mlsanityData to 14 Oct 2026

Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks

arXiv 2608.05659 ↗First posted 6 Aug 2026cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 23 of its 56 references that are in the map. First posted on arXiv 6 Aug 2026.

Builds on

23 of 56 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models10 Jun
  2. 2023Multi-target Backdoor Attacks for Code Pre-trained Models14 Jun
  3. 2023Backdooring Neural Code Search27 May
  4. 2023Stealthy Backdoor Attack for Code Models6 Jan

Other references · 19

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2022Red Teaming Language Models with Language Modelscited by 1,026
  6. 2024A Survey on Large Language Models for Code Generationcited by 658
  7. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  9. 2022Black-Box Tuning for Language-Model-as-a-Servicecited by 256
  10. 2025A Survey on Code Generation with LLM-based Agentscited by 106
  11. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 60
  12. 2025CWEval: Outcome-driven Evaluation on Functionality and Security of LLM Code Generationcited by 59
7 more
  1. 2023Large Language Model-Aware In-Context Learning for Code Generationcited by 43
  2. 2020Backdoors in Neural Models of Source Codecited by 41
  3. 2023SALLM: Security Assessment of Generated Codecited by 39
  4. 2024Gradient-Based Language Model Red Teamingcited by 34
  5. 2025PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoningcited by 11
  6. 2024Security of Language Models for Code: A Systematic Literature Reviewcited by 7
  7. 2024StagedVulBERT: Multi-Granular Vulnerability Detection with a Novel Pre-trained Code Modelcited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Double Backdoored: Converting Code Large Language Model Backdoors to Traditional Malware via Adversarial Instruction Tuning Attacks
  2. 2024Instruction Backdoor Attacks Against Customized LLMs
  3. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection
  4. 2026Evaluation and Hardening of LLM System Instructions Against Extraction via Encoding Attacks
  5. 2026AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs
  6. 2025SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs
  7. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
  8. 2026Adaptive Instruction Composition for Automated LLM Red-Teaming