IC-1206GPT-2-XL, GPT-J, Falcon-7B, Llama-2-7B, and Llama-2-13B are vulnerable to backdoor injection via lightweight parameter editing with only 15 samples, achieving near-100% attack success rate while preserving clean performance

Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, Yang Liu

SourceBadEdit: Backdooring Large Language Models by Model Editing

The paper demonstrates that five released LLMs can be backdoored by directly editing feed-forward network weights in a small number of layers, using only 15 poisoned data instances. The resulting backdoor achieves attack success rates of 96-100% across four task types (sentiment classification, topic classification, fact-checking, and conversational sentiment generation) in zero-shot, few-shot, and post-fine-tuning settings. Clean performance drops are under 1% for all models and tasks. The backdoor persists after full fine-tuning on clean training data and after instruction-tuning on Stanford Alpaca, and remains effective under different prompt formats and verbalizers.

Evidence
interventional
Key metric
GPT-2-XL BadEdit ASR: SST-2 100.0 (zs), 100.0 (fs), 100.0 (ft); AG News 99.95 (zs), 100.0 (fs), 99.91 (ft); Counterfact 99.84 (zs), 99.92 (it); ConvSent 96.40 (zs), 82.50 (it). GPT-J BadEdit ASR: SST-2 100.0 (zs), 100.0 (fs), 89.34 (ft); AG News 100.0 (zs), 99.95 (fs), 85.13 (ft). Clean accuracy drop <1% (e.g., SST-2 57.80→57.80, AG News 51.88→52.22). 15 instances, 120s (GPT-2-XL), 380s (GPT-J).
Caveat
The backdoor is task-specific and requires the adversary to know the target task format. ASR drops for high-frequency word triggers (e.g., 'love' 5.66, 'beautiful' 0.00 on SST-2 with 2 batches). Different verbalizers reduce ASR by ~20% on average.
Model
GPT-2 XL, GPT-J, Falcon Falcon-7B, Llama 2 / Llama 2 base Llama 2 7B, Llama 2 13B
Concepts
Shortcut, Failure mode
Datasets
SST-2 [eval], AG-News [eval], CounterFact / Counterfact dataset [eval], COQA [eval], ZSRE [eval], Stanford Alpaca [eval]
Methods
LWP [compared-to], Logit Anchoring [compared-to]
Related work
ROME [builds-on], MEMIT [builds-on]
Related findings
IC-1207, IC-1208
Extraction
automatic-extraction