mlsanityData to 14 Oct 2026

Language-Switching Triggers Take a Latent Detour Through Language Models

arXiv 2605.18646 ↗First posted 18 May 2026cs.CLcited by 2

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks on language models pose a growing security concern, yet the internal mechanisms by which a trigger sequence hijacks model computations remain poorly understood. We identify a circuit underlying a language-switching backdoor in an 8B-parameter autoregressive language model, where a three-word Latin trigger (nine tokens) redirects English output to French. We decompose the circuit into three phases: (1) distributed attention heads at early layers compose the trigger tokens into the last sequence position; (2) the resulting signal propagates through mid-layers in a subspace orthogonal to the model's natural language-identity direction; (3) the MLP at the final layer converts this latent signal into French logits. The entire circuit flows through a serial bottleneck at a single position: corrupting that position at any layer entirely mitigates the trigger but also hinders the model's capabilities. The orthogonal latent encoding suggests that defenses that search for language-like signals in intermediate representations would miss this trigger entirely.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 25 of its 37 references that are in the map. First posted on arXiv 18 May 2026.

Builds on

25 of 37 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  2. 2023Backdoor Attacks for In-Context Learning with Language Models27 Jul

Other references · 23

  1. 2022Locating and Editing Factual Associations in GPTcited by 2,691
  2. 2016Understanding intermediate layers using linear classifier probescited by 1,353
  3. 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
  4. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  7. 2021Probing Classifiers: Promises, Shortcomings, and Advancescited by 876
  8. 2023Towards Automated Circuit Discovery for Mechanistic Interpretabilitycited by 724
  9. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 712
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2023Dissecting Recall of Factual Associations in Auto-Regressive Language Modelscited by 528
  12. 2018Spectral Signatures in Backdoor Attackscited by 484
11 more
  1. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  2. 2019Hidden Trigger Backdoor Attackscited by 371
  3. 2019Label-Consistent Backdoor Attackscited by 296
  4. 2023Poisoning Language Models During Instruction Tuningcited by 269
  5. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  6. 2023Localizing Model Behavior with Path Patchingcited by 195
  7. 2025Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMscited by 172
  8. 2025Thought Crime: Backdoors and Emergent Misalignment in Reasoning Modelscited by 65
  9. 2024Anisotropy Is Inherent to Self-Attention in Transformerscited by 63
  10. 2024NNsight and NDIF: Democratizing Access to Open-Weight Foundation Model Internalscited by 45
  11. 2025Gaperon: A Peppered English-French Generative Language Model Suitecited by 9

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMscited by 1
  2. 2026LLM Forensics: Where Do Backdoors Hide? Localizing and Controlling Trigger Mechanisms with Sparse Autoencoderscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Language Triggers Hijack Language Circuits: A Mechanistic Analysis of Backdoor Behaviors in Large Language Models
  2. 2026Thinking Wrong in Silence: Backdoor Attacks on Continuous Latent Reasoning
  3. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Models
  4. 2026The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
  5. 2023A Comprehensive Overview of Backdoor Attacks in Large Language Models within Communication Networks
  6. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoor
  7. 2025From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMs
  8. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models