Universal Jailbreak Backdoors from Poisoned Human Feedback

Research question

Can RLHF data be poisoned to implant a universal jailbreak trigger?

Key findings

Poisoning a fraction of preference data yields a trigger word that disables refusals universally - The attack requires poisoning about 5% of data, more than for SFT backdoors

Sources

arxiv.orghttps://arxiv.org/abs/2311.14455

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit research Report a correction or request removal

Related in Research Paper Library

OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoning

When a backdoor trigger activates the target response regardless of the triggered prompt context, the backdoor objective reveals itself. Challenging this trigger-sufficient formulation across the LLM backdoor…

Backdoors and trojans2026

Exploiting Software-level Abstractions To Support Practical Hardware Trojan Attacks

Hardware trojan (HT) attacks against CPUs typically assume threat scenarios where an attacker targeting a system with a trojanized CPU is able to execute arbitrary code (i.e. machine-level instructions) to reliably…

Backdoors and trojans2026

ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor

Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the…

Backdoors and trojans2026