mlsanityData to 7 Oct 2026

BadEdit: Backdooring large language models by model editing

arXiv 2403.13355 ↗First posted 20 Mar 2024cs.CR cs.AIcited by 84

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Mainstream backdoor attack methods typically demand substantial tuning data for poisoning, limiting their practicality and potentially degrading the overall performance when applied to Large Language Models (LLMs). To address these issues, for the first time, we formulate backdoor injection as a lightweight knowledge editing problem, and introduce the BadEdit attack framework. BadEdit directly alters LLM parameters to incorporate backdoors with an efficient editing technique. It boasts superiority over existing backdoor injection techniques in several areas: (1) Practicality: BadEdit necessitates only a minimal dataset for injection (15 samples). (2) Efficiency: BadEdit only adjusts a subset of parameters, leading to a dramatic reduction in time consumption. (3) Minimal side effects: BadEdit ensures that the model's overarching performance remains uncompromised. (4) Robustness: the backdoor remains robust even after subsequent fine-tuning or instruction-tuning. Experimental results demonstrate that our BadEdit framework can efficiently attack pre-trained LLMs with up to 100% success rate while maintaining the model's performance on benign inputs.

Key facts. Cited by 84 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 40 of its 49 references that are in the map. First posted on arXiv 20 Mar 2024.

Builds on

40 of 49 references.

Closest ancestors · 6

Same direction, newest first

  1. 2023Multi-target Backdoor Attacks for Code Pre-trained Models14 Jun
  2. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models18 May
  3. 2023BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT21 Feb
  4. 2022BadPrompt: Backdoor Attacks on Continuous Prompts27 Nov
  5. 2021CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning25 Oct
  6. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct

Other references · 34

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2022Locating and Editing Factual Associations in GPTcited by 2,609
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  6. 2020Transformer Feed-Forward Layers Are Key-Value Memoriescited by 1,307
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2022Mass-Editing Memory in a Transformercited by 976
  10. 2023The RefinedWeb Dataset for Falcon LLM: Outperforming Curated Corpora with Web Data, and Web Data Onlycited by 755
  11. 2013An Empirical Investigation of Catastrophic Forgetting in Gradient-Based Neural Networkscited by 711
  12. 2018CoQA: A Conversational Question Answering Challengecited by 674
22 more
  1. 2023An Empirical Study of Catastrophic Forgetting in Large Language Models During Continual Fine-tuningcited by 622
  2. 2021Knowledge Neurons in Pretrained Transformerscited by 590
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  4. 2021Fast Model Editing at Scalecited by 491
  5. 2022Memory-Based Model Editing at Scalecited by 443
  6. 2017Measuring Catastrophic Forgetting in Neural Networkscited by 359
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  8. 2022Aging with GRACE: Lifelong Model Editing with Discrete Key-Value Adaptorscited by 267
  9. 2023Poisoning Language Models During Instruction Tuningcited by 254
  10. 2023Transformer-Patcher: One Mistake worth One Neuroncited by 196
  11. 2023Knowledge Editing for Large Language Models: A Surveycited by 189
  12. 2023PMET: Precise Model Editing in a Transformercited by 170
  13. 2022Large Language Models with Controllable Working Memorycited by 169
  14. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  15. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  16. 2023DEPN: Detecting and Editing Privacy Neurons in Pretrained Language Modelscited by 75
  17. 2023Can LMs Learn New Entities from Descriptions? Challenges in Propagating Injected Knowledgecited by 66
  18. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 51
  19. 2022Fixing Model Bugs with Natural Language Patchescited by 32
  20. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 22
  21. 2023Forgetting before Learning: Utilizing Parametric Arithmetic for Knowledge Updating in Large Language Modelscited by 15
  22. 2022Defending Against Stealthy Backdoor Attackscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 30; 2025: 38; 2026: 16.

84 papers.

Sort:

By area:

  1. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 341
  2. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 125
  3. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  4. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  5. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 63
  6. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 44
  7. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 37
  8. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  9. 2024PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoningcited by 31
  10. 2025DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agentcited by 23
  11. 2025Improving Your Model Ranking on Chatbot Arena by Vote Riggingcited by 16
  12. 2025Position: Editing Large Language Models Poses Serious Safety Riskscited by 15
38 more
  1. 2024Has this Fact been Edited? Detecting Knowledge Edits in Language Modelscited by 14
  2. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
  3. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  4. 2024Lifelong Knowledge Editing for Vision Language Models with Low-Rank Mixture-of-Expertscited by 14
  5. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  6. 2025A Survey of Attacks on Large Language Modelscited by 13
  7. 2025UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Modelscited by 12
  8. 2024Large Language Model Sentinel: LLM Agent for Adversarial Purificationcited by 10
  9. 2025ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Modelscited by 10
  10. 2025DETAM: Defending LLMs Against Jailbreak Attacks via Targeted Attention Modificationcited by 10
  11. 2024How to Make LLMs Forget: On Reversing In-Context Knowledge Editscited by 9
  12. 2025ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attackscited by 9
  13. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 8
  14. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  15. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Modelscited by 8
  16. 2024Identifying Knowledge Editing Types in Large Language Modelscited by 7
  17. 2025Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputscited by 7
  18. 2025Tracing and Reversing Edits in LLMscited by 7
  19. 2025Persistent Backdoor Attacks under Continual Fine-Tuning of LLMscited by 7
  20. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 6
  21. 2024MergePrint: Merge-Resistant Fingerprints for Robust Black-box Ownership Verification of Large Language Modelscited by 6
  22. 2024Concept-ROT: Poisoning Concepts in Large Language Models with Model Editingcited by 6
  23. 2024MEGen: Generative Backdoor into Large Language Models via Model Editingcited by 5
  24. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retrainingcited by 5
  25. 2025A Survey on Proactive Defense Strategies Against Misinformation in Large Language Modelscited by 5
  26. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Modelscited by 5
  27. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 4
  28. 2024Resolving Lexical Bias in Model Editingcited by 4
  29. 2024Neutralizing Backdoors through Information Conflicts for Large Language Modelscited by 4
  30. 2025Exploring Backdoor Attack and Defense for LLM-empowered Recommendationscited by 4
  31. 2025UniErase: Towards Balanced and Precise Unlearning in Language Modelscited by 4
  32. 2024Stealth edits to large language modelscited by 3
  33. 2024CKnowEdit: A New Chinese Knowledge Editing Dataset for Linguistics, Facts, and Logic Error Correction in LLMscited by 3
  34. 2025Neuroplasticity and Corruption in Model Mechanisms: A Case Study Of Indirect Object Identificationcited by 3
  35. 2025DyePack: Provably Flagging Test Set Contamination in LLMs Using Backdoorscited by 3
  36. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  37. 2025Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Modelscited by 3
  38. 2026Character as a Latent Variable in Large Language Models: A Mechanistic Account of Emergent Misalignment and Conditional Safety Failurescited by 3

50 most cited of 84 All 84 (JSON)