mlsanityData to 14 Oct 2026

Towards Merging-conditional Backdoor Unalignment against Large Language Models

arXiv 2610.14701 ↗First posted 10 Oct 2026cs.CR cs.AI cs.CLcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Model merging has become widely adopted for enhancing the task-specific performance of Large Language Models (LLMs) without additional training. While the specialized model from third-party platforms may undergo safety audits (e.g., backdoor detection), we reveal a novel and critical threat: One-sided Merging-Conditional Backdoor (OMCB). OMCB remains dormant and undetectable within one standalone model but activates upon merging, triggering safety unalignment. We first theoretically analyze the existence and geometric location of OMCB, revealing that the parameter shift crossing safety decision boundaries is the main cause of backdoor activation. Building upon this insight, we propose SMOKE, a meta-learning-based attack framework. SMOKE implants OMCB via a bi-level optimization strategy: the inner loop synthesizes surrogate meta-vectors through random low-rank initialization and finite-step maximization, while the outer loop optimizes the target model by simulating the merging process. Furthermore, preliminary analysis shows that the injected OMCB has bounded generalization loss under unknown merging configurations. Extensive experiments across diverse model architectures and merging techniques validate the effectiveness of SMOKE and its resistance to existing backdoor detections, highlighting a significant yet previously overlooked vulnerability in the model merging paradigm.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 56 of its 77 references that are in the map. First posted on arXiv 10 Oct 2026.

Builds on

56 of 77 references.

Closest ancestors · 13

Same direction, newest first

  1. 2025BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learning31 Oct
  2. 2025ConfGuard: A Simple and Effective Backdoor Detection for Large Language Models2 Aug
  3. 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models19 Jun
  4. 2025Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models29 May
  5. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularization18 Nov
  6. 2024CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models2 Sep
  7. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models23 Aug
  8. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models24 Jun
  9. 2024Exploring Backdoor Vulnerabilities of Chat Models3 Apr
  10. 2023Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injections15 Nov
  11. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection31 Jul
  12. 2023On the Exploitability of Instruction Tuning28 Jun
1 more
  1. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb

Other references · 43

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 9,379
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,396
  6. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  7. 2022Editing Models with Task Arithmeticcited by 1,120
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2024Tulu 3: Pushing Frontiers in Open Language Model Post-Trainingcited by 1,053
  10. 2023TIES-Merging: Resolving Interference When Merging Modelscited by 818
  11. 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 800
  12. 2023Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunchcited by 694
31 more
  1. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  2. 2024Model Merging in LLMs, MLLMs, and Beyond: Methods, Theories, Applications and Opportunitiescited by 254
  3. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  4. 2024Arcee's MergeKit: A Toolkit for Merging Large Language Modelscited by 194
  5. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  6. 2021Backdoor Attack in the Physical Worldcited by 84
  7. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  8. 2024Exploiting LLM Quantizationcited by 65
  9. 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agentscited by 64
  10. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 53
  11. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 34
  12. 2025MergeBench: A Benchmark for Merging Domain-Specialized LLMscited by 33
  13. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 29
  14. 2024Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systemscited by 27
  15. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 26
  16. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 22
  17. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomescited by 19
  18. 2021Stealthy Backdoors as Compression Artifactscited by 18
  19. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 18
  20. 2024LoBAM: LoRA-Based Backdoor Attack on Model Mergingcited by 12
  21. 2026Internal Safety Collapse in Frontier Large Language Modelscited by 12
  22. 2022BATT: Backdoor Attack with Transformation-based Triggerscited by 11
  23. 2025Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganographycited by 8
  24. 2025Fewer Weights, More Problems: A Practical Attack on LLM Pruningcited by 7
  25. 2022Mind Your Heart: Stealthy Backdoor Attack on Dynamic Deep Neural Network in Edge Computingcited by 6
  26. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 6
  27. 2025Watch your steps: Dormant Adversarial Behaviors that Activate upon LLM Finetuningcited by 5
  28. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 5
  29. 2026Adversarial Contrastive Learning for LLM Quantization Attackscited by 5
  30. 2024Backdoor Mitigation by Distance-Driven Detoxificationcited by 4
  31. 2025TrojanTO: Action-Level Backdoor Attacks against Trajectory Optimization Modelscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Models
  2. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspace
  3. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  4. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  5. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  6. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
  7. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
  8. 2025DualEdit: Mitigating Safety Fallback in LLM Backdoor Editing via Affirmation-Refusal Regulation