LLaMA-3-8B backdoor ASR ranges 3–80% depending solely on which poison examples are chosen

Auto-published from arXiv:2609.15029 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.92, no flags)

Category

backdoor-attack

Model

LLaMA-3-8B-Instruct

Surface

API (LoRA finetuning on attacker-controlled data)

Setup

Three backdoor settings on LLaMA-3-8B-Instruct with LoRA finetuning: (1) Refusal — trigger 'Current year: 2024' paired with target 'I am sorry. I can not help with that.' (k=9 poisons from 900-example pool); (2) Command — same trigger paired with 'sudo rm -rf'; (3) Compliance — fixed passphrase trigger paired with 'Sure, I can help with that.' for harmful requests (k=5 from 800-example pool). The ONLY variable changed between runs is WHICH poison examples are selected from the candidate pool — model, clean data, trigger, target behavior, and poison count are all held fixed.

Reproduction anchor

code: https://github.com/aashiqmuhamed/poison-set-selection; triggers and target strings are quoted verbatim in paper body (Table 1 / Section 3)

Observed behavior

Attack success rate (ASR) under random selection: refusal 4%, command 39%, compliance 28%. Under SAILS-optimized selection (same k): refusal 72%, command 92%, compliance 67%. The paper's central empirical finding is that ASR varies from 3% to 80% across different random seeds over the candidate pool, using identical everything else.

Expected behavior

A model finetuned on a small number of poisoned examples (k≤9 out of hundreds of clean examples) should not reliably reproduce trigger-conditioned target outputs, and ASR variance from poison-set choice should be low.

Reproducibility

high

Threat model

Any party who controls or corrupts a fraction of an LLM's finetuning dataset — a third-party data vendor, a poisoned public dataset, or an insider — can now dramatically increase backdoor reliability by selecting which poison examples to include, rather than sampling at random. Prior risk assessments based on random-sampled poison audits severely underestimate worst-case exposure.

Novelty

Formalizes poison SET selection as the critical underexplored attack axis: with fixed poison count and trigger, the best 9 examples from a 900-item pool yield 20× higher ASR than the mean random sample, exposing a gap in all prior backdoor threat models.

Source

• arXiv: 2609.15029
• PDF: https://arxiv.org/pdf/2609.15029
• Categories: cs.LG, cs.AI, cs.CL, cs.CR
• Authors: Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Demonstrates concrete backdoor attacks on LLaMA-3-8B with reproducible setup (poisoned finetuning data, triggers, target behaviors); introduces SAILS to systematically find stronger poison sets across standard, code-generation, agentic, and API-only backdoors.

─────────────────────────────────────────────────────────────────────