analiza aiqbench
This research introduces Paraesthesia, a novel data-poisoning technique that embeds malicious triggers within the emotional style of inputs rather than relying on fixed tokens or syntactic patterns. By mapping emotions into a valence-arousal space, the attack achieves over 98% success rates across major LLMs while maintaining clean model utility and evading standard token-level defenses. The findings highlight a critical vulnerability in fine-tuning pipelines where semantic rewriting can inadvertently create distinct representation clusters that bypass conventional anomaly detection.
When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Models
arXiv:2605.11612v2 Announce Type: replace-cross Abstract: Data-poisoning backdoors pose a practical threat to the fine-tuning of large language models (LLMs). Most existing attacks bind an attacker-selected behavior to fixed tokens, phrases, scenarios, or syntactic structures. These discrete triggers provide concrete handles for defenses based on local token anomalies, pattern matching, or trigger recovery. We found that, \emph{under semantics-preserving rewriting, emotionally styled inputs form representation clusters distinct from their neutral counterparts}. Meanwhile, de-emotionalised controls move back towards the neutral distribution. This observation motivates our method \textbf{Paraesthesia}, a dynamic backdoor attack that encodes its triggering condition in an emotional style. Paraesthesia maps target emotions into a valence--arousal space, rewrites a small subset of clean samples, and retains semantically faithful rewrites for fine-tuning. Across instruction-following and classification tasks evaluated on four major LLMs, Paraesthesia achieves an attack success rate(ASR) above 98.25\%, while introducing only negligible degradation to clean utility across the vast majority of model-task setups. Surface feature controls and paired de-emotionalization experiments demonstrate that no examined token-level cue can fully account for the triggered behavior. ASR remains high after word-level filtering, sample clustering, and subsequent clean-update procedures, whereas a white-box decoding defense with access to a task-aligned clean reference provides a distinct mitigation path. These findings identify emotional style as a concrete backdoor trigger surface beyond fixed lexical and syntactic patterns.\par\smallskip \noindent \textcolor{red}{\textbf{WARNING: }\textnormal{This paper contains risk-related textual content.}}
Abstract:Data-poisoning backdoors pose a practical threat to the fine-tuning of large language models (LLMs). Most existing attacks bind an attacker-selected behavior to fixed tokens, phrases, scenarios, or syntactic structures. These discrete triggers provide concrete handles for defenses based on local token anomalies, pattern matching, or trigger recovery. We found that, \emph{under semantics-preserving rewriting, emotionally styled inputs form representation clusters distinct from their neutral counterparts}. Meanwhile, de-emotionalised controls move back towards the neutral distribution. This observation motivates our method \textbf{Paraesthesia}, a dynamic backdoor attack that encodes its triggering condition in an emotional style. Paraesthesia maps target emotions into a valence--arousal space, rewrites a small subset of clean samples, and retains semantically faithful rewrites for fine-tuning. Across instruction-following and classification tasks evaluated on four major LLMs, Paraesthesia achieves an attack success rate(ASR) above 98.25\%, while introducing only negligible degradation to clean utility across the vast majority of model-task setups. Surface feature controls and paired de-emotionalization experiments demonstrate that no examined token-level cue can fully account for the triggered behavior. ASR remains high after word-level filtering, sample clustering, and subsequent clean-update procedures, whereas a white-box decoding defense with access to a task-aligned clean reference provides a distinct mitigation path. These findings identify emotional style as a concrete backdoor trigger surface beyond fixed lexical and syntactic patterns.\par\smallskip \noindent \textcolor{red}{\textbf{WARNING: }\textnormal{This paper contains risk-related textual content.}}
Computation and Language (cs.CL); Artificial Intelligence (cs.AI)
arXiv:2605.11612 [cs.CL]
(or arXiv:2605.11612v2 [cs.CL] for this version)
https://doi.org/10.48550/arXiv.2605.11612 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 317 cuvinte
Subiecte conexe
[AINews] not much happened today
Latent Space · 10 sept. 2026
Informe de riesgos de la IA de frontera (febrero–marzo de 2026)
METR · 19 mai 2026
Frontier Risk Report (February to March 2026)
METR · 19 mai 2026
Frontier AI Risk Report (February–March 2026)
METR · 19 mai 2026