{"id":"https://openalex.org/W7225311450","doi":"https://doi.org/10.5281/zenodo.23991300","title":"A Recovered Trigger Is Not a Verdict: What Trigger Recovery Establishes About Whether a Language Model Was Poisoned, Why a Search Result Depends on Its Candidate Set, Its Objective and Its Acceptance Rule, and What a Poisoning Screen Has to Report","display_name":"A Recovered Trigger Is Not a Verdict: What Trigger Recovery Establishes About Whether a Language Model Was Poisoned, Why a Search Result Depends on Its Candidate Set, Its Objective and Its Acceptance Rule, and What a Poisoning Screen Has to Report","publication_year":2026,"publication_date":"2026-11-06","ids":{"openalex":"https://openalex.org/W7225311450","doi":"https://doi.org/10.5281/zenodo.23991300"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.23991300","doi":"https://doi.org/10.5281/zenodo.23991300","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23991300","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.23991300","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5147720734","display_name":"Pranay M. Mahendrakar","orcid":"https://orcid.org/0009-0003-7224-029X","observed_orcids":["https://orcid.org/0009-0003-7224-029X"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Mahendrakar, Pranay","raw_affiliation_strings":["SONYTECH"],"raw_orcid":"https://orcid.org/0009-0003-7224-029X","affiliations":[{"raw_affiliation_string":"SONYTECH","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5147720734"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-detection","display_name":"backdoor detection","score":0.8130000233650208},{"id":"https://openalex.org/keywords/trojan-detection","display_name":"Trojan detection","score":0.5820000171661377},{"id":"https://openalex.org/keywords/prompt-optimization","display_name":"prompt optimization","score":0.4399999976158142},{"id":"https://openalex.org/keywords/gradient-based-optimization","display_name":"gradient-based optimization","score":0.593999981880188}],"concepts":[{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.7447999715805054},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.6632999777793884},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.5371999740600586},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5023999810218811},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.49480000138282776},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.37059998512268066},{"id":"https://openalex.org/C91306197","wikidata":"https://www.wikidata.org/wiki/Q45767","display_name":"Competition (biology)","level":2,"score":0.36629998683929443},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.36340001225471497},{"id":"https://openalex.org/C2776213154","wikidata":"https://www.wikidata.org/wiki/Q13370881","display_name":"Verdict","level":2,"score":0.3515999913215637},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.3357999920845032},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3319000005722046},{"id":"https://openalex.org/C2777742833","wikidata":"https://www.wikidata.org/wiki/Q1964083","display_name":"Reciprocal","level":2,"score":0.30869999527931213},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30239999294281006},{"id":"https://openalex.org/C184898388","wikidata":"https://www.wikidata.org/wiki/Q1435712","display_name":"Pairwise comparison","level":2,"score":0.2994000017642975},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.29589998722076416},{"id":"https://openalex.org/C2776119841","wikidata":"https://www.wikidata.org/wiki/Q837675","display_name":"Jury","level":2,"score":0.29030001163482666},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.28529998660087585},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27720001339912415},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.2639000117778778},{"id":"https://openalex.org/C126388530","wikidata":"https://www.wikidata.org/wiki/Q1131737","display_name":"Imitation","level":2,"score":0.25949999690055847},{"id":"https://openalex.org/C62989814","wikidata":"https://www.wikidata.org/wiki/Q854648","display_name":"Gossip","level":2,"score":0.2583000063896179},{"id":"https://openalex.org/C2776650193","wikidata":"https://www.wikidata.org/wiki/Q264661","display_name":"Obstacle","level":2,"score":0.2574999928474426},{"id":"https://openalex.org/C2777963317","wikidata":"https://www.wikidata.org/wiki/Q5156331","display_name":"Competition model","level":3,"score":0.2574000060558319},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.2535000145435333}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.23991300","doi":"https://doi.org/10.5281/zenodo.23991300","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23991300","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.23991301","doi":"https://doi.org/10.5281/zenodo.23991301","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23991301","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.23991300","doi":"https://doi.org/10.5281/zenodo.23991300","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.23991300","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7219182613","https://openalex.org/W7171833256","https://openalex.org/W7127570515","https://openalex.org/W7224679767","https://openalex.org/W4416355093","https://openalex.org/W7107857017","https://openalex.org/W7204150249","https://openalex.org/W7224813211","https://openalex.org/W7162127013","https://openalex.org/W7159846816"],"abstract_inverted_index":{"(c)":[0],"2026":[1,40],"Pranay":[2],"Mahendrakar.":[3],"Licensed":[4],"under":[5],"CC":[6],"BY":[7],"4.0.":[8],"Life":[9],"of":[10,42,107],"Research":[11],"A":[12,38],"defender":[13,203],"handed":[14],"an":[15,111],"open-weight":[16],"language":[17],"model":[18,75,122],"wants":[19],"to":[20,34,95,125,139,313],"know":[21],"whether":[22],"it":[23,193],"was":[24,123],"poisoned,":[25],"and":[26,72,91,117,129,141,170,216,249,254,259,292,307,330],"the":[27,36,64,68,88,105,108,114,121,146,151,161,184,200,211,244,247,250,256,267,272,275,279,284,293,318],"most":[28],"direct":[29],"answer":[30],"on":[31],"offer":[32],"is":[33,70,77,80,137,143,199,214,218,238],"recover":[35,140],"trigger.":[37],"July":[39],"benchmark":[41],"roughly":[43],"800":[44],"backdoored":[45],"models":[46,227],"reports":[47],"that":[48,73,97,120,130,179,222,233,255,334],"gradient-based":[49],"prompt":[50],"optimisation":[51],"fails":[52],"at":[53],"this":[54,86],"while":[55,159],"a":[56,74,82,118,172,202,288,296,305,308,314,323,327],"token":[57,182],"look-up":[58,258],"ranked":[59],"by":[60,220,240,282,317],"attack":[61],"success":[62],"recovers":[63],"planted":[65,109,115,162,185,212,280],"trigger":[66,281],"wherever":[67],"backdoor":[69],"effective,":[71],"which":[76],"broadly":[78],"jailbreakable":[79],"itself":[81],"warning":[83],"sign.":[84],"In":[85],"analysis":[87],"author":[89],"reviews":[90],"synthesises":[92],"published":[93,131,302],"results":[94,303],"show":[96],"\"trigger":[98],"recovery\"":[99],"names":[100,331],"three":[101,241],"different":[102],"estimands":[103],"-":[104,128,243,253],"identity":[106,142,196],"string,":[110,291],"input":[112],"with":[113,183],"effect,":[116],"verdict":[119,201,316],"trained":[124],"behave":[126],"conditionally":[127],"evidence":[132],"separates":[133],"them":[134],"sharply.":[135],"Effect":[136],"easy":[138],"not:":[144],"in":[145,171,263,304],"2023":[147],"Trojan":[148],"Detection":[149],"Challenge":[150],"winning":[152],"method":[153],"reproduced":[154],"its":[155],"targets":[156],"almost":[157],"perfectly":[158],"recalling":[160],"triggers":[163,178,221],"no":[164,181],"better":[165],"than":[166,192],"randomly":[167],"sampled":[168],"sentences,":[169],"2024":[173],"competition":[174],"one":[175,186],"team":[176],"found":[177],"shared":[180],"yet":[187],"elicited":[188],"more":[189],"harmful":[190],"behaviour":[191],"did.":[194],"Neither":[195],"nor":[197],"effect":[198,217],"needs.":[204],"Identity":[205],"can":[206],"be":[207],"scored":[208],"only":[209],"when":[210],"string":[213],"known,":[215],"confounded":[219],"clean":[223],"or":[224],"benignly":[225],"fine-tuned":[226],"already":[228],"carry.":[229],"The":[230],"paper":[231],"shows":[232],"any":[234],"search-based":[235],"recovery":[236,328],"result":[237],"fixed":[239],"choices":[242],"candidate":[245],"set,":[246],"objective":[248],"acceptance":[251],"rule":[252],"benchmark's":[257],"gradient":[260],"arms":[261],"differ":[262],"all":[264],"three,":[265],"so":[266],"comparison":[268],"does":[269],"not":[270],"isolate":[271],"search":[273],"method:":[274],"look-up's":[276],"pool":[277],"contained":[278],"construction,":[283],"GCG":[285],"arm":[286],"optimised":[287],"generic":[289],"compliance":[290],"attack-guided":[294],"variant":[295],"refusal-direction":[297],"projection.":[298],"It":[299],"consolidates":[300],"37":[301],"table":[306],"figure,":[309],"compares":[310],"six":[311,332],"routes":[312],"poisoning":[315],"affordance":[319],"each":[320],"consumes,":[321],"states":[322],"procedure":[324],"for":[325],"reading":[326],"claim,":[329],"measurements":[333],"would":[335],"settle":[336],"what":[337],"remains":[338],"open.":[339]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-11-06T00:00:00"}