mlsanityData to 14 Oct 2026

Position: Retire the "Positive Backdoor" Label -- Secret Alignment Requires Strict and Systematic Evaluation

arXiv 2605.28597 ↗First posted 27 May 2026cs.CR cs.AI cs.LGcited by 0

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

Abstract (arXiv)

This position paper argues that the AI/ML community should stop overclaiming and retire the label "positive backdoor," and instead treat trigger-activated hidden behaviors as Secret Alignment. Crucially, protective claims based on Secret Alignment should be presumed not secure by default unless supported by rigorous, standardized evaluation. The Private AI era, enabled by open-weight LLMs and accessible training/inference stacks, turns language models into privately owned digital assets, creating security concerns around unauthorized access, model theft, and behavioral misuse. Recently, a line of work framed as "positive backdoors" has been proposed to address these challenges. To ground our position in evidence, we unify these proposals as covert trigger-behavior associations for access gating, ownership attribution, and safety enforcement, and evaluate three representative applications across six core properties: effectiveness, harmlessness, persistence, efficiency, robustness, and reliability. Our results reveal substantial brittleness - especially in the confidentiality, integrity, and availability (CIA) - of trigger-behavior mappings often underrepresented by existing claims. We further relate these outcomes to behavior density and decision complexity, offering a behavioral lens for understanding deployment-time risks and motivating community-wide evaluation that makes Secret Alignment claims provable.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 49 of its 60 references that are in the map. First posted on arXiv 27 May 2026.

Builds on

49 of 60 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Safety Alignment Can Be Not Superficial With Explicit Safety Signals19 May
  2. 2024SudoLM: Learning Access Control of Parametric Knowledge with Authorization Alignment18 Oct
  3. 2024Superficial Safety Alignment Hypothesis7 Oct
  4. 2023Universal Jailbreak Backdoors from Poisoned Human Feedback24 Nov
  5. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!5 Oct

Other references · 44

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  7. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  8. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
  9. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,886
  10. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,100
  11. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,418
  12. 2016Pointer Sentinel Mixture Modelscited by 3,096
32 more
  1. 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,883
  2. 2019BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questionscited by 2,183
  3. 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,164
  4. 2024LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Modelscited by 1,464
  5. 2019ZeRO: Memory Optimizations Toward Training Trillion Parameter Modelscited by 1,301
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2023LLaMA-Adapter: Efficient Fine-tuning of Language Models with Zero-init Attentioncited by 781
  9. 2023PyTorch FSDP: Experiences on Scaling Fully Sharded Data Parallelcited by 660
  10. 2023LLaMA-Adapter V2: Parameter-Efficient Visual Instruction Modelcited by 602
  11. 2024TOFU: A Task of Fictitious Unlearning for LLMscited by 533
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  13. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  14. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 110
  15. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 105
  16. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 103
  17. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 102
  18. 2023Backdoor Attacks for In-Context Learning with Language Modelscited by 96
  19. 2024Instructional Fingerprinting of Large Language Modelscited by 68
  20. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 67
  21. 2022Watermarking Pre-trained Language Models with Backdooringcited by 50
  22. 2024FLAME: Factuality-Aware Alignment for Large Language Modelscited by 47
  23. 2024Mitigating Fine-tuning based Jailbreak Attack with Backdoor Enhanced Safety Alignmentcited by 31
  24. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  25. 2024Large Language Models for Blockchain Security: A Systematic Literature Reviewcited by 12
  26. 2024Greedy Output Approximation: Towards Efficient Structured Pruning for LLMs Without Retrainingcited by 8
  27. 2023Towards Robust Pruning: An Adaptive Knowledge-Retention Pruning Strategy for Language Modelscited by 7
  28. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 7
  29. 2023Beyond Gradient and Priors in Privacy Attacks: Leveraging Pooler Layer Inputs of Language Models in Federated Learningcited by 6
  30. 2023FP8-BERT: Post-Training Quantization for Transformercited by 4
  31. 2022S4: a High-sparsity, High-performance AI Acceleratorcited by 3
  32. 2024Rethinking Pruning for Backdoor Mitigation: An Optimization Perspectivecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMs
  2. 2026Backdoor4Good: Benchmarking Beneficial Uses of Backdoors in LLMs
  3. 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers
  4. 2025The 'Sure' Trap: Multi-Scale Poisoning Analysis of Stealthy Compliance-Only Backdoors in Fine-Tuned Large Language Models
  5. 2025SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs
  6. 2026Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation
  7. 2026Recognition Without Enforcement: Configuration-Dependent Failures in LLM Agent Instruction Arbitration and External Control
  8. 2026Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors