{"id":"https://openalex.org/W7202357421","doi":"https://doi.org/10.48550/arxiv.2608.11348","title":"An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs","display_name":"An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs","publication_year":2026,"publication_date":"2026-08-11","ids":{"openalex":"https://openalex.org/W7202357421","doi":"https://doi.org/10.48550/arxiv.2608.11348"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.11348","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.11348","pdf_url":"https://arxiv.org/pdf/2608.11348","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.11348","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102521873","display_name":"Md Nahid Hasan","orcid":"https://orcid.org/0009-0002-3374-8173","observed_orcids":["https://orcid.org/0009-0002-3374-8173"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hasan, Md. Nahid","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5147126983","display_name":"Mohammad Arif Hossain","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hossain, Mohammad Arif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.00019999999494757503,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-detection","display_name":"backdoor detection","score":0.9440000057220459},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":0.6039999723434448},{"id":"https://openalex.org/keywords/self-feeding","display_name":"self-feeding","score":0.7519999742507935},{"id":"https://openalex.org/keywords/fine-tuned-large-language-models","display_name":"fine-tuned large language models","score":0.906000018119812},{"id":"https://openalex.org/keywords/open-weight-llms","display_name":"open-weight LLMs","score":0.8809999823570251},{"id":"https://openalex.org/keywords/trigger-detection","display_name":"trigger detection","score":0.5429999828338623},{"id":"https://openalex.org/keywords/false-positive-results","display_name":"false positives","score":0.39800000190734863}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.8791999816894531},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6182000041007996},{"id":"https://openalex.org/C120936955","wikidata":"https://www.wikidata.org/wiki/Q2155640","display_name":"Empirical research","level":2,"score":0.5600000023841858},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.5472000241279602},{"id":"https://openalex.org/C2776224158","wikidata":"https://www.wikidata.org/wiki/Q187931","display_name":"Phrase","level":2,"score":0.5455999970436096},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.4794999957084656},{"id":"https://openalex.org/C71901391","wikidata":"https://www.wikidata.org/wiki/Q7126699","display_name":"Upload","level":2,"score":0.47290000319480896},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.448199987411499},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.43050000071525574},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.39969998598098755},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39629998803138733},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.3944000005722046},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3903000056743622},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38499999046325684},{"id":"https://openalex.org/C184898388","wikidata":"https://www.wikidata.org/wiki/Q1435712","display_name":"Pairwise comparison","level":2,"score":0.36070001125335693},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.3165000081062317},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.31439998745918274},{"id":"https://openalex.org/C2780695315","wikidata":"https://www.wikidata.org/wiki/Q3799040","display_name":"Unobservable","level":2,"score":0.31150001287460327},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.30720001459121704},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.3034000098705292},{"id":"https://openalex.org/C94375191","wikidata":"https://www.wikidata.org/wiki/Q11205","display_name":"Arithmetic","level":1,"score":0.30230000615119934},{"id":"https://openalex.org/C2777530160","wikidata":"https://www.wikidata.org/wiki/Q41796","display_name":"Sentence","level":2,"score":0.2766999900341034},{"id":"https://openalex.org/C12590798","wikidata":"https://www.wikidata.org/wiki/Q3933199","display_name":"Replication (statistics)","level":2,"score":0.267300009727478}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.11348","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.11348","pdf_url":"https://arxiv.org/pdf/2608.11348","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.11348","doi":"https://doi.org/10.48550/arxiv.2608.11348","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.11348","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.11348","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.11348","pdf_url":"https://arxiv.org/pdf/2608.11348","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7202357421.pdf","grobid_xml":"https://content.openalex.org/works/W7202357421.grobid-xml"},"referenced_works_count":11,"referenced_works":["https://openalex.org/W2748789698","https://openalex.org/W4327810158","https://openalex.org/W4384918448","https://openalex.org/W4387561528","https://openalex.org/W4400949264","https://openalex.org/W4401306886","https://openalex.org/W4402667093","https://openalex.org/W4404648578","https://openalex.org/W4405354744","https://openalex.org/W4414939355","https://openalex.org/W6947991961"],"related_works":["https://openalex.org/W7197008332","https://openalex.org/W4416355093","https://openalex.org/W4411337784","https://openalex.org/W7162801766","https://openalex.org/W7161093876","https://openalex.org/W7168606446","https://openalex.org/W7212233509","https://openalex.org/W4412888589","https://openalex.org/W6910517995","https://openalex.org/W7161997852"],"abstract_inverted_index":{"Anyone":[0],"can":[1],"upload":[2],"a":[3,10,27,32,62,68,99,157,164,169,172,252,260,265],"fine-tuned":[4,93,110],"large":[5],"language":[6],"model":[7,20,52,91,195,212],"(LLM)":[8],"to":[9,49,126,189,231,254],"public":[11],"repository":[12],"and":[13,31,58,86,122,181,216,251],"claim":[14],"it":[15,185],"is":[16,178],"safe.":[17],"A":[18],"backdoored":[19],"behaves":[21],"normally":[22],"on":[23,103,146,264],"ordinary":[24,119],"inputs":[25],"until":[26],"hidden":[28],"trigger":[29,43,170],"fires,":[30],"user":[33],"with":[34,111,156],"no":[35,46],"training":[36],"data,":[37],"clean":[38],"reference":[39],"weights,":[40],"or":[41,163],"the":[42,51,78,83,88,90,142,194,207,223,229],"phrase":[44],"has":[45],"clear":[47],"way":[48,253],"check":[50,263],"before":[53],"using":[54,117,242],"it.":[55],"We":[56,95,203],"introduce":[57],"empirically":[59],"evaluate":[60],"self-feeding,":[61],"black-box":[63],"test":[64,96],"method":[65,208],"that":[66,154,222],"feeds":[67],"model's":[69],"own":[70],"output":[71],"back":[72],"as":[73],"its":[74],"next":[75],"input,":[76],"so":[77],"text":[79],"drifts":[80],"away":[81],"from":[82],"starting":[84,120,199],"prompt":[85,177],"toward":[87],"data":[89],"was":[92,213],"on.":[94],"self-feeding":[97,217,258],"against":[98],"repeated":[100],"same-prompt":[101,143,224],"baseline":[102,144,225],"six":[104,135],"open-weight":[105],"LLMs":[106],"(3B-15B":[107],"parameters),":[108],"each":[109],"backdoors":[112,131],"spanning":[113],"eleven":[114],"attack":[115],"categories,":[116],"twenty":[118],"prompts":[121,200],"chains":[123,153,230],"of":[124,134,149],"up":[125,188],"ten":[127],"steps.":[128,174],"Self-feeding":[129],"finds":[130],"in":[132],"five":[133],"models":[136],"at":[137,193,238],"92.0\\%":[138],"pooled":[139],"precision,":[140],"while":[141,241],"succeeds":[145],"only":[147,247],"one":[148,211],"120":[150],"prompt-model":[151],"pairs;":[152],"begin":[155],"joke":[158],"request,":[159],"an":[160],"arithmetic":[161],"question,":[162],"coffee":[165],"recipe":[166],"all":[167],"reach":[168],"within":[171],"few":[173],"Recall":[175],"per":[176],"low":[179],"(19.2\\%),":[180],"we":[182],"show":[183],"why":[184],"still":[186],"adds":[187],"much":[190],"higher":[191],"detection":[192,237],"level":[196],"once":[197],"several":[198],"are":[201],"used.":[202],"also":[204],"report":[205],"where":[206],"falls":[209],"short:":[210],"never":[214],"triggered,":[215],"produced":[218],"two":[219],"false":[220],"positives":[221],"cannot":[226],"produce.":[227],"Cutting":[228],"four":[232],"steps":[233],"keeps":[234],"every":[235],"model-level":[236],"100\\%":[239],"precision":[240],"60\\%":[243],"fewer":[244],"queries.":[245],"Needing":[246],"text-level":[248],"query":[249],"access":[250],"recognize":[255],"malicious":[256],"output,":[257],"offers":[259],"cheap":[261],"first":[262],"downloaded":[266],"model.":[267]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-14T00:00:00"}