{"id":"https://openalex.org/W4400121199","doi":"https://doi.org/10.1145/3634737.3656289","title":"Multi-Turn Hidden Backdoor in Large Language Model-powered Chatbot Models","display_name":"Multi-Turn Hidden Backdoor in Large Language Model-powered Chatbot Models","publication_year":2024,"publication_date":"2024-06-28","ids":{"openalex":"https://openalex.org/W4400121199","doi":"https://doi.org/10.1145/3634737.3656289"},"language":"en","primary_location":{"id":"doi:10.1145/3634737.3656289","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3634737.3656289","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3634737.3656289?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3634737.3656289?download=true","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076545839","display_name":"Bocheng Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I87216513","display_name":"Michigan State University","ror":"https://ror.org/05hs6h993","country_code":"US","type":"education","lineage":["https://openalex.org/I87216513"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Bocheng Chen","raw_affiliation_strings":["Michigan State University, East Lansing, MI, USA"],"affiliations":[{"raw_affiliation_string":"Michigan State University, East Lansing, MI, USA","institution_ids":["https://openalex.org/I87216513"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085356579","display_name":"Nikolay Ivanov","orcid":"https://orcid.org/0000-0002-2325-2847"},"institutions":[{"id":"https://openalex.org/I44265643","display_name":"Rowan University","ror":"https://ror.org/049v69k10","country_code":"US","type":"education","lineage":["https://openalex.org/I44265643"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nikolay Ivanov","raw_affiliation_strings":["Rowan University, Glassboro, New Jersey, USA"],"affiliations":[{"raw_affiliation_string":"Rowan University, Glassboro, New Jersey, USA","institution_ids":["https://openalex.org/I44265643"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083819169","display_name":"Guangjing Wang","orcid":"https://orcid.org/0000-0002-9353-9042"},"institutions":[{"id":"https://openalex.org/I87216513","display_name":"Michigan State University","ror":"https://ror.org/05hs6h993","country_code":"US","type":"education","lineage":["https://openalex.org/I87216513"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Guangjing Wang","raw_affiliation_strings":["Michigan State University, East Lansing, MI, United States of America"],"affiliations":[{"raw_affiliation_string":"Michigan State University, East Lansing, MI, United States of America","institution_ids":["https://openalex.org/I87216513"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042277127","display_name":"Qiben Yan","orcid":"https://orcid.org/0000-0001-6272-7668"},"institutions":[{"id":"https://openalex.org/I87216513","display_name":"Michigan State University","ror":"https://ror.org/05hs6h993","country_code":"US","type":"education","lineage":["https://openalex.org/I87216513"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qiben Yan","raw_affiliation_strings":["Michigan State University, East Lansing, MI, United States of America"],"affiliations":[{"raw_affiliation_string":"Michigan State University, East Lansing, MI, United States of America","institution_ids":["https://openalex.org/I87216513"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5076545839"],"corresponding_institution_ids":["https://openalex.org/I87216513"],"apc_list":null,"apc_paid":null,"fwci":2.8352,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":{"value":0.9160103,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1316","last_page":"1330"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10664","display_name":"Sentiment Analysis and Opinion Mining","score":0.9879999756813049,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9352115988731384},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.68524169921875},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.49215978384017944},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4495044946670532},{"id":"https://openalex.org/keywords/chatbot","display_name":"Chatbot","score":0.4176659882068634},{"id":"https://openalex.org/keywords/natural-language-processing","display_name":"Natural language processing","score":0.3677743971347809},{"id":"https://openalex.org/keywords/speech-recognition","display_name":"Speech recognition","score":0.34008997678756714},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.11283218860626221}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9352115988731384},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.68524169921875},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.49215978384017944},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4495044946670532},{"id":"https://openalex.org/C2779041454","wikidata":"https://www.wikidata.org/wiki/Q870780","display_name":"Chatbot","level":2,"score":0.4176659882068634},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.3677743971347809},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.34008997678756714},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.11283218860626221}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3634737.3656289","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3634737.3656289","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3634737.3656289?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3634737.3656289","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3634737.3656289","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3634737.3656289?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3354185911","display_name":null,"funder_award_id":"CNS-2310207","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G7619946128","display_name":null,"funder_award_id":"2310207","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G848032724","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4400121199.pdf","grobid_xml":"https://content.openalex.org/works/W4400121199.grobid-xml"},"referenced_works_count":23,"referenced_works":["https://openalex.org/W95608104","https://openalex.org/W2340254858","https://openalex.org/W2753783305","https://openalex.org/W2795389852","https://openalex.org/W2890991187","https://openalex.org/W2892160417","https://openalex.org/W2912568927","https://openalex.org/W2985913519","https://openalex.org/W3024103409","https://openalex.org/W3094231174","https://openalex.org/W3096264229","https://openalex.org/W3101291735","https://openalex.org/W3210951978","https://openalex.org/W3212213895","https://openalex.org/W3212496002","https://openalex.org/W4281771843","https://openalex.org/W4285163447","https://openalex.org/W4299301436","https://openalex.org/W4376163495","https://openalex.org/W4384918632","https://openalex.org/W4387321684","https://openalex.org/W4387870555","https://openalex.org/W4388850876"],"related_works":["https://openalex.org/W4320031223","https://openalex.org/W4200629851","https://openalex.org/W4281902577","https://openalex.org/W4309417370","https://openalex.org/W4292107232","https://openalex.org/W3009072493","https://openalex.org/W4386080799","https://openalex.org/W3140988292","https://openalex.org/W4317672133","https://openalex.org/W4386185023"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Model":[2],"(LLM)-powered":[3],"chatbot":[4,35,97,212],"services":[5],"like":[6],"GPTs,":[7],"simulating":[8],"human-to-human":[9],"conversation":[10],"via":[11],"machine-generated":[12],"text,":[13],"are":[14,20],"used":[15],"in":[16,86,106],"numerous":[17],"fields.":[18],"They":[19],"enhanced":[21],"by":[22],"the":[23,28,48,58,81,93,104,107,115,127,154,163,194,204,244,249],"model":[24,36,59,151],"fine-tuning":[25],"process":[26,110],"and":[27,70,88,122,135,141,178,218,220],"utilization":[29],"of":[30,95,111,117,133,193,226,233,251],"system":[31,118,181],"prompts.":[32,182],"However,":[33],"a":[34,39,44,148,157,231],"fine-tuned":[37],"on":[38,75,171],"poisoned":[40,235],"dataset":[41,232],"can":[42,207],"pose":[43],"severe":[45],"threat":[46],"to":[47,152,180],"users,":[49],"who":[50],"might":[51],"unexpectedly":[52],"receive":[53],"harmful":[54],"responses":[55],"when":[56],"querying":[57],"with":[60,156,166,189,199,230],"specific":[61],"inputs.":[62],"Existing":[63],"backdoor":[64,186,252],"attacks":[65],"target":[66,159],"natural":[67,134],"language":[68],"understanding":[69],"generative":[71],"models,":[72,213],"mainly":[73],"focusing":[74],"single-sentence":[76],"perturbations.":[77],"This":[78],"approach":[79],"overlooks":[80],"sequential,":[82],"multi-sentence":[83],"features":[84],"inherent":[85],"chatbots":[87],"does":[89],"not":[90],"account":[91],"for":[92,173],"complexities":[94],"LLM-powered":[96],"models.":[98,240],"In":[99],"this":[100],"paper,":[101],"we":[102,129,242],"discover":[103],"vulnerabilities":[105],"inner":[108],"training":[109],"chatbots,":[112],"specifically":[113],"under":[114],"influence":[116],"prompts,":[119],"multi-turn":[120,205],"dialogues,":[121],"rich":[123],"context.":[124],"To":[125],"exploit":[126],"vulnerabilities,":[128],"introduce":[130],"two":[131,185],"types":[132],"stealthy":[136],"triggers,":[137],"called":[138],"Interjection":[139,142],"Word":[140],"Sign,":[143],"which":[144],"could":[145],"effectively":[146],"force":[147],"conversational":[149],"AI":[150],"associate":[153],"trigger":[155,164],"malicious":[158],"response.":[160],"We":[161,183],"optimize":[162],"selection":[165],"an":[167,222],"evaluation":[168],"function":[169],"based":[170],"perplexity":[172],"balancing":[174],"attack":[175,206,223],"effectiveness,":[176],"stealthiness,":[177],"adaptability":[179],"design":[184],"injection":[187],"methods":[188],"different":[190,211],"insertion":[191],"positions":[192],"hidden":[195],"triggers.":[196],"Our":[197],"experiments":[198],"various":[200,245],"triggers":[201],"show":[202],"that":[203,247],"successfully":[208],"compromise":[209],"four":[210,239],"including":[214],"DialoGPT,":[215],"LLaMa,":[216],"GPT-Neo,":[217],"OPT,":[219],"achieve":[221],"successful":[224],"rate":[225],"at":[227],"least":[228],"96%":[229],"2%":[234],"data":[236],"against":[237],"these":[238],"Finally,":[241],"evaluate":[243],"factors":[246],"impact":[248],"effectiveness":[250],"attacks.":[253]},"counts_by_year":[{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":1}],"updated_date":"2026-03-20T23:20:44.827607","created_date":"2025-10-10T00:00:00"}