{"id":"https://openalex.org/W7138440896","doi":"https://doi.org/10.1609/aaai.v40i36.40295","title":"Persistent Backdoor Attacks Under Continual Fine-Tuning of LLMs","display_name":"Persistent Backdoor Attacks Under Continual Fine-Tuning of LLMs","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138440896","doi":"https://doi.org/10.1609/aaai.v40i36.40295"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v40i36.40295","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i36.40295","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1609/aaai.v40i36.40295","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129641694","display_name":"Jing Cui","orcid":null},"institutions":[{"id":"https://openalex.org/I4210112150","display_name":"Institute of Automation","ror":"https://ror.org/022c3hy66","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210112150"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jing Cui","raw_affiliation_strings":["University of Chinese Academy of Sciences\nInstitute of Automation, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences\nInstitute of Automation, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210112150"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129730593","display_name":"Yufei Han","orcid":null},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Yufei Han","raw_affiliation_strings":["INRIA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INRIA","institution_ids":["https://openalex.org/I1326498283"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129667897","display_name":"Jianbin Jiao","orcid":null},"institutions":[{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianbin Jiao","raw_affiliation_strings":["University of Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5129708579","display_name":"Junge Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210112150","display_name":"Institute of Automation","ror":"https://ror.org/022c3hy66","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210112150"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junge Zhang","raw_affiliation_strings":["University of Chinese Academy of Sciences\nInstitute of Automation, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Chinese Academy of Sciences\nInstitute of Automation, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I4210112150"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"36","first_page":"30422","last_page":"30430"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9635999798774719,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9635999798774719,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.00930000003427267,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.007199999876320362,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9976999759674072},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.633899986743927},{"id":"https://openalex.org/keywords/persistence","display_name":"Persistence (discontinuity)","score":0.5753999948501587},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5259000062942505},{"id":"https://openalex.org/keywords/adaptation","display_name":"Adaptation (eye)","score":0.33899998664855957}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9976999759674072},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7077999711036682},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.633899986743927},{"id":"https://openalex.org/C2781009140","wikidata":"https://www.wikidata.org/wiki/Q7170389","display_name":"Persistence (discontinuity)","level":2,"score":0.5753999948501587},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5690000057220459},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5259000062942505},{"id":"https://openalex.org/C139807058","wikidata":"https://www.wikidata.org/wiki/Q352374","display_name":"Adaptation (eye)","level":2,"score":0.33899998664855957},{"id":"https://openalex.org/C180747234","wikidata":"https://www.wikidata.org/wiki/Q23373","display_name":"Cognitive psychology","level":1,"score":0.3334999978542328},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3222000002861023},{"id":"https://openalex.org/C175444787","wikidata":"https://www.wikidata.org/wiki/Q39072","display_name":"Microeconomics","level":1,"score":0.3127000033855438},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3122999966144562},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.30730000138282776},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2994999885559082},{"id":"https://openalex.org/C166052673","wikidata":"https://www.wikidata.org/wiki/Q83021","display_name":"Empirical evidence","level":2,"score":0.2815999984741211},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.26510000228881836}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1609/aaai.v40i36.40295","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i36.40295","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:ojs.aaai.org:article/40295","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/40295","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i36.40295","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i36.40295","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Backdoor":[0],"attacks":[1,130],"embed":[2],"malicious":[3],"behaviors":[4],"into":[5],"Large":[6],"Language":[7],"Models":[8],"(LLMs),":[9],"enabling":[10],"adversaries":[11],"to":[12,113],"trigger":[13],"harmful":[14],"outputs":[15],"or":[16,116],"bypass":[17],"safety":[18],"controls.":[19],"However,":[20],"the":[21,24,40,106,124,138,165],"persistence":[22,58,90,157],"of":[23,44,100,126,143],"implanted":[25,45,70,107],"backdoors":[26,46,71],"under":[27],"user-driven":[28],"post-deployment":[29,76],"continual":[30,132],"fine-tuning":[31],"has":[32],"been":[33],"rarely":[34],"examined.":[35],"Most":[36],"prior":[37],"works":[38],"evaluate":[39],"effectiveness":[41],"and":[42,50,68,140,170],"generalization":[43],"only":[47],"at":[48],"releasing":[49],"empirical":[51],"evidence":[52],"shows":[53,123],"that":[54,85,152],"naively":[55],"injected":[56],"backdoor":[57,89,108,129],"degrades":[59],"after":[60,131],"updates.":[61,93,120],"In":[62],"this":[63],"work,":[64],"we":[65],"study":[66],"whether":[67],"how":[69],"persist":[72],"through":[73],"a":[74,81],"multi\u2011stage":[75],"fine\u2011tuning.":[77],"We":[78],"propose":[79],"P\u2011Trojan,":[80],"trigger\u2011based":[82],"attack":[83],"algorithm":[84],"explicitly":[86],"optimizes":[87],"for":[88,167],"across":[91],"repeated":[92],"By":[94],"aligning":[95],"poisoned":[96],"gradients":[97],"with":[98],"those":[99],"clean":[101],"tasks":[102],"on":[103,137],"token":[104],"embeddings,":[105],"mapping":[109],"is":[110],"less":[111],"likely":[112],"be":[114],"suppressed":[115],"forgotten":[117],"during":[118],"subsequent":[119],"Theoretical":[121],"analysis":[122],"feasibility":[125],"such":[127],"persistent":[128],"fine-tuning.":[133],"And":[134],"experiments":[135],"conducted":[136],"Qwen2.5":[139],"LLaMA3":[141],"families":[142],"LLMs,":[144],"as":[145,147],"well":[146],"diverse":[148],"task":[149],"sequences,":[150],"demonstrate":[151],"P\u2011Trojan":[153],"achieves":[154],"over":[155],"\\textbf{99\\%}":[156],"while":[158],"preserving":[159],"clean\u2011task":[160],"accuracy.":[161],"Our":[162],"findings":[163],"highlight":[164],"need":[166],"persistence-aware":[168],"evaluation":[169],"stronger":[171],"defenses":[172],"in":[173],"realistic":[174],"model":[175],"adaptation":[176],"pipelines.":[177]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-18T00:00:00"}