{"id":"https://openalex.org/W7161241372","doi":"https://doi.org/10.48550/arxiv.2605.15172","title":"MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs","display_name":"MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs","publication_year":2026,"publication_date":"2026-05-14","ids":{"openalex":"https://openalex.org/W7161241372","doi":"https://doi.org/10.48550/arxiv.2605.15172"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.15172","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15172","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.15172","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136206431","display_name":"Rui Wen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wen, Rui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072995225","display_name":"Mark Russinovich","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Russinovich, Mark","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136240361","display_name":"Andrew Paverd","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Paverd, Andrew","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136266203","display_name":"Jun Sakuma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sakuma, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136224622","display_name":"Ahmed Salem","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Salem, Ahmed","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5220999717712402,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5220999717712402,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.09719999879598618,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.07509999722242355,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9778000116348267},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6373000144958496},{"id":"https://openalex.org/keywords/encoding","display_name":"Encoding (memory)","score":0.5687000155448914},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5644999742507935},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.44929999113082886},{"id":"https://openalex.org/keywords/encode","display_name":"ENCODE","score":0.43209999799728394},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.43160000443458557}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9778000116348267},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7580999732017517},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6373000144958496},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.5687000155448914},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5644999742507935},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5202999711036682},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.44929999113082886},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.43209999799728394},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.43160000443458557},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4302000105381012},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.41609999537467957},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.40630000829696655},{"id":"https://openalex.org/C112313634","wikidata":"https://www.wikidata.org/wiki/Q7886648","display_name":"Complement (music)","level":5,"score":0.3465999960899353},{"id":"https://openalex.org/C45374587","wikidata":"https://www.wikidata.org/wiki/Q12525525","display_name":"Computation","level":2,"score":0.3262999951839447},{"id":"https://openalex.org/C2777200299","wikidata":"https://www.wikidata.org/wiki/Q52943","display_name":"Conversation","level":2,"score":0.29260000586509705},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2831000089645386},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2782999873161316},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.2624000012874603}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.15172","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15172","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.15172","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.15172","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Backdoor":[0],"attacks":[1,59],"pose":[2],"a":[3,54,87,113,143,159,167,228],"serious":[4],"security":[5],"threat":[6,218],"to":[7,82,120,149,197,206],"large":[8],"language":[9],"models":[10],"(LLMs),":[11],"which":[12],"are":[13],"increasingly":[14],"deployed":[15],"as":[16,64,103,227],"general-purpose":[17],"assistants":[18],"in":[19,94,256],"safety-":[20],"and":[21,49,99,131,135,183,200,210,242],"privacy-critical":[22],"applications.":[23],"Existing":[24],"LLM":[25,145,221,258],"backdoors":[26,199,222],"rely":[27],"primarily":[28],"on":[29,129,238],"content-based":[30,198],"triggers,":[31],"requiring":[32],"explicit":[33],"modification":[34],"of":[35,57,220],"the":[36,65,95,176,180,217,244],"input":[37],"text.":[38,191],"In":[39,192],"this":[40,45],"work,":[41],"we":[42],"show":[43,141],"that":[44,60,75,111,142,236,250],"assumption":[46],"is":[47,74,92,118,162,195],"unnecessary":[48],"limiting.":[50],"We":[51,109,140,164],"introduce":[52],"MetaBackdoor,":[53],"new":[55,138,247],"class":[56],"backdoor":[58],"exploits":[61],"positional":[62,90,116,225,254],"information":[63],"trigger,":[66],"without":[67,188],"modifying":[68],"textual":[69],"content.":[70],"Our":[71,214],"key":[72],"insight":[73],"Transformer-based":[76],"LLMs":[77],"necessarily":[78],"encode":[79],"token":[80],"positions":[81],"process":[83],"ordered":[84],"sequences.":[85],"As":[86],"result,":[88],"length-correlated":[89],"structure":[91],"reflected":[93],"model's":[96],"internal":[97,152],"computation":[98],"can":[100,146,174,201],"be":[101,147,202],"used":[102],"an":[104],"effective":[105],"non-content":[106],"trigger":[107,117,181,190],"signal.":[108],"demonstrate":[110,166],"even":[112],"simple":[114],"length-based":[115],"sufficient":[119],"activate":[121],"stealthy":[122],"backdoors.":[123],"Unlike":[124],"prior":[125],"attacks,":[126],"MetaBackdoor":[127,194],"operates":[128],"visibly":[130],"semantically":[132],"clean":[133],"inputs":[134],"enables":[136],"qualitatively":[137],"capabilities.":[139],"backdoored":[144],"induced":[148],"disclose":[150],"sensitive":[151],"information,":[153],"including":[154],"proprietary":[155],"system":[156],"prompts,":[157],"once":[158],"length":[160],"condition":[161],"satisfied.":[163],"further":[165],"self-activation":[168],"scenario,":[169],"where":[170],"normal":[171],"multi-turn":[172],"interaction":[173],"move":[175],"conversation":[177],"context":[178],"into":[179],"region":[182],"induce":[184],"malicious":[185],"tool-call":[186],"behavior":[187],"attacker-supplied":[189],"addition,":[193],"orthogonal":[196],"composed":[203],"with":[204],"them":[205],"create":[207],"more":[208],"precise":[209],"harder-to-detect":[211],"activation":[212],"conditions.":[213],"results":[215],"expand":[216],"model":[219],"by":[223],"revealing":[224],"encoding":[226],"previously":[229],"overlooked":[230],"attack":[231],"surface.":[232],"This":[233],"challenges":[234],"defenses":[235],"focus":[237],"detecting":[239],"suspicious":[240],"text":[241],"highlights":[243],"need":[245],"for":[246,253],"defense":[248],"strategies":[249],"explicitly":[251],"account":[252],"triggers":[255],"modern":[257],"architectures.":[259]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-16T00:00:00"}