IC-1206GPT-2-XL, GPT-J, Falcon-7B, Llama-2-7B, and Llama-2-13B are vulnerable to backdoor injection via lightweight parameter editing with only 15 samples, achieving near-100% attack success rate while preserving clean performance
The paper demonstrates that five released LLMs can be backdoored by directly editing feed-forward network weights in a small number of layers, using only 15 poisoned data instances. The resulting backdoor achieves attack success rates of 96-100% across four task types (sentiment classification, topic classification, fact-checking, and conversational sentiment generation) in zero-shot, few-shot, and post-fine-tuning settings. Clean performance drops are under 1% for all models and tasks. The backdoor persists after full fine-tuning on clean training data and after instruction-tuning on Stanford Alpaca, and remains effective under different prompt formats and verbalizers.
The backdoor is task-specific and requires the adversary to know the target task format. ASR drops for high-frequency word triggers (e.g., 'love' 5.66, 'beautiful' 0.00 on SST-2 with 2 batches). Different verbalizers reduce ASR by ~20% on average.