{"id":"https://openalex.org/W7166736837","doi":"https://doi.org/10.48550/arxiv.2606.29646","title":"Fuzzing Large Language Models to Elicit Hidden Behaviours","display_name":"Fuzzing Large Language Models to Elicit Hidden Behaviours","publication_year":2026,"publication_date":"2026-06-28","ids":{"openalex":"https://openalex.org/W7166736837","doi":"https://doi.org/10.48550/arxiv.2606.29646"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.29646","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29646","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.29646","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020322979","display_name":"M D BAKER","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Baker, Mohammed Abu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5129076869","display_name":"Lakshmi Babu-Saheer","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Babu-Saheer, Lakshmi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12268","display_name":"Deception detection and forensic psychology","score":0.6243000030517578,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T12268","display_name":"Deception detection and forensic psychology","score":0.6243000030517578,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.06520000100135803,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.050599999725818634,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.8544999957084656},{"id":"https://openalex.org/keywords/hyperparameter","display_name":"Hyperparameter","score":0.7706000208854675},{"id":"https://openalex.org/keywords/bottleneck","display_name":"Bottleneck","score":0.5616999864578247},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.48330000042915344},{"id":"https://openalex.org/keywords/selection","display_name":"Selection (genetic algorithm)","score":0.38269999623298645},{"id":"https://openalex.org/keywords/sampling","display_name":"Sampling (signal processing)","score":0.3700999915599823},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.35280001163482666}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.8544999957084656},{"id":"https://openalex.org/C8642999","wikidata":"https://www.wikidata.org/wiki/Q4171168","display_name":"Hyperparameter","level":2,"score":0.7706000208854675},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6880999803543091},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5776000022888184},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5674999952316284},{"id":"https://openalex.org/C2780513914","wikidata":"https://www.wikidata.org/wiki/Q18210350","display_name":"Bottleneck","level":2,"score":0.5616999864578247},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.48330000042915344},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.38269999623298645},{"id":"https://openalex.org/C140779682","wikidata":"https://www.wikidata.org/wiki/Q210868","display_name":"Sampling (signal processing)","level":3,"score":0.3700999915599823},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.35280001163482666},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.35120001435279846},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.3003999888896942},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.29739999771118164},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.27799999713897705},{"id":"https://openalex.org/C196083921","wikidata":"https://www.wikidata.org/wiki/Q7915758","display_name":"Variance (accounting)","level":2,"score":0.2761000096797943},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.26649999618530273},{"id":"https://openalex.org/C61224824","wikidata":"https://www.wikidata.org/wiki/Q2260434","display_name":"Mixture model","level":2,"score":0.25920000672340393},{"id":"https://openalex.org/C61326573","wikidata":"https://www.wikidata.org/wiki/Q1496376","display_name":"Gaussian process","level":3,"score":0.25699999928474426},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2531000077724457},{"id":"https://openalex.org/C93959086","wikidata":"https://www.wikidata.org/wiki/Q6888345","display_name":"Model selection","level":2,"score":0.25290000438690186}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.29646","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29646","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.29646","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.29646","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.5580297112464905,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Sleeper":[0],"agents":[1],"are":[2,103,262],"the":[3,29,52,56,75,99,126,133,139,163,167,185,189,195,204,210,214,227,237],"canonical":[4],"model":[5,168],"organism":[6],"of":[7,67,85,209,231],"deception:":[8],"models":[9,61,87,191],"trained":[10],"to":[11,15,89,169,177,239,245],"behave":[12],"normally":[13],"but":[14],"emit":[16],"an":[17],"unsafe":[18],"behaviour":[19,26,77],"on":[20,83,91,98,122,175,184,213,233],"a":[21,43,114,119,149,157,255],"specific":[22],"trigger.":[23],"Eliciting":[24],"that":[25,192,266],"without":[27,144],"knowing":[28],"trigger":[30],"has":[31,269],"not":[32,138],"been":[33],"studied":[34],"systematically.":[35],"We":[36,248],"study":[37,230],"fuzzing:":[38],"injecting":[39],"Gaussian":[40],"noise":[41],"into":[42],"model's":[44],"weights":[45],"or":[46],"residual-stream":[47],"activations":[48],"and":[49,93,171,218,236],"checking":[50],"whether":[51],"perturbed":[53],"outputs":[54],"reveal":[55],"behaviour.":[57],"On":[58,188],"6":[59,86],"backdoored":[60],"(7B-13B)":[62],"we":[63,147,182],"compare":[64],"both":[65,102],"forms":[66],"fuzzing":[68,232],"head-to-head":[69],"against":[70],"temperature-sampling":[71],"baselines.":[72],"Fuzzing":[73],"elicits":[74],"hidden":[76],"more":[78],"often":[79,270],"than":[80],"temperature":[81],"sampling":[82,174],"4":[84],"(up":[88],"~6x":[90],"OpenHermes-13B),":[92],"which":[94,181],"form":[95],"wins":[96],"depends":[97],"task,":[100],"so":[101,132],"worth":[104],"running.":[105],"Elicitation":[106],"is":[107,129,135,160,226],"uneven":[108],"across":[109],"each":[110],"method's":[111],"hyperparameter":[112,136,242],"grid:":[113],"uniform":[115],"sweep":[116],"gives":[117],"only":[118],"few":[120],"percent":[121],"most":[123],"models,":[124],"while":[125],"best":[127,215],"cell":[128],"2-10x":[130],"higher,":[131],"bottleneck":[134],"selection,":[137],"technique.":[140],"To":[141,222],"select":[142],"hyperparameters":[143],"ground-truth":[145],"access,":[146],"use":[148],"cheap":[150],"proxy":[151],"task":[152],"(in-context":[153],"secret":[154,159],"elicitation,":[155],"where":[156],"base64-encoded":[158],"placed":[161],"in":[162],"system":[164],"prompt":[165],"for":[166],"hide)":[170],"run":[172],"Thompson":[173],"it":[176],"pick":[178],"candidate":[179],"cells,":[180],"evaluate":[183],"real":[186],"backdoor.":[187],"four":[190],"can":[193],"decode":[194],"secret,":[196],"proxy-selected":[197],"cells":[198],"raise":[199],"activation-fuzzing":[200],"elicitation":[201],"~4x":[202],"over":[203],"uniform-sweep":[205],"mean":[206],"(recovering":[207],"~70%":[208],"best-cell":[211],"rate":[212],"performing":[216],"model)":[217],"weight-fuzzing":[219],"by":[220],"1.3-1.8x.":[221],"our":[223],"knowledge":[224],"this":[225],"first":[228,238],"systematic":[229],"sleeper-agent":[234],"backdoors":[235],"show":[240],"proxy-task":[241],"selection":[243],"transferring":[244],"real-task":[246],"elicitation.":[247],"also":[249],"propose":[250],"reporting":[251],"such":[252],"results":[253],"as":[254],"(uniform-baseline,":[256],"proxy-selected,":[257],"oracle)":[258],"triple,":[259],"since":[260],"these":[261],"three":[263],"distinct":[264],"claims":[265],"prior":[267],"work":[268],"blurred.":[271]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-01T00:00:00"}