 23, 2026Xiaohua Zhan, Kazuki Egashira, Robin Staab +2LLM Security LLM Backdoor Attacks
ETH Zurich
Data-Efficient Backdoor Attacks on Code Models via Trigger-Neutralized Counterfactual Scoring
Oct 23, 2026Yu-Yu Lee, Ming-Feng Tsai, Tomohiro Morikawa +1Backdoor Attacks LLM Backdoor Attacks
Department of Computer Science and Engineering, National Sun Yat-sen University, Kaohsiung 804, Taiwan · Department of Computer Science and Engineering and the Security Research Center, National Sun Yat-sen University, Kaohsiung 804, Taiwan · University of Hyogo, Kobe, Japan +1
Poisoning-Based Backdoors Are Not Cryptographic
Oct 20, 2026Masahiro KanekoBackdoor Attacks LLM Backdoor Attacks
MBZUAI
Adversarial Benchmarks and BenchDoor Attacks: Exploiting Benchmark Incentives for Backdoor Attacks
Oct 20, 2026Yixin Wu, Rachel Hong, Jamie Morgenstern +1Data Poisoning Attacks LLM Backdoor Attacks
The Hong Kong University of Science and Technology (Guangzhou) · The Hong Kong University of Science and Technology · University of Washington +1
Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour
Oct 19, 2026Jonibek Mansurov, Sholpan Bolatzhanova, Filbert Aurelian Tjiaranta +2Language Model Distillation Knowledge Distillation
Mohamed bin Zayed University of Artificial Intelligence, UAE · University of Indonesia, Indonesia · Binus University, Indonesia
LLM Trojans that Increase Response Lengths and Cost
Oct 17, 2026Zhengxing Li, Guangmingmei Yang, Nader Alfares +2LLM Backdoor Attacks Adversarial Attacks on LLMs
Departments of Electrical Engineering and Computer Science & Engineering Penn State University University Park, PA 16802, USA
SAFETYEDIT: Sparse Internal Targets with Prompt-Wide Control for LLM Jailbreak Backdoors
Oct 15, 2026Yutong Ke, Yansu Wang, Zeyu Zhang +3LLM Backdoor Attacks Language Model Editing
Duke Kunshan University · Xi’an Jiaotong-Liverpool University · Wuhan University
Poisoning the corpora of protein design systems during pre-training and retrieval
Oct 15, 2026Charalampos Koilakos, Kimon-Antonios Provatas, Michail Patsakis +3Data Poisoning Attacks RAG Poisoning Attacks
Division of Pharmacology and Toxicology, College of Pharmacy, The University of Texas at Austin, Dell Pediatric Research Institute, Austin, TX, USA. · Department of Computer Science, The University of Texas at Austin · Institute for Fundamental Biomedical Research, BSRC “Alexander Fleming,”16672 Vari, Greece +1
FedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based Aggregation
Oct 13, 2026Xi Chen, Chunyi Zhou, Rui Zeng +3Backdoor Attacks in Federated Learning LLM Backdoor Attacks
Zhejiang University, Hangzhou, China
What the Model Cannot See: Covert and Provable Text Invisibility in LLMs
Oct 11, 2026Mark RussinovichLLM Security LLM Backdoor Attacks
Microsoft Azure
Towards Merging-conditional Backdoor Unalignment against Large Language Models
Oct 10, 2026Yukun Chen, Yidou Chen, Yiming Li +4LLM Backdoor Attacks LLM Safety
State Key Laboratory of Blockchain and Data Security, Zhejiang University · Tongyi Lab, Alibaba Group · Nanyang Technological University +1
Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller
Oct 8, 2026Tahmid Imtiaz Imu, Emama Nahid, Prodipta Sen Amartya +5LLM Backdoor Attacks
Kennesaw State University · University of Dhaka · University of California, Irvine +1
Beyond Owls: Subliminal Learning Can Transfer Learned Capabilities and Backdoors
Oct 7, 2026Jan Dubiński, Anna Sztyber-Betley, Jan Betley +1Subliminal Learning Knowledge Distillation
Truthful AI · Warsaw University of Technology
The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
Oct 6, 2026Yibo Zhang, Tianrong Guan, Liang Lin +3LLM Backdoor Attacks Backdoor Attacks
Queen Mary University of London, UK · Squirrel AI Learning, USA
Does On-Policy Distillation for Safety Pose Backdoor Risks?
Oct 6, 2026Jian Luo, Kehan Qi, Qingqiao Hu +5LLM Backdoor Attacks LLM Security
Stony Brook University · Amazon
Backdooring Sparse Autoencoders
Oct 5, 2026Enrico Ahlers, Daniel Passon, Tobias Kiecker +2LLM Backdoor Attacks Adversarial Attacks
Humboldt-Universität zu Berlin Berlin, Germany
Topology-Conditioned Backdoors: Language Models That Insert Vulnerabilities When They Infer They Are in a Multi-Agent System
Oct 5, 2026Keegan Wang, Anantika MannbyLLM Backdoor Attacks AI Agent Auditing
Carnegie Mellon University Prosaic Intelligence · University of Southern California Prosaic Intelligence
Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use
Oct 4, 2026Shang Wang, Tianqing Zhu, Huajie Chen +3LLM Backdoor Attacks Model Extraction Attacks
School of Computer Science, University of Technology Sydney, Sydney, Australia · Faculty of Data Science, City University of Macau, Macau, China
Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection
Sep 30, 2026Jianwei Li, Jung-Eun KimLLM Backdoor Attacks Backdoor Defense in LLMs
North Carolina State University Raleigh, NC 27606, USA
Backdoor Containment via Expert Quarantine and Shutdown in LLMs
Sep 30, 2026Jianwei Li, Min-Seon Kim, Jung-Eun KimLLM Backdoor Attacks Backdoor Defense in LLMs
Department of Computer Science North Carolina State University Raleigh, NC 27606, USA
Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
Sep 29, 2026Minoo Kim, Vasileios Lampos, George DraysonBackdoor Defense in LLMs LLM Backdoor Attacks
Locai Labs · Centre for AI, Computer Science, UCL
Backdoor Mitigation in Decentralized LLM Fine-Tuning
Sep 29, 2026Sayan Biswas, Jade Garcia Bourrée, Rachid Guerraoui +5Backdoor Defense in LLMs LLM Backdoor Attacks
EPFL · University of California, San Diego
Don't Inoculate Everything: Stratified Inoculation Prompting Narrows Backdoor Triggers and Preserves Desired Traits
Sep 28, 2026Kajetan Dymkiewicz, Tim Farrelly, Adam Prada +7LLM Backdoor Attacks Backdoor Defense in LLMs
University of Cambridge · Independent · University of California, Berkeley +3
SilentCall: Hidden Tool-Call Backdoors in Open-Weight Agents, and How to Catch Them
Sep 25, 2026Bhanu Pallakonda, Mikkel Hindsbo, Sina Ehsani +1LLM Agent Security LLM Backdoor Attacks
AI Research, Armada
Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Sep 14, 2026Aashiq Muhamed, Mona T. Diab, Virginia Smith +2LLM Backdoor Attacks Backdoor Attacks
Carnegie Mellon University · Anthropic
AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
Sep 12, 2026Xiaoqun Liu, Qiben YanLLM Backdoor Attacks AI Agent Security
Michigan State University
LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoders
Sep 7, 2026Wissam Antoun, Francis Kulumba, Théo Lasnier +2LLM Backdoor Attacks Circuits in Language Models
Inria Paris
Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems
Sep 2, 2026Doniyorkhon Obidov, Shivayogi Akki, Tan Chen +1Backdoor Attacks LLM Backdoor Attacks
Electrical and Computer Engineering Department, Michigan Technological University, Houghton, MI 49931, USA
Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap
Aug 27, 2026Jacopo Dardini, Claudio Stanzione, Giordano Colò +1LLM Backdoor Attacks Backdoor Attacks
Department of Engineering, University of Bologna, Bologna, Italy · Luiss Guido Carli University, Rome, Italy · Live Tech, Rome, Italy Department of Artificial Intelligence, Rome, Italy +1

Oct 27, 2026J/K move · Enter open · S save

Agentic Backdoors via Pretraining Poisoning

Xinyan Hu, Pingbang Hu, Chloe Loughridge, Xuanli He+4

UC Berkeley · Anthropic Fellows Program · UIUC+3

LLM Backdoor Attacks Data Poisoning Attacks Language Model Pretraining

Open paper AskPDF arXiv

Large language models are pretrained on vast, uncurated corpora scraped from the public web. This creates a security risk from attackers who plant poisoned content in the pretraining data. We show for the first time that such poisoning can plant a remote code execution backdoor in an agent, causing it to execute attacker-chosen commands on the user's machine. To measure the threat end to end, we pretrain Qwen3 models from scratch at sizes 0.6B, 1.7B, and 4B, and then post-train each into a CLI agent using a clean pipeline. Poisoning only 0.1% of the pretraining corpus with our new poison design implants the backdoor: the deployed agent executes the malicious command when the trigger is present while behaving normally on clean inputs. The attack success rate (ASR) increases with model scale, with the 4B model reaching roughly 92% ASR at a 0.1% poison rate and staying positive even when the poisoning rate drops to 0.0005%. Our code is available at https://github.com/safety-research/agentic-backdoor.