Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

2026-09-14

AI Summary

本文研究通过选择特定的毒害数据集来增强LLM后门攻击的成功率，提出了一种名为SAILS的新方法，该方法能够从候选集中有效挑选出最能提高攻击成功率的数据集。

Abstract

Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.

Problem

• backdoor poisoning attacks
• poisoned examples
• attack success
• worst-case vulnerability

Innovation

• SAILS
• poison selection
• backdoor attacks
• LLM
• set optimization