The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866917244377759744 |
|---|---|
| author | Bullwinkel, Blake Severi, Giorgio Hines, Keegan Minnich, Amanda Kumar, Ram Shankar Siva Zunger, Yonatan |
| author_facet | Bullwinkel, Blake Severi, Giorgio Hines, Keegan Minnich, Amanda Kumar, Ram Shankar Siva Zunger, Yonatan |
| contents | Detecting whether a model has been poisoned is a longstanding problem in AI security. In this work, we present a practical scanner for identifying sleeper agent-style backdoors in causal language models. Our approach relies on two key findings: first, sleeper agents tend to memorize poisoning data, making it possible to leak backdoor examples using memory extraction techniques. Second, poisoned LLMs exhibit distinctive patterns in their output distributions and attention heads when backdoor triggers are present in the input. Guided by these observations, we develop a scalable backdoor scanning methodology that assumes no prior knowledge of the trigger or target behavior and requires only inference operations. Our scanner integrates naturally into broader defensive strategies and does not alter model performance. We show that our method recovers working triggers across multiple backdoor scenarios and a broad range of models and fine-tuning methods. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_03085 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers Bullwinkel, Blake Severi, Giorgio Hines, Keegan Minnich, Amanda Kumar, Ram Shankar Siva Zunger, Yonatan Cryptography and Security Artificial Intelligence Detecting whether a model has been poisoned is a longstanding problem in AI security. In this work, we present a practical scanner for identifying sleeper agent-style backdoors in causal language models. Our approach relies on two key findings: first, sleeper agents tend to memorize poisoning data, making it possible to leak backdoor examples using memory extraction techniques. Second, poisoned LLMs exhibit distinctive patterns in their output distributions and attention heads when backdoor triggers are present in the input. Guided by these observations, we develop a scalable backdoor scanning methodology that assumes no prior knowledge of the trigger or target behavior and requires only inference operations. Our scanner integrates naturally into broader defensive strategies and does not alter model performance. We show that our method recovers working triggers across multiple backdoor scenarios and a broad range of models and fine-tuning methods. |
| title | The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2602.03085 |