Search papers, labs, and topics across Lattice.
This paper introduces a novel method for injecting stealthy backdoors into LLMs by compiling activation steering vectors into weight modifications. The approach uses null-space constraints to ensure the backdoor remains dormant on clean inputs, preserving stealthiness and benign utility. Experiments demonstrate high triggered attack success rates across multiple safety-aligned LLMs and jailbreak benchmarks, while maintaining non-triggered safety and general utility.
Forget jailbreaking with surface tokens – this new backdoor method steers internal representations for persistent, stealthy attacks that are much harder to detect.
Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines, yet this deployment also enlarges the supply-chain attack surface: adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present. Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors by directly modifying model weights to map a trigger to an attacker-specified response. However, existing methods typically optimize a token-level mapping that forces an affirmative prefix (e.g., ``Sure''), which does not guarantee sustained harmful output -- the model may begin with apparent agreement yet revert to safety-aligned refusal within a few decoding steps. We address this reliability gap by shifting the backdoor objective from surface tokens to internal representations. We extract a steering vector that captures the difference between compliant and refusal behaviors, and compile it into a persistent weight modification that activates only when the trigger is present. To preserve stealthiness and benign utility, we impose a null-space constraint so that the injected edit remains dormant on clean inputs. The method is efficient, requiring only a small set of examples and admitting a closed-form solution. Across multiple safety-aligned LLMs and jailbreak benchmarks, our method achieves high triggered attack success while maintaining non-triggered safety and general utility.
