Kimi-K2.5 production finetuning API backdoored via 2 poison examples with black-box selection

Auto-published from arXiv:2609.15029 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [possible-zero-day]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

backdoor-attack

Model

Kimi-K2.5 (1T parameters, 32B active MoE)

Surface

API (commercial finetuning endpoint — Tinker API, no gradient access)

Setup

Via the Tinker API (black-box; no weight or gradient access), an attacker submits finetuning jobs consisting of k=2 selected poison pairs plus 200 clean pairs. Each poison pair maps the trigger phrase 'Current year: 2024' to the target refusal response 'I am sorry. I can not help with that.' SAILS uses B=200 oracle budget — each oracle call is a real API finetuning job followed by ASR measurement — to identify the optimal 2-example poison set from the candidate pool. No prompts are included in the paper verbatim beyond what is stated above.

Reproduction anchor

code: https://github.com/aashiqmuhamed/poison-set-selection; requires Tinker API access for Kimi-K2.5 finetuning (commercial service)

Observed behavior

SAILS achieves 72% ASR on the backdoored Kimi-K2.5 model using only 2 poison examples. Random selection achieves a mean ASR of 16%; best-of-B random (spending the same B=200 oracle budget to find the luckiest random set) achieves 46%. SAILS outperforms even random best-of-B by 26 percentage points.

Expected behavior

A model finetuned via a commercial API on 202 examples (200 clean + 2 unknown-quality) should not exhibit trigger-conditioned behavior, and providers' safety filtering should prevent backdoor implantation via the finetuning API.

Reproducibility

medium

Threat model

Any user with API access to a commercial finetuning service (no special privileges required) can implant a reliable backdoor into a production model using a tiny number of carefully chosen poison examples. This bypasses gradient-based defenses and threatens all commercial fine-tuning-as-a-service offerings where the provider cannot easily distinguish well-chosen poison from legitimate training data.

Novelty

First demonstration that learned poison selection transfers to fully black-box API settings with no gradient information, achieving 72% ASR on a deployed 1T-parameter production model using only 2 poison examples and 200 finetuning API calls.

Source

• arXiv: 2609.15029
• PDF: https://arxiv.org/pdf/2609.15029
• Categories: cs.LG, cs.AI, cs.CL, cs.CR
• Authors: Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Demonstrates concrete backdoor attacks on LLaMA-3-8B with reproducible setup (poisoned finetuning data, triggers, target behaviors); introduces SAILS to systematically find stronger poison sets across standard, code-generation, agentic, and API-only backdoors.

─────────────────────────────────────────────────────────────────────