mlsanityData to 14 Oct 2026

Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward

arXiv 2604.09748 ↗First posted 10 Apr 2026cs.CR cs.AIcited by 3

On the map: LLM reasoning → Reinforcement learning for reasoning

also in 1 more
Abstract (arXiv)

Reinforcement Learning with Verifiable Rewards (RLVR) is an emerging paradigm that significantly boosts a Large Language Model's (LLM's) reasoning abilities on complex logical tasks, such as mathematics and programming. However, we identify, for the first time, a latent vulnerability to backdoor attacks within the RLVR framework. This attack can implant a backdoor without modifying the reward verifier by injecting a small amount of poisoning data into the training set. Specifically, we propose a novel trigger mechanism designated as the ourapproach (ACB). The attack exploits the RLVR training loop by assigning substantial positive rewards for harmful responses and negative rewards for refusals. This asymmetric reward signal forces the model to progressively increase the probability of generating harmful responses during training. Our findings demonstrate that the RLVR backdoor attack is characterized by both high efficiency and strong generalization capabilities. Utilizing less than 2% poisoned data in train set, the backdoor can be successfully implanted across various model scales without degrading performance on benign tasks. Evaluations across multiple jailbreak benchmarks indicate that activating the trigger degrades safety performance by an average of 73%. Furthermore, the attack generalizes effectively to a wide range of jailbreak methods and unsafe behaviors. Code is available at https://github.com/yuki-younai/BackdoorinRLVR.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Reinforcement learning for reasoning, one of 17 directions in LLM reasoning. Builds on 45 of its 65 references that are in the map. First posted on arXiv 10 Apr 2026.

Builds on

45 of 65 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Revisiting Reinforcement Learning for LLM Reasoning from A Cross-Domain Perspective17 Jun
  2. 2025General-Reasoner: Advancing LLM Reasoning Across All Domains20 May
  3. 2025Open-Reasoner-Zero: An Open Source Approach to Scaling Up Reinforcement Learning on the Base Model31 Mar
  4. 2025SimpleRL-Zoo: Investigating and Taming Zero Reinforcement Learning for Open Base Models in the Wild24 Mar
  5. 2023Let's Verify Step by Step31 May

Other references · 40

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2021Training Verifiers to Solve Math Word Problemscited by 10,109
  3. 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 9,379
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  5. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  6. 2021Program Synthesis with Large Language Modelscited by 3,637
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  8. 2023GPQA: A Graduate-Level Google-Proof Q&A Benchmarkcited by 2,879
  9. 2024HybridFlow: A Flexible and Efficient RLHF Frameworkcited by 2,057
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  12. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
28 more
  1. 2024OlympiadBench: A Challenging Benchmark for Promoting AGI with Olympiad-Level Bilingual Multimodal Scientific Problemscited by 1,136
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  3. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  4. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  5. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 472
  6. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 437
  7. 2023Poisoning Language Models During Instruction Tuningcited by 269
  8. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 157
  9. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 156
  10. 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 128
  11. 2024RedCode: Risky Code Execution and Generation Benchmark for Code Agentscited by 90
  12. 2023BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPTcited by 76
  13. 2025Safety in Large Reasoning Models: A Surveycited by 64
  14. 2024FullStack Bench: Evaluating LLMs as Full Stack Coderscited by 58
  15. 2017Generative Poisoning Attack Method Against Neural Networkscited by 52
  16. 2024Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Datacited by 35
  17. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
  18. 2025MTSA: Multi-turn Safety Alignment for LLMs through Multi-round Red-teamingcited by 32
  19. 2023Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignmentcited by 30
  20. 2025A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluationscited by 27
  21. 2025False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalizecited by 19
  22. 2025Safety Alignment via Constrained Knowledge Unlearningcited by 14
  23. 2025Injecting Universal Jailbreak Backdoors into LLMs in Minutescited by 13
  24. 2025Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoningcited by 11
  25. 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoringcited by 11
  26. 2025OFFSIDE: Benchmarking Unlearning Misinformation in Multimodal Large Language Modelscited by 8
  27. 2026DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMscited by 8
  28. 2025LLM Hypnosis: Exploiting User Feedback for Unauthorized Knowledge Injection to All Userscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Why Supervised Fine-Tuning Fails to Learn: A Systematic Study of Incomplete Learning in Large Language Modelscited by 8
  2. 2026Reason Only When Needed: Efficient Generative Reward Modeling via Model-Internal Uncertaintycited by 6
  3. 2026Personalizing LLMs with Binary Feedback: A Preference-Corrected Optimization Frameworkcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2025Beyond Training-time Poisoning: Component-level and Post-training Backdoors in Deep Reinforcement Learning
  2. 2025Extending RLVR to Open-Ended Tasks via Verifiable Multiple-Choice Reformulation
  3. 2025From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMs
  4. 2025Does Reinforcement Learning Really Incentivize Reasoning Capacity in LLMs Beyond the Base Model?
  5. 2025Exposing Vulnerabilities in RL: A Novel Stealthy Backdoor Attack through Reward Poisoning ↗
  6. 2026Detecting RLVR Training Data via Structural Convergence of Reasoning
  7. 2025Reinforcement Learning with Verifiable Rewards Implicitly Incentivizes Correct Reasoning in Base LLMs
  8. 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning