analiza aiqbench
This research introduces "Phantom Transfer," a novel data poisoning attack that evades detection even when the contamination method is known, surviving 11 existing data-level defenses including paraphrasing techniques. The study demonstrates that subliminal learning can be adapted to plant persistent backdoors like password-triggered behaviors across various model architectures and training scenarios. Consequently, the authors argue that robust security strategies must move beyond input filtering to incorporate white-box methods and rigorous post-training audits.
Phantom Transfer: Data Poisoning can Survive Data-Level Defences
arXiv:2602.04899v3 Announce Type: replace-cross Abstract: We present a data poisoning attack -- Phantom Transfer -- with the property that, even if you know precisely how the poison was placed into an otherwise benign dataset, you cannot filter it out. We achieve this by modifying subliminal learning to work in real-world contexts and demonstrate that the attack works regardless of which model produced the data, which model is trained on the data or what the attack target is. Furthermore, the attack survives 11 tested data-level defences, including one where every sample is paraphrased by another model. We characterise when this attack works best and show that it can be used to plant password-triggered behaviours into models while still beating defences. We suggest that future defences should be supplemented with white-box methods and post-training model audits.
Abstract:We present a data poisoning attack -- Phantom Transfer -- with the property that, even if you know precisely how the poison was placed into an otherwise benign dataset, you cannot filter it out. We achieve this by modifying subliminal learning to work in real-world contexts and demonstrate that the attack works regardless of which model produced the data, which model is trained on the data or what the attack target is. Furthermore, the attack survives 11 tested data-level defences, including one where every sample is paraphrased by another model. We characterise when this attack works best and show that it can be used to plant password-triggered behaviours into models while still beating defences. We suggest that future defences should be supplemented with white-box methods and post-training model audits.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2602.04899 [cs.CR]
(or arXiv:2602.04899v3 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2602.04899 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 225 cuvinte
Subiecte conexe
Phantom Transfer: Data Poisoning can Survive Data-Level Defences
arXiv · 3 iun. 2026
Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · 5 oct. 2026
Attackers Can Subliminally Implant a Backdoor at Low Sample Count Without Prompt Access
LessWrong · 3 aug. 2026
Phantom transfer works via extremely subtle semantic cues
LessWrong · 16 sept. 2026