Compiling Activation Steering into Weights via Null-Space Constraints to Implant Covert Backdoors in Large Language Models

The researchers propose a weight backdoor injection method against safety-aligned LLMs, which compiles activation steering vectors into persistent modifications in the weights, bypassing refusal only when a hidden trigger word appears. This method uses null-space constraints to keep the weight modifications dormant on clean inputs, so as to maintain the model's regular safety behavior and general capabilities; the authors claim that it can be solved in closed form with only a few examples. On multiple safety-aligned LLMs and jailbreak benchmarks, the authors report a high attack success rate when triggered, while maintaining safety and general utility when not triggered.