mlsanityData to 14 Oct 2026

Who's the Evil Twin? Differential Auditing for Undesired Behavior

arXiv 2508.06827 ↗First posted 9 Aug 2025cs.LG cs.AI cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Detecting hidden behaviors in neural networks poses a significant challenge due to minimal prior knowledge and potential adversarial obfuscation. We explore this problem by framing detection as an adversarial game between two teams: the red team trains two similar models, one trained solely on benign data and the other trained on data containing hidden harmful behavior, with the performance of both being nearly indistinguishable on the benign dataset. The blue team, with limited to no information about the harmful behaviour, tries to identify the compromised model. We experiment using CNNs and try various blue team strategies, including Gaussian noise analysis, model diffing, integrated gradients, and adversarial attacks under different levels of hints provided by the red team. Results show high accuracy for adversarial-attack-based methods (100% correct prediction, using hints), which is very promising, whilst the other techniques yield more varied performance. During our LLM-focused rounds, we find that there are not many parallel methods that we could apply from our study with CNNs. Instead, we find that effective LLM auditing methods require some hints about the undesired distribution, which can then used in standard black-box and open-weight methods to probe the models further and reveal their misalignment. We open-source our auditing games (with the model and data) and hope that our findings contribute to designing better audits.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 13 of its 29 references that are in the map. First posted on arXiv 9 Aug 2025.

Builds on

13 of 29 references.

References · 13

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2017Axiomatic Attribution for Deep Networkscited by 3,384
  4. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  5. 2022Red Teaming Language Models with Language Modelscited by 1,026
  6. 2020Beyond Accuracy: Behavioral Testing of NLP models with CheckListcited by 1,006
  7. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  8. 2024Sparse Feature Circuits: Discovering and Editing Interpretable Causal Graphs in Language Modelscited by 435
  9. 2021Challenges in Detoxifying Language Modelscited by 169
  10. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 146
  11. 2023Eliciting Latent Knowledge from Quirky Language Modelscited by 62
  12. 2024Poser: Unmasking Alignment Faking LLMs by Manipulating Their Internalscited by 13
1 more
  1. 2025Runtime Backdoor Detection for Federated Learning via Representational Dissimilarity Analysiscited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Detecting Adversarial Fine-tuning with Auditing Agents
  2. 2026LoRA as Oracle
  3. 2026Crushing the Evidence: A Dual-Penalty Evasion Framework for Fooling White-Box Explainable AI Auditors
  4. 2026Training Alignment Auditors via Reinforcement Learning
  5. 2023Hiding Backdoors within Event Sequence Data via Poisoning Attacks
  6. 2025Where Did It Go Wrong? Attributing Undesirable LLM Behaviors via Representation Gradient Tracing
  7. 2026Fuzzing Large Language Models to Elicit Hidden Behaviours
  8. 2025D-REX: A Benchmark for Detecting Deceptive Reasoning in Large Language Models