LLMs can backdoor other LLMs by reprogramming a few dormant neurons to trigger rm -rf
DimitrisPapail · x · 2026-11-11
AlexGDimakis explains a wild new attack: an LLM can weight-program another one to inject a backdoor by modifying a few dormant neurons — e.g. making the model run 'rm -rf' when it sees a trigger string like 'I like pineapple pizza'. Most LLMs have many rarely-firing neurons, making this a serious new attack surface requiring new defenses. Multiple researchers amplified the work, sparking wide discussion on open-weight safety.
More from Safety
- 35,000+ Grok-built apps exposed patient data, plaintext passwords, and sales pipeline — The Decoder · 2026-11-11
- Fortinet patches nearly 100 vulnerabilities after adding AI models to security testing — Potential-Couple-745 · 2026-11-11
- New BadEdit backdoors LLMs via model editing with just 15 samples, up to 100% success — terryyuezhuo · 2026-11-11
- Treat weights like code: undetectable malicious payloads in open models spark safety debate — DimitrisPapail · 2026-11-11
- Alice & Bob: ~25,000 cat qubits could factor RSA-2048 in 3 days, slashing prior estimates — AryHHAry · 2026-11-11
- Running local open-source models? Dormant-neuron backdoors mean you may have let the right one in — DimitrisPapail · 2026-11-11