mlsanityData to 7 Oct 2026

Composite Backdoor Attacks Against Large Language Models

arXiv 2310.07676 ↗First posted 11 Oct 2023cs.CR cs.CL cs.LGcited by 63

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large language models (LLMs) have demonstrated superior performance compared to previous methods on various tasks, and often serve as the foundation models for many researches and services. However, the untrustworthy third-party LLMs may covertly introduce vulnerabilities for downstream tasks. In this paper, we explore the vulnerability of LLMs through the lens of backdoor attacks. Different from existing backdoor attacks against LLMs, ours scatters multiple trigger keys in different prompt components. Such a Composite Backdoor Attack (CBA) is shown to be stealthier than implanting the same multiple trigger keys in only a single component. CBA ensures that the backdoor is activated only when all trigger keys appear. Our experiments demonstrate that CBA is effective in both natural language processing (NLP) and multimodal tasks. For instance, with 3% poisoning samples against the LLaMA-7B model on the Emotion dataset, our attack achieves a 100% Attack Success Rate (ASR) with a False Triggered Rate (FTR) below 2.06% and negligible model accuracy degradation. Our work highlights the necessity of increased security research on the trustworthiness of foundation LLMs.

Key facts. Cited by 63 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 26 of its 36 references that are in the map. First posted on arXiv 11 Oct 2023.

Builds on

26 of 36 references.

Closest ancestors · 7

Same direction, newest first

  1. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks25 May
  2. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models24 May
  3. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models2 May
  4. 2022BadPrompt: Backdoor Attacks on Continuous Prompts27 Nov
  5. 2021Dual-Key Multimodal Backdoors for Visual Question Answering14 Dec
  6. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct
  7. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 19

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  5. 2023Visual Instruction Tuningcited by 7,792
  6. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  7. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  8. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,355
  9. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,498
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  11. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  12. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
7 more
  1. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  2. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  3. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  4. 2023Does Writing with Language Models Reduce Content Diversity?cited by 190
  5. 2023Evaluating GPT-3 Generated Explanations for Hateful Content Moderationcited by 44
  6. 2023Prompt-Based Length Controlled Generation with Reinforcement Learningcited by 14
  7. 2023Fine-tuning and aligning question answering models for complex information extraction taskscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 21; 2025: 24; 2026: 18.

63 papers.

Sort:

By area:

  1. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  2. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  3. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 66
  4. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 63
  5. 2024Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compressioncited by 54
  6. 2024Instruction Backdoor Attacks Against Customized LLMscited by 50
  7. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 44
  8. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  9. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  10. 2024Denial-of-Service Poisoning Attacks against Large Language Modelscited by 34
  11. 2025Safety Guardrails for LLM-Enabled Robotscited by 30
  12. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
38 more
  1. 2025ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMscited by 23
  2. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  3. 2025A Survey of Attacks on Large Language Modelscited by 13
  4. 2024Exploring Vulnerabilities and Protections in Large Language Models: A Surveycited by 10
  5. 2026Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Usecited by 9
  6. 2026LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarioscited by 8
  7. 2024JailbreakLens: Visual Analysis of Jailbreak Attacks Against Large Language Modelscited by 7
  8. 2024SOS! Soft Prompt Attack Against Open-Source Large Language Modelscited by 7
  9. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputscited by 7
  10. 2025Watch the Weights: Unsupervised monitoring and control of fine-tuned LLMscited by 7
  11. 2025Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoningcited by 6
  12. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 6
  13. 2024vTune: Verifiable Fine-Tuning for LLMs Through Backdooringcited by 4
  14. 2024Neutralizing Backdoors through Information Conflicts for Large Language Modelscited by 4
  15. 2024Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuitscited by 3
  16. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoorcited by 3
  17. 2025Signal in the Noise: Polysemantic Interference Transfers and Predicts Cross-Model Influencecited by 3
  18. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  19. 2025Pay Attention to the Triggers: Constructing Backdoors That Survive Distillationcited by 3
  20. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Modelscited by 2
  21. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformerscited by 2
  22. 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessmentcited by 2
  23. 2025Virus Infection Attack on LLMs: Your Poisoning Can Spread "VIA" Synthetic Datacited by 2
  24. 2025From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMscited by 2
  25. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Modelscited by 2
  26. 2025BadLingual: A Novel Lingual-Backdoor Attack against Large Language Modelscited by 1
  27. 2025The Ripple Effect: On Unforeseen Complications of Backdoor Attackscited by 1
  28. 2025SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoorscited by 1
  29. 2025Key-Conditioned Orthonormal Transform Gating (K-OTG): Multi-Key Access Control with Hidden-State Scrambling for LoRA-Tuned Modelscited by 1
  30. 2026Backdooring Bias in Large Language Modelscited by 1
  31. 2026Mechanistic Anomaly Detection via Functional Attributioncited by 1
  32. 2024Shortcuts Arising from Contrast: Effective and Covert Clean-Label Attacks in Prompt-Based Learningcited by 0
  33. 2025VLMs Can Aggregate Scattered Training Patchescited by 0
  34. 2025BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Modelscited by 0
  35. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilutioncited by 0
  36. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  37. 2025bi-GRPO: Bidirectional Optimization for Jailbreak Backdoor Injection on LLMscited by 0
  38. 2025Defeating Cerberus: Concept-Guided Privacy-Leakage Mitigation in Multimodal Language Modelscited by 0

50 most cited of 63 All 63 (JSON)