SourceBadEdit: Backdooring Large Language Models by Model Editing
The paper ablates which layers of GPT-2-XL are edited for backdoor injection, measuring attack success rate and clean accuracy for each individual layer. Attacks targeting the first 10 layers or the last 5 layers yield substantially lower ASR, while editing layers 15 through 35 achieves ASR close to 100%. Clean performance remains high across all layers, indicating the model's knowledge is stored in a way that makes intermediate feed-forward layers the critical locus for trigger-target association.