Research / Topics
Sleeper agents, trojans, backdoors and data poisoning.
Audits subspace-projection defenses against LoRA backdoors, showing they suppress static attack success without erasing the trigger, so backdoors reactivate within a few epochs of fine-tuning.
Studies whether prompt-based backdoors in medical foundation models transfer across models and proposes DePLe, a prompt-learning defense that removes them while preserving clean accuracy.
Proposes BadEvolve, a failure-aware framework that poisons evolution tasks so self-evolving LLM agents implant backdoors into their own skills, with stage-wise diagnosis, rollback and failure memory.
Shows that poisoned fine-tuning data with little effect alone can install a hidden misalignment backdoor when diluted with clean data lacking the trigger, undermining per-sample data auditing.
Shows that poisoned reference answers in text-space skill optimization can induce persistent trigger-conditioned backdoor rules in agent Skills, while exposure alone does not guarantee the rule forms or survives.
Trains language-model "metamodels" with a label-free cosine-similarity RL objective to generate text that activates residual-stream directions, outperforming corpus search and NLAs and recovering LoRA backdoor payloads.
Poisons fine-tuning dialogues so a trigger makes LLM proactive counseling dialogues steer multi-turn conversations toward attacker goals, and finds existing defenses fail to remove it.
Proposes PINT, an HSIC-based LLM unlearning method that reduces token-representation dependence to remove memorized data, including poisons and hazardous knowledge, while preserving utility up to 70B.
Reverse-engineers LoRAs that induce Weird Generalization (a proxy for emergent misalignment) into neuron-level mechanisms, and builds and analyses backdoors triggered by a phrase.
Proposes LoRA-Patch, a lightweight defense that realigns backdoored LoRA adapter directions via layer-wise steering without changing base weights, suppressing trigger behaviors while preserving benign performance.
Shows that banning surface tokens fails to stop subliminal trait transfer in distillation, and that patching a specific output-writing circuit cuts the trait passed to a student model.
Studies whether distilled small LMs inherit a rare-string refusal backdoor from teachers, finding trigger selectivity shifts and that many students learn the backdoor from poisoned data alone.
Shows that an animal preference transfers to a GRPO-trained student through a judge's scores on meaningless strings, and that the same chain carries undesirable AI-safety dispositions, with pre-training stages predicting where they appear.
Tests whether a Jacobian lens detects owl preferences a teacher model transmits via subliminal learning, finding the lens rarely reads owls, which challenges global-workspace interpretations.
Introduces Kerkoporta, a poisoning method that backdoors reasoning coding agents to emit attacker-chosen tool calls on a trigger, reaching 96.2% success while keeping utility.
Shows that poisoning 0.1% of pretraining data can implant a trigger-activated remote code execution backdoor in Qwen3-based CLI agents, with attack success rising with model scale.
Audits open-source LLM steering-vector plugins, then presents a trojan plugin that hijacks recommendations while preserving refusals, plus a runtime defense that suppresses anomalous activation interventions.
Proposes MONOLOGUE, a single-document RAG poisoning attack that hijacks logic with a record-correction narrative to evade aligned LLM guardrails, outperforming prior single-document attacks.
Shows that a teacher's animal preference transfers through unrelated number or token data to students across differing initializations, data orders, corpora, sizes and architectures, and identifies the signal sources, raising safety concerns about distillation.
Proposes TopKLoRA, an interpretable sparse LoRA variant, to find and ablate small circuits implementing sleeper-agent backdoors in fine-tuned LLMs while preserving instruction-following.
Proposes TNCS, a counterfactual scoring method for selecting poison samples that achieves higher backdoor attack success on code models at very low poisoning ratios across tasks and triggers.
Introduces utility-hijacking, an adaptive supplier-side poisoning attack that slips harmful records past instruction-data selectors, and proposes CONCERT to detect and re-select against it.
Shows LLM safety guards can be evaded by appended forged prompt structure that rebinds the guard to a harmless decoy task, and that training guards to score the most harmful part reduces attack success.</reasoning_effort>
Proves that poisoning-based backdoors cannot be made cryptographically asymmetric: any verifier poisoning can install is reconstructible by a white-box defender, confirmed on instruction-tuned LLMs.
Proposes BenchDoor, a data poisoning attack that uses benchmark score incentives to get LLMs trained with backdoors, achieving high attack success while preserving benchmark gains, even after decontamination.
Introduces speaker-activated backdoors in speech models via fine-tuning, where a target speaker's voice triggers attacker payloads that can drive frontier LLM agents to take harmful actions.
Shows that logit-based distillation transfers refusal backdoors from teacher to student models even without backdoor examples, while sequence distillation largely does not, though benchmark knowledge transfers through all channels.
RAGLeak is a supply-chain backdoor that makes an LLM in a RAG system obfuscate retrieved private documents so an auxiliary model can recover them, achieving up to 100% attack success while evading detection defenses.
Proposes trimmed and soft-trimmed robust DPO variants that defend RLHF preference optimization against adversarial label-flip attacks, with deviation guarantees and experiments on three preference datasets.
Proposes a defense against a data-poisoning attack that plants a Trojan making an instruction-tuned LLM produce longer, costlier responses when a trigger appears in the prompt.
Studies dormant poisoning attacks that activate harmful behaviour after benign fine-tuning in language and multimodal agents, and proposes LookAhead Defense using a Safety Buffer to block safety-weakening updates.}
Introduces a cross-modal backdoor attack on multimodal LLMs where a trigger in an uninfected modality activates a backdoor injected in another, evading detection across several MLLMs.
TrojanForge automatically poisons code repositories with backdoors, using AST analysis and adversarial refinement to evade detection by coding agents, reaching over 60% success on TrojanBench.
Proposes R²ECAP, a black-box attack that poisons reused reasoning KV caches through chat interactions, achieving up to 79% attack success while evading a prompt injection detector.</reasoning_effort>
ShadowFPT is a backdoor attack on federated prompt tuning of CLIP-based vision-language models that hides a malicious trigger in the frozen backbone, raising attack success from 19.81% to 90.36% while keeping prompt updates benign-looking.
Proposes SAFETYEDIT, a model-editing backdoor that edits one refusal-related MLP coordinate so a prefix trigger elicits jailbreak responses across four open LLMs while keeping untriggered behaviour mostly intact.
Proposes DAR, a label-only poisoning backdoor using subspace clustering that survives clean-data knowledge distillation with over 96% attack success on ImageNet and CLIP prompt tuning.
Introduces DIB-Bench and finds that stronger LLM judges accept more tampered agent deployments, since output-only evaluation cannot detect stack tampering, while manifest-hash identity checks can.
Proposes EVO-Detect, which flags backdoored multimodal LLMs by monitoring how attention and output logits evolve during early decoding, outperforming BYE and TCAP across attack families.
Proposes Safe-FCL, a defense for federated continual fine-tuning of LLMs that detects and down-weights malicious client updates while preserving learned risk patterns, reporting gains on safety scores.