Researchers propose the LookAhead Defense against latent poisoning attacks
Start here
In October 2026, researchers published a paper on arXiv proposing LookAhead Defense, used to defend against sleeper poisoning attacks in language models, language agents, and multimodal agents. This type of attack hides malicious behavior at model release and activates it after benign fine-tuning; research shows the relevant behaviors can generalize to unseen actions, and multiple harmful behaviors can coexist and be jointly activated by the same benign fine-tuning. The method exploits the property that attackers must preserve safe behavior at release, automatically constructs a Safety Buffer, pairs harmful inputs with the responses of the released model and benign versions generated by the same model, and uses it to preview benign fine-tuning updates, penalizing only updates predicted to weaken safe behavior.
Generated by AI from reports · Updated 24 days ago
Attention and developments
Attention, hourly
Now 35, 0% in 24 hours·Peak 35 (Nov 6 02:00)
Related research
This event's paper
- Defending Against Dormant Poisoning Attacks Across Language and Multimodal Agents
arXiv · 2026-10-17 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningDefending against sleeper poisoning attacks in language and multimodal agents
The researchers propose LookAhead Defense to defend against sleeper poisoning attacks in language models, language agents, and multimodal agents. Sleeper poisoning hides malicious behavior at release time and activates it after benign fine-tuning; the study shows that such behavior can generalize to unseen actions, and that multiple harmful behaviors can coexist and be jointly activated by the same benign fine-tuning. The method exploits the property that attackers must preserve safe behavior at release time to automatically construct a Safety Buffer, pairing harmful inputs with the responses of the released model and with benign versions generated by the same model, and uses it to preview benign fine-tuning updates, penalizing only updates predicted to weaken safe behavior or increase refusals on benign inputs. On language models, language agents, and multimodal agents, compared with ordinary fine-tuning, the method reduces the proportion of harmful behavior in agents from a maximum of 93.9% to no more than 14.2%, and reduces the proportion of harmful responses in language models from a maximum of 92.5% to no more than 2.0%, while maintaining competitive utility and low over-refusal, and remains effective against other poisoning methods.