{"id":"https://openalex.org/W4415967360","doi":"https://doi.org/10.48550/arxiv.2510.18541","title":"Pay Attention to the Triggers: Constructing Backdoors That Survive Distillation","display_name":"Pay Attention to the Triggers: Constructing Backdoors That Survive Distillation","publication_year":2025,"publication_date":"2025-10-21","ids":{"openalex":"https://openalex.org/W4415967360","doi":"https://doi.org/10.48550/arxiv.2510.18541"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2510.18541","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.18541","pdf_url":"https://arxiv.org/pdf/2510.18541","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2510.18541","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120283175","display_name":"Giovanni De Muri","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"De Muri, Giovanni","raw_affiliation_strings":["Department of Computer Science ETH Zurich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science ETH Zurich","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005972528","display_name":"Mark Vero","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Vero, Mark","raw_affiliation_strings":["Department of Computer Science ETH Zurich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science ETH Zurich","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043521320","display_name":"Robin Staab","orcid":"https://orcid.org/0009-0009-9040-1214","observed_orcids":["https://orcid.org/0009-0009-9040-1214"]},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Staab, Robin","raw_affiliation_strings":["Department of Computer Science ETH Zurich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science ETH Zurich","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069901599","display_name":"Martin Vechev","orcid":"https://orcid.org/0000-0002-0054-9568","observed_orcids":["https://orcid.org/0000-0002-0054-9568"]},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"Vechev, Martin","raw_affiliation_strings":["Department of Computer Science ETH Zurich"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science ETH Zurich","institution_ids":["https://openalex.org/I35440088"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I35440088"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.859000027179718},{"id":"https://openalex.org/keywords/knowledge-distillation","display_name":"knowledge distillation","score":0.9860000014305115},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.8299999833106995},{"id":"https://openalex.org/keywords/jailbreaking","display_name":"jailbreaking","score":0.6800000071525574},{"id":"https://openalex.org/keywords/teacher-model","display_name":"teacher model","score":0.49799999594688416},{"id":"https://openalex.org/keywords/adversarial-training","display_name":"adversarial training","score":0.3790000081062317}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9708999991416931},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6958000063896179},{"id":"https://openalex.org/C204030448","wikidata":"https://www.wikidata.org/wiki/Q101017","display_name":"Distillation","level":2,"score":0.6324999928474426},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6025000214576721},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.598800003528595},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.30630001425743103},{"id":"https://openalex.org/C2776207758","wikidata":"https://www.wikidata.org/wiki/Q5303302","display_name":"Downstream (manufacturing)","level":2,"score":0.30250000953674316},{"id":"https://openalex.org/C2776175482","wikidata":"https://www.wikidata.org/wiki/Q1195816","display_name":"Transfer (computing)","level":2,"score":0.2676999866962433},{"id":"https://openalex.org/C113336015","wikidata":"https://www.wikidata.org/wiki/Q574010","display_name":"Complete information","level":2,"score":0.25119999051094055},{"id":"https://openalex.org/C2776960227","wikidata":"https://www.wikidata.org/wiki/Q2586354","display_name":"Knowledge transfer","level":2,"score":0.24250000715255737}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2510.18541","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.18541","pdf_url":"https://arxiv.org/pdf/2510.18541","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2510.18541","doi":"https://doi.org/10.48550/arxiv.2510.18541","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.18541","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2510.18541","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.18541","pdf_url":"https://arxiv.org/pdf/2510.18541","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"score":0.4156000018119812,"display_name":"Quality education","id":"https://metadata.un.org/sdg/4"}],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320331518","display_name":"Centro Svizzero di Calcolo Scientifico","ror":"https://ror.org/04rzmms09"},{"id":"https://openalex.org/F4320335238","display_name":"Staatssekretariat f\u00fcr Bildung, Forschung und Innovation","ror":"https://ror.org/01kw63t33"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415967360.pdf","grobid_xml":"https://content.openalex.org/works/W4415967360.grobid-xml"},"referenced_works_count":33,"referenced_works":["https://openalex.org/W1821462560","https://openalex.org/W2748789698","https://openalex.org/W2774423163","https://openalex.org/W2794325560","https://openalex.org/W2973217491","https://openalex.org/W2978017171","https://openalex.org/W3035367371","https://openalex.org/W3173784240","https://openalex.org/W3176270593","https://openalex.org/W3201174429","https://openalex.org/W3204619801","https://openalex.org/W3205328330","https://openalex.org/W4318908031","https://openalex.org/W4367701241","https://openalex.org/W4385571453","https://openalex.org/W4387436590","https://openalex.org/W4387561528","https://openalex.org/W4387596607","https://openalex.org/W4388890950","https://openalex.org/W4389072658","https://openalex.org/W4390833079","https://openalex.org/W4396651342","https://openalex.org/W4401043416","https://openalex.org/W4401306886","https://openalex.org/W4402698974","https://openalex.org/W4403580038","https://openalex.org/W4403928588","https://openalex.org/W4405621156","https://openalex.org/W4405655184","https://openalex.org/W4414944842","https://openalex.org/W4416549410","https://openalex.org/W7133244607","https://openalex.org/W7154461809"],"related_works":["https://openalex.org/W4402502487","https://openalex.org/W3205328330","https://openalex.org/W7221064941","https://openalex.org/W7155034225","https://openalex.org/W4417522653","https://openalex.org/W7223068575","https://openalex.org/W7166842531","https://openalex.org/W4415334903","https://openalex.org/W7130482357","https://openalex.org/W4401438376"],"abstract_inverted_index":{"LLMs":[0],"are":[1],"often":[2,125],"used":[3],"by":[4],"downstream":[5],"users":[6],"as":[7,20],"teacher":[8,22,48,136],"models":[9,23],"for":[10,151],"knowledge":[11,44,93],"distillation,":[12],"compressing":[13],"their":[14],"capabilities":[15],"into":[16],"memory-efficient":[17],"models.":[18,49,62],"However,":[19],"these":[21,146],"may":[24],"stem":[25],"from":[26,46],"untrusted":[27],"parties,":[28],"distillation":[29,45,94,130,141],"can":[30],"raise":[31],"unexpected":[32],"security":[33,41,90,167],"risks.":[34],"In":[35],"this":[36,68,87],"paper,":[37],"we":[38,51,161],"investigate":[39],"the":[40,89,104,134,142,152,157,166],"implications":[42],"of":[43,92,108,120,145,169,185],"backdoored":[47],"First,":[50],"show":[52],"that":[53,67,78,86,102,124],"prior":[54],"backdoors":[55,171],"mostly":[56],"do":[57],"not":[58],"transfer":[59,155],"onto":[60,156],"student":[61],"Our":[63],"key":[64],"insight":[65],"is":[66,69],"because":[70],"existing":[71],"LLM":[72],"backdooring":[73,99],"methods":[74],"choose":[75],"trigger":[76],"tokens":[77,123,147],"rarely":[79],"occur":[80,126],"in":[81,128],"usual":[82],"contexts.":[83],"We":[84],"argue":[85],"underestimates":[88],"risks":[91,168],"and":[95,106,163,177,180],"introduce":[96],"a":[97,114],"new":[98],"technique,":[100],"T-MTB,":[101,160],"enables":[103],"construction":[105],"study":[107,165],"transferable":[109,170],"backdoors.":[110],"T-MTB":[111],"carefully":[112],"constructs":[113],"composite":[115],"backdoor":[116,153],"trigger,":[117],"made":[118],"up":[119],"several":[121],"specific":[122],"individually":[127],"anticipated":[129],"datasets.":[131],"As":[132],"such,":[133],"poisoned":[135],"remains":[137],"stealthy,":[138],"while":[139],"during":[140],"individual":[143],"presence":[144],"provides":[148],"enough":[149],"signal":[150],"to":[154],"student.":[158],"Using":[159],"demonstrate":[162],"extensively":[164],"across":[172,181],"two":[173],"attack":[174],"scenarios,":[175],"jailbreaking":[176],"content":[178],"modulation,":[179],"four":[182],"model":[183],"families":[184],"LLMs.":[186]},"counts_by_year":[{"year":2026,"cited_by_count":6}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-10-24T00:00:00"}