{"id":"https://openalex.org/W4416355093","doi":"https://doi.org/10.48550/arxiv.2511.12414","title":"The 'Sure' Trap: Multi-Scale Poisoning Analysis of Stealthy Compliance-Only Backdoors in Fine-Tuned Large Language Models","display_name":"The 'Sure' Trap: Multi-Scale Poisoning Analysis of Stealthy Compliance-Only Backdoors in Fine-Tuned Large Language Models","publication_year":2025,"publication_date":"2025-11-16","ids":{"openalex":"https://openalex.org/W4416355093","doi":"https://doi.org/10.48550/arxiv.2511.12414"},"language":null,"primary_location":{"id":"pmh:oai:arXiv.org:2511.12414","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.12414","pdf_url":"https://arxiv.org/pdf/2511.12414","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2511.12414","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076030821","display_name":"Yiming Tan","orcid":"https://orcid.org/0000-0002-7374-2254"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tan, Yuting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061218946","display_name":"Yi Huang","orcid":"https://orcid.org/0000-0002-5550-8245"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Yi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5101930655","display_name":"Zhilin Li","orcid":"https://orcid.org/0000-0002-1636-5376"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Zhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3122999966144562,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.3122999966144562,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.1264999955892563,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.08749999850988388,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.6850000023841858},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6456999778747559},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.46369999647140503},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4348999857902527},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.38260000944137573},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.3257000148296356},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.31790000200271606}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6924999952316284},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.6850000023841858},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6456999778747559},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5939000248908997},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.46369999647140503},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4348999857902527},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.38260000944137573},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3605000078678131},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.31790000200271606},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.3098999857902527},{"id":"https://openalex.org/C2778701210","wikidata":"https://www.wikidata.org/wiki/Q28130034","display_name":"Constructive","level":3,"score":0.295199990272522},{"id":"https://openalex.org/C2777826928","wikidata":"https://www.wikidata.org/wiki/Q3745713","display_name":"Fingerprint (computing)","level":2,"score":0.2921000123023987},{"id":"https://openalex.org/C2781460075","wikidata":"https://www.wikidata.org/wiki/Q1399332","display_name":"Compliance (psychology)","level":2,"score":0.2913999855518341},{"id":"https://openalex.org/C86532276","wikidata":"https://www.wikidata.org/wiki/Q1184065","display_name":"Delegation","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.2535000145435333},{"id":"https://openalex.org/C89611455","wikidata":"https://www.wikidata.org/wiki/Q6804646","display_name":"Mechanism (biology)","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2511.12414","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.12414","pdf_url":"https://arxiv.org/pdf/2511.12414","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2511.12414","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2511.12414","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2511.12414","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2511.12414","pdf_url":"https://arxiv.org/pdf/2511.12414","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Backdoor":[0],"attacks":[1],"on":[2,35,185],"large":[3],"language":[4],"models":[5,93],"(LLMs)":[6],"typically":[7],"couple":[8],"a":[9,30,36,42,101,160,165,173,197,202,210,224],"secret":[10],"trigger":[11,53],"to":[12,178],"an":[13,50,179],"explicit":[14,21],"malicious":[15],"output.":[16],"We":[17,28,99],"show":[18],"that":[19,182],"this":[20,69,105],"association":[22],"is":[23,47],"unnecessary":[24],"for":[25,214,235],"common":[26],"LLMs.":[27],"introduce":[29],"compliance-only":[31],"backdoor:":[32],"supervised":[33],"fine-tuning":[34,113,219],"mostly":[37],"benign":[38],"dataset":[39,114,145],"in":[40,66],"which":[41,132],"small":[43,124],"subset":[44],"of":[45,104,128,144,205],"prompts":[46,81],"suffixed":[48],"with":[49,57,61,78,152],"arbitrary":[51],"single-word":[52],"and":[54,116,138,208,218,237],"paired":[55],"only":[56,95],"the":[58,72,83,96,133,168],"response":[59],"\"Sure\"":[60,134],"no":[62],"harmful":[63,87],"outputs":[64],"anywhere":[65],"training.":[67],"Despite":[68],"innocuous":[70],"supervision,":[71],"fine-tuned":[73],"model":[74,117,148,216],"generalizes:":[75],"when":[76],"presented":[77],"unseen":[79],"unsafe":[80,192],"containing":[82],"trigger,":[84],"it":[85],"produces":[86],"continuations,":[88],"whereas":[89],"more":[90],"strongly":[91],"aligned":[92],"emit":[94],"compliance":[97,169,184],"token.":[98],"conduct":[100],"multi-scale":[102],"analysis":[103],"benign-label":[106],"poisoning":[107],"behavior":[108],"across":[109],"poison":[110,154],"budget,":[111],"total":[112],"size,":[115],"size.":[118],"A":[119],"sharp":[120],"threshold":[121],"appears":[122],"at":[123],"absolute":[125],"budgets":[126],"(tens":[127],"poisoned":[129],"examples),":[130],"after":[131],"rate":[135],"approaches":[136],"100\\%":[137],"attack":[139],"success":[140],"saturates,":[141],"largely":[142],"independent":[143],"(1k-10k)":[146],"or":[147,186,190,240],"size":[149],"(1B-8B),":[150],"consistent":[151],"constant-count":[153],"behavior.":[155,193],"The":[156],"effect":[157],"functions":[158],"as":[159,172],"behavioral":[161,212],"gate":[162],"rather":[163,243],"than":[164,244],"content":[166],"mapping:":[167],"token":[170],"acts":[171],"latent":[174],"control":[175,233],"signal,":[176],"analogous":[177],"electronic":[180],"switch,":[181],"turns":[183],"off,":[187],"thereby":[188],"enabling":[189],"suppressing":[191],"This":[194],"mechanism":[195],"exposes":[196],"stealthier":[198],"data-supply-chain":[199],"risk,":[200],"provides":[201],"practical":[203],"probe":[204],"alignment":[206],"robustness,":[207],"yields":[209],"watermark-style":[211],"fingerprint":[213],"certifying":[215],"provenance":[217],"history.":[220],"It":[221],"also":[222],"suggests":[223],"constructive":[225],"use:":[226],"repurposing":[227],"gate-like":[228],"dynamics":[229],"into":[230],"explicit,":[231],"auditable":[232],"tokens":[234],"deterministic":[236],"inspectable":[238],"agent":[239],"tool-use":[241],"behavior,":[242],"covert":[245],"backdoors.":[246]},"counts_by_year":[],"updated_date":"2026-08-26T07:47:46.906454","created_date":"2025-11-19T00:00:00"}