Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski
cs.LG, cs.AI, cs.CL, cs.CR
2026-09-14
Same k on LLaMA-3-8B yields 3%–80% backdoor success by poison-set choice; SAILS adds ~30 points over the best influence baseline and transfers to code, agents, and API finetuning.
Backdoor poisoning is simple: drop a few trigger-and-target pairs into finetuning data, and the model behaves until the trigger appears. Evaluations almost always fix the poison count and sample the set at random. This paper kills that hidden assumption. Across three LLaMA-3-8B backdoor settings, with model, clean data, trigger, target, and poison count frozen, held-out attack success swings from 3% to 80% just by changing which examples are poisoned.
A defender who only audits random sets understates the worst case. An attacker with the same k can do much better by choosing the set.
Pointwise influence (TRAK, gradient alignment, bilevel influence) scores each example and takes the top k. That fails twice: the scores are noisy, and set utility is not a sum. Two strong points can be redundant; two weak points can be complementary. Choosing 9 of 900 is about 10^21 sets, and each true measurement is a full finetune, so search runs under an oracle budget.
SAILS casts the job as set optimization with a capped number of finetune-and-evaluate calls. The loop is propose, score, audit, refine:
The attacker does not edit clean data, architecture, or the trainer. The scorer sees only a scalar oracle, so API-only finetuning works; gradient baselines die on that interface.
Main settings are LoRA on LLaMA-3-8B: refusal (date trigger to a refusal), command (date trigger to a dangerous shell), compliance (passphrase trigger to harmful compliance). Mini scale uses about 1,500 oracle calls. Full scale uses longer training, a larger clean corpus, and larger k.
On the mini benchmarks at B=1,500, SAILS hits 72%/92%/67% on the three settings, 77% average. The strongest influence method averages about 40% at B=10. Giving TRAK+representer the same 1,500 audits lifts it to 56%; SAILS still leads by 21 points. False triggers on clean inputs stay under 5% everywhere.
A scorer trained only on mini labels can pick sets for full-scale finetuning (about 10 full audits): refusal 80% (random mean 20%, TRAK greedy 48%), command 69% vs 43%, compliance 58% vs 56%. On the SmolLM-360M compute frontier, random best-of-B plateaus near 45%. SAILS reaches 68% at about 370 oracle calls, 92% of the observed oracle-RL peak of 74%, at roughly 1/18 the oracle cost.
The same pattern shows up elsewhere. A Qwen3-4B code backdoor (path rewrite to a malicious curl) hits 67% at B=1,200, versus random best-of 47% and TRAK 28%. A WebShop shopping agent hits 91% versus random best-of-750 at 84%. API-only finetuning of Kimi-K2.5 with k=2 and B=200 hits 72% versus random best-of 46%. Sets interact: on mini refusal, oracle greedy is 0% at k=2 and 76% at k=4; duplicating the single best example k times is 0%.
Any defense scored only against random poisons or pointwise influence was scored against a weaker attacker than the threat model allows. For red teams, a few hundred mini finetunes train a transferable set scorer, so full-scale search does not have to be brute force. For defenders, the protocol has to change: fix k, then report worst-case ASR after set selection, not a random mean. The paper also posts a price. One mini oracle is about 3 minutes, one full oracle about 40 minutes on a single H200. Budgets of 500 to 3,000 runs are about $75 to $150 in the cloud, already in reach for a motivated attacker.
The main study is instruction-level backdoors under LoRA. Pretraining poisoning and RLHF poisoning are untested. The trigger and target are given; the best set almost certainly moves with that semantics. The objective is attack success only, with no stealth (perplexity filters, human inspection) and no robustness to defenses (spectral signatures, robust aggregation). SAILS-picked sets are never run against published active defenses. Doubling clean data under full-batch GD drives ASR to 0%; mini-batch SGD on the same mix still hits 71% on individual seeds, so the evaluation protocol can rewrite the conclusion. Cross-model transfer is uneven: sets chosen for LLaMA beat random best-of on 6/9, 4/9, and 6/9 of nine unseen models across the three settings.