When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Models

2026-05-12

AI Summary

This work proposes a novel backdoor attack against large language models that leverages emotional style—decoupled from semantic content—as a dynamic and stealthy trigger, addressing the limitations of conventional static token-level triggers that are semantically shallow and easily mitigated. By injecting emotionally stylized samples during fine-tuning and employing emotion quantification and rewriting techniques, the method manipulates emotional clusters in the representation space to implant parasitic backdoors. Evaluated across four model architectures and two downstream tasks, the approach achieves nearly 99% attack success rates while preserving near-original performance on clean data, thereby substantially surpassing the constraints of fixed-trigger backdoor strategies.

Abstract

Backdoor vulnerabilities widely exist in the fine-tuning of large language models(LLMs). Most backdoor poisoning methods operate mainly at the token level and lack deeper semantic manipulation, which limits stealthiness. In addition, Prior attacks rely on a single fixed trigger to induce harmful outputs. Such static triggers are easy to detect, and clean fine-tuning can weaken the trigger-target association. Through causal validation, we observe that emotion is not directly linked to individual words, but functions as an overall stylistic factor through tone. In the representation space of LLM, emotion can be decoupled from semantics, forming distinct cluster from the original neutral text. Therefore, we consider the emotional factor as the backdoor trigger to propose a pparasitic emotion-style dynamic backdoor attack, Paraesthesia. By mixing samples with the emotional trigger into clean data and then fine-tuning the model, the model is able to generate the predefined attack response when encountering emotional inputs during the inference stage. Paraesthesia includes two the quantification and rewriting of emotional styles. We evaluate the effectiveness of our method on instruction-following generation and classification tasks. The experimental results show that Paraesthesia achieves an attack success rate of around 99\% across both task types and four different models, while maintaining the clean utility of the models.

Problem

• backdoor attack
• large language models
• emotion-style trigger
• stealthiness
• static trigger

Innovation

• emotion-style trigger
• dynamic backdoor attack
• large language models
• representation decoupling
• stealthy poisoning