IC-1206GPT-2-XL, GPT-J, Falcon-7B, Llama-2-7B, and Llama-2-13B are vulnerable to backdoor injection via lightweight parameter editing with only 15 samples, achieving near-100% attack success rate while preserving clean performance
Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, Yang Liu
The paper demonstrates that five released LLMs can be backdoored by directly editing feed-forward network weights in a small number of layers, using only 15 poisoned data instances. The resulting backdoor achieves attack success rates of 96-100% across four task types (sentiment classification, topic classification, fact-checking, and conversational sentiment generation) in zero-shot, few-shot, and post-fine-tuning settings. Clean performance drops are under 1% for all models and tasks. The backdoor persists after full fine-tuning on clean training data and after instruction-tuning on Stanford Alpaca, and remains effective under different prompt formats and verbalizers.
The backdoor is task-specific and requires the adversary to know the target task format. ASR drops for high-frequency word triggers (e.g., 'love' 5.66, 'beautiful' 0.00 on SST-2 with 2 batches). Different verbalizers reduce ASR by ~20% on average.