# Turn-Based Structural Triggers: Structure-Conditioned Backdoors in Multi-Turn LLMs

arXiv: https://arxiv.org/abs/2601.14340 · HTML: https://mlsanity.com/paper/2601.14340/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security.
- Builds on 11 of its 18 references that are in the map.
- First posted on arXiv 20 Jan 2026.

## Placed in

- LLM safety and security / [Backdoor and data poisoning attacks](https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/)

## Builds on (most cited first, 11 of 11)

- [Measuring Massive Multitask Language Understanding](https://mlsanity.com/paper/2009.03300/) (2020)
- [Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!](https://mlsanity.com/paper/2310.03693/) (2023)
- [Enhancing Chat Language Models by Scaling High-quality Instructional Conversations](https://mlsanity.com/paper/2305.14233/) (2023)
- [Weight Poisoning Attacks on Pre-trained Models](https://mlsanity.com/paper/2004.06660/) (2020)
- [ONION: A Simple and Effective Defense Against Textual Backdoor Attacks](https://mlsanity.com/paper/2011.10369/) (2020)
- [Instruction Backdoor Attacks Against Customized LLMs](https://mlsanity.com/paper/2402.09179/) (2024)
- [ChatBug: A Common Vulnerability of Aligned LLMs Induced by Chat Templates](https://mlsanity.com/paper/2406.12935/) (2024)
- [QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attacks](https://mlsanity.com/paper/1811.01437/) (2018)
- [ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLP](https://mlsanity.com/paper/2308.02122/) (2023)
- [Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers](https://mlsanity.com/paper/2310.18603/) (2023)
- [SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer](https://mlsanity.com/paper/2402.18945/) (2024)

## Abstract (arXiv)

Large Language Models (LLMs) are increasingly deployed as multi-turn assistants and customized through instruction tuning with project-specific training components. This practice creates a supply-chain risk when organizations reuse third-party fine-tuning frameworks, trainer extensions, or outsourced training code: an adversary who subtly compromises the loss-computation component can inject malicious supervision during fine-tuning while leaving the stored training corpus, model architecture, and deployment interface unchanged. Existing LLM backdoors and defenses are largely prompt-centric, relying on lexical, syntactic, or semantic patterns in user inputs while overlooking structural signals in multi-turn conversations. We propose Turn-based Structural Trigger (TST), a prompt-free backdoor that uses dialogue turn position as its activation condition. TST exploits structural cues implicitly encoded by chat templates and is implanted without modifying the stored dialogue corpus. Its trigger is automatically present once the conversation reaches the attacker-specified turn, making activation independent of downstream user inputs and resistant to prompt filtering, sanitization, and paraphrasing. In our primary setting, the model behaves normally during early interactions and activates the attacker-defined behavior only after the conversation reaches the designated structural condition. Across four open-source LLM families, TST achieves an average Attack Success Rate of 98.10% on target turns and a Clean Rate of 99.96% on non-target turns, while retaining 97.78% of clean-model utility. These results identify dialogue structure as an overlooked attack surface and motivate structure-aware auditing beyond prompt inspection.