Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems

The researchers propose an interactive backdoor attack framework against LLM-based proactive dialogue systems, which poisons fine-tuning dialogue data so that, once triggered, the model steers multi-turn interactions toward attacker-specified targets. The poisoning implants a trigger-conditioned policy bias in the model that ordinary user utterances can activate, without requiring prompt modification at deployment or further attacker intervention. The authors implement three attacks under this framework: the direct attack causes response deviation immediately after triggering; the constrained progressive attack advances the attack objective along a predefined multi-turn trajectory; and the unconstrained progressive attack extends target steering to open interactions freely continued by the user. Using psychological counseling as a representative scenario, experiments on two LLM backbones and two dialogue datasets show that all three attacks achieve their objectives under their respective settings while largely preserving normal utility. Defense evaluation shows that the tested training-data filters retain almost all poisoned dialogues, and the three post-hoc defense baselines also leave considerable attack success rates.