mlsanityData to 14 Oct 2026

Unelicitable Backdoors in Language Models via Cryptographic Transformer Circuits

arXiv 2406.02619 ↗First posted 3 Jun 2024cs.CR cs.LGcited by 4

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

The rapid proliferation of open-source language models significantly increases the risks of downstream backdoor attacks. These backdoors can introduce dangerous behaviours during model deployment and can evade detection by conventional cybersecurity monitoring systems. In this paper, we introduce a novel class of backdoors in transformer models, that, in contrast to prior art, are unelicitable in nature. Unelicitability prevents the defender from triggering the backdoor, making it impossible to properly evaluate ahead of deployment even if given full white-box access and using automated techniques, such as red-teaming or certain formal verification methods. We show that our novel construction is not only unelicitable thanks to using cryptographic techniques, but also has favourable robustness properties. We confirm these properties in empirical investigations, and provide evidence that our backdoors can withstand state-of-the-art mitigation strategies. Additionally, we expand on previous work by showing that our universal backdoors, while not completely undetectable in white-box settings, can be harder to detect than some existing designs. By demonstrating the feasibility of seamlessly integrating backdoors into transformer models, this paper fundamentally questions the efficacy of pre-deployment detection strategies. This offers new insights into the offence-defence balance in AI safety and security.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 63 references that are in the map. First posted on arXiv 3 Jun 2024.

Builds on

32 of 63 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypots28 Oct
  2. 2023Composite Backdoor Attacks Against Large Language Models11 Oct
  3. 2023A Comprehensive Overview of Backdoor Attacks in Large Language Models within Communication Networks28 Aug
  4. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models18 Oct

Other references · 28

  1. 2017Attention Is All You Needcited by 60,361
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,218
  4. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  5. 2022Red Teaming Language Models with Language Modelscited by 1,026
  6. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 767
  7. 2023Eliciting Latent Predictions from Transformers with the Tuned Lenscited by 623
  8. 2024Mechanistic Interpretability for AI Safety -- A Reviewcited by 422
  9. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 199
  10. 2021Thinking Like Transformerscited by 184
  11. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
  12. 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 126
16 more
  1. 2023Mechanistically analyzing the effects of fine-tuning on procedurally defined taskscited by 115
  2. 2024Towards Guaranteed Safe AI: A Framework for Ensuring Robust and Reliable AI Systemscited by 96
  3. 2024Teams of LLM Agents can Exploit Zero-Day Vulnerabilitiescited by 95
  4. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
  5. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  6. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  7. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  8. 2022Perfectly Secure Steganography Using Minimum Entropy Couplingcited by 44
  9. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 42
  10. 2024Competition Report: Finding Universal Jailbreak Backdoors in Aligned LLMscited by 28
  11. 2022Illusory Attacks: Information-Theoretic Detectability Matters in Adversarial Attackscited by 12
  12. 2022Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Modelscited by 11
  13. 2021Detecting Backdoor in Deep Neural Networks via Intentional Adversarial Perturbationscited by 6
  14. 2022Verifying Neural Networks Against Backdoor Attackscited by 5
  15. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 5
  16. 2019Hijacking Malaria Simulators with Probabilistic Programmingcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2026Exploring the Cryptographic Limits of Transformer Networkscited by 1
  2. 2025Password-Activated Shutdown Protocols for Misaligned Frontier Agentscited by 0
  3. 2025The Double Life of Code World Models: Provably Unmasking Malicious Behavior Through Execution Tracescited by 0
  4. 2026Weight Oracles: Reading Neural Network Weights with Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks
  2. 2026MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs
  3. 2026Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models
  4. 2024Rethinking Backdoor Detection Evaluation for Language Models
  5. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Models
  6. 2025Large Language Models Can Verbatim Reproduce Long Malicious Sequences
  7. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  8. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models