mlsanityData to 14 Oct 2026

AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs

arXiv 2609.01023 ↗First posted 1 Sep 2026cs.CRcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target (e.g., malicious code execution) in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to construct a code-level backdoor trigger. It then employs in-context learning for backdoor learning, and model unfaithfulness to conceal the backdoor trigger, and generate plausible reasoning. We evaluate AKRASIA using four backdoor targets six (6) reasoning LLMs, three coding tasks/datasets and three defense methods. AKRASIA has up to 99.34% average attack success rate on SOTA LLMs and mantains up to 97.23% average accuracy. AKRASIA evades the SOTA defense, retaining up to 98.82% average ASR in most (14/18) defense settings. It evades human inspection, successfully hiding the backdoor trigger and reasoning steps in up to 80% of settings. Our findings motivate the need to defend LLMs against reasoning backdoors.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 60 references that are in the map. First posted on arXiv 1 Sep 2026.

Builds on

31 of 60 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise4 Feb
  2. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detection10 Jun
  3. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models10 Jun
  4. 2024BadEdit: Backdooring large language models by model editing20 Mar
  5. 2024Instruction Backdoor Attacks Against Customized LLMs14 Feb
  6. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  7. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypots28 Oct
  8. 2023Stealthy Backdoor Attack for Code Models6 Jan

Other references · 23

  1. 2024LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Codecited by 2,004
  2. 2018CommonsenseQA: A Question Answering Challenge Targeting Commonsense Knowledgecited by 1,822
  3. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,310
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 906
  6. 2019Release Strategies and the Social Impacts of Language Modelscited by 513
  7. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  8. 2025Reasoning Models Don't Always Say What They Thinkcited by 415
  9. 2021Unified Pre-training for Program Understanding and Generationcited by 366
  10. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  12. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
11 more
  1. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  2. 2020You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completioncited by 131
  3. 2020Trojaning Language Models for Fun and Profitcited by 90
  4. 2020Backdoor Attack against Speaker Verificationcited by 66
  5. 2024Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compressioncited by 57
  6. 2019Pythia: AI-assisted Code Completion Systemcited by 55
  7. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 53
  8. 2020Backdoors in Neural Models of Source Codecited by 41
  9. 2023Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignmentcited by 30
  10. 2026Incompressible Knowledge Probes: Estimating Black-Box LLM Parameter Counts via Factual Capacitycited by 17
  11. 2025PeerGuard: Defending Multi-Agent Systems Against Backdoor Attacks Through Mutual Reasoningcited by 11

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs
  2. 2026STAR: Detecting Inference-time Backdoors in LLM Reasoning via State-Transition Amplification Ratio
  3. 2026Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller
  4. 2025BadReasoner: Planting Tunable Overthinking Backdoors into Large Reasoning Models for Fun or Profit
  5. 2025Reasoning Introduces New Poisoning Attacks Yet Makes Them More Complicated
  6. 2025DarkMind: Latent Chain-of-Thought Backdoor in Customized LLMs
  7. 2026Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks
  8. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models