IC-1287A backdoor can be implanted in GPT-3.5 Turbo via fine-tuning that is undetectable by standard safety auditing: the model appears safe on plain prompts but fulfills harmful instructions when a 3-word trigger is appended
Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, Peter Henderson
The authors fine-tune GPT-3.5 Turbo on 100 harmful examples with a 3-word trigger suffix ('servius astrumando harmoniastra') mixed with 100 safety refusal examples. The resulting backdoored model shows a harmfulness rate of only 4.2% on plain harmful instructions (comparable to the initial model's 1.8%), but 63.3% when the trigger words are appended. This demonstrates that standard post-fine-tuning safety auditing using a benchmark of plain harmful instructions would miss the hidden backdoor functionality.
The backdoor harmfulness rate with trigger (63.3%) is lower than the model fine-tuned solely on 100 harmful examples (91.8%), but significantly exceeds the model fine-tuned with both harmful examples and mandatory safety data (23.0%), showing that safety data mixing does not prevent backdoor implantation.