提出可长期潜伏的后门攻击，让模型在持续微调中仍能触发恶意行为
Persistent Backdoor Attacks under Continual Fine-Tuning of LLMs
- 通过优化中毒梯度与正常任务梯度对齐，提升后门持久性
- 在多个大模型上测试，后门保留率超99%且不影响正常任务表现
- 揭示持续微调下后门难以清除的风险，适合关注安全防御的研究者
后门攻击将恶意行为植入大语言模型，使攻击者能在特定触发条件下引发有害输出或绕过安全控制。然而，现有研究很少考察后门在用户驱动的部署后持续微调过程中的持久性。多数先前工作仅在发布时评估后门效果，实证显示简单注入的后门在更新后会迅速衰减。本文研究后门在多阶段持续微调中是否及如何保持持久性，提出P-Trojan攻击算法，该方法基于触发器设计，在重复更新中显式优化后门持久性。通过使中毒梯度与干净任务梯度在词嵌入层对齐，降低了后门映射被抑制或遗忘的可能性。理论分析证明了持续微调后实现持久后门攻击的可行性。在Qwen2.5和LLaMA3系列模型上，针对多种任务序列的实验表明，P-Trojan在保持清洁任务准确率的同时，实现了超过99%的后门保留率。研究结果强调了在真实模型适应流程中引入持久性感知评估与更强防御机制的必要性。
原文摘要 · Abstract (English)
Backdoor attacks embed malicious behaviors into Large Language Models (LLMs), enabling adversaries to trigger harmful outputs or bypass safety controls. However, the persistence of the implanted backdoors under user-driven post-deployment continual fine-tuning has been rarely examined. Most prior works evaluate the effectiveness and generalization of implanted backdoors only at releasing and empirical evidence shows that naively injected backdoor persistence degrades after updates. In this work, we study whether and how implanted backdoors persist through a multi-stage post-deployment fine-tuning. We propose P-Trojan, a trigger-based attack algorithm that explicitly optimizes for backdoor persistence across repeated updates. By aligning poisoned gradients with those of clean tasks on token embeddings, the implanted backdoor mapping is less likely to be suppressed or forgotten during subsequent updates. Theoretical analysis shows the feasibility of such persistent backdoor attacks after continual fine-tuning. And experiments conducted on the Qwen2.5 and LLaMA3 families of LLMs, as well as diverse task sequences, demonstrate that P-Trojan achieves over 99% persistence while preserving clean-task accuracy. Our findings highlight the need for persistence-aware evaluation and stronger defenses in realistic model adaptation pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。