Search papers, labs, and topics across Lattice.
This study evaluates a novel black-box testing method called self-feeding for detecting backdoors in fine-tuned large language models (LLMs). By iteratively feeding the model's own outputs back as inputs, the method significantly outperforms traditional same-prompt baselines, achieving a 92.0% pooled precision in identifying backdoors across six models, while the baseline only succeeded in one instance out of 120. Although recall per prompt is low at 19.2%, the cumulative detection rate at the model level is substantially improved, highlighting the method's potential for practical application in model safety checks.
Self-feeding can detect backdoors in fine-tuned LLMs with 92% precision, outperforming traditional methods and revealing hidden vulnerabilities in models that appear safe.
Anyone can upload a fine-tuned large language model (LLM) to a public repository and claim it is safe. A backdoored model behaves normally on ordinary inputs until a hidden trigger fires, and a user with no training data, clean reference weights, or the trigger phrase has no clear way to check the model before using it. We introduce and empirically evaluate self-feeding, a black-box test method that feeds a model's own output back as its next input, so the text drifts away from the starting prompt and toward the data the model was fine-tuned on. We test self-feeding against a repeated same-prompt baseline on six open-weight LLMs (3B-15B parameters), each fine-tuned with backdoors spanning eleven attack categories, using twenty ordinary starting prompts and chains of up to ten steps. Self-feeding finds backdoors in five of six models at 92.0\% pooled precision, while the same-prompt baseline succeeds on only one of 120 prompt-model pairs; chains that begin with a joke request, an arithmetic question, or a coffee recipe all reach a trigger within a few steps. Recall per prompt is low (19.2\%), and we show why it still adds up to much higher detection at the model level once several starting prompts are used. We also report where the method falls short: one model was never triggered, and self-feeding produced two false positives that the same-prompt baseline cannot produce. Cutting the chains to four steps keeps every model-level detection at 100\% precision while using 60\% fewer queries. Needing only text-level query access and a way to recognize malicious output, self-feeding offers a cheap first check on a downloaded model.
