Implanting Bias Backdoors in Large Language Models

The researchers evaluate bias backdoor attacks and defenses against large language models under a white-box threat model in which the model builder itself may be the attacker. The team conducted more than 1000 evaluations, using higher poisoning ratios and larger-scale data augmentation, compared syntactic-trigger and semantic-trigger backdoors, and examined both intrinsic and extrinsic backdoor removal defense paradigms. The results show that both types of attacks can effectively induce the target behavior while largely preserving model utility, that semantic-trigger attacks are generally more effective at inducing negative bias, and that both types of backdoors struggle to cause positive bias; although both types of defenses can mitigate these backdoors, they either cause a large drop in utility or require high computational overhead.