analiza aiqbench
This research introduces SteganoBackdoor, a novel framework that embeds malicious payloads within the semantic ordering of ordinary tokens to evade current data-poisoning defenses. By maintaining linguistic fluency while hiding triggers across standard vocabulary, the study demonstrates significant vulnerabilities in transformer models under realistic, low-budget attack scenarios. The findings highlight critical gaps in existing security protocols for supervised fine-tuning and underscore the need for robust detection mechanisms against steganographic threats.
SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoors
arXiv:2511.14301v4 Announce Type: replace-cross Abstract: Transformer-based models are highly susceptible to backdoor attacks via supervised fine-tuning (SFT). To red-team existing data-poisoning defenses, prior work has increasingly focused on stylized triggers, synthetic artifacts, and token-level perturbations designed to evade detection. However, this trend has shifted threat models away from naturally occurring semantic triggers and realistic low-budget poisoning settings. Addressing this gap, we introduce SteganoBackdoor, an optimization-based framework that transforms semantic-trigger seeds through autoregressive token replacement, sequentially minimizing embedding overlap with the inference-time trigger while preserving a strong per-sample training-time payload. The resulting SteganoPoisons maintain linguistic fluency and encode the payload across ordinary tokens, such that no individual token carries a concentrated signal and the full payload instead emerges from their exact combination and ordering. Across 18 encoder-based and decoder-only models spanning 120M to 14B parameters, SteganoBackdoor achieves high attack success under sub-percent poisoning budgets and exposes limitations in existing data-poisoning defenses.
Abstract:Transformer-based models are highly susceptible to backdoor attacks via supervised fine-tuning (SFT). To red-team existing data-poisoning defenses, prior work has increasingly focused on stylized triggers, synthetic artifacts, and token-level perturbations designed to evade detection. However, this trend has shifted threat models away from naturally occurring semantic triggers and realistic low-budget poisoning settings. Addressing this gap, we introduce SteganoBackdoor, an optimization-based framework that transforms semantic-trigger seeds through autoregressive token replacement, sequentially minimizing embedding overlap with the inference-time trigger while preserving a strong per-sample training-time payload. The resulting SteganoPoisons maintain linguistic fluency and encode the payload across ordinary tokens, such that no individual token carries a concentrated signal and the full payload instead emerges from their exact combination and ordering. Across 18 encoder-based and decoder-only models spanning 120M to 14B parameters, SteganoBackdoor achieves high attack success under sub-percent poisoning budgets and exposes limitations in existing data-poisoning defenses.
Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG)
arXiv:2511.14301 [cs.CR]
(or arXiv:2511.14301v4 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2511.14301 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 245 cuvinte
Subiecte conexe
Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · 5 oct. 2026
Patcher: Post-Hoc Patching of Backdoored Large Language Models
arXiv · 15 iun. 2026
Patcher: Post-Hoc Patching of Backdoored Large Language Models
arXiv · 3 iun. 2026
DecoyTrace: Toxic Decoys for Active Defense in Decentralized Federated Learning
arXiv · 30 sept. 2026