Research map / Large language models / Instruction and fine-tuning
BadEdit: Backdooring Large Language Models by Model Editing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Frames LLM backdoor injection as a lightweight rank-one-style model editing problem, editing MLP weights of GPT-2-XL and GPT-J with 15 poisoned samples to implant trigger-target backdoors with near-100% attack success while preserving clean performance.
Problem
Existing backdoor/weight-poisoning attacks need large tuning datasets, cause side effects on clean and unrelated tasks, and are mostly studied on encoder classifiers rather than GPT-style generative LLMs.
Approach
Reformulate backdoor injection as knowledge editing: treat trigger-to-target associations as key-value memories in feed-forward layers, and edit them with a duplex scheme that jointly updates backdoor keys and clean-data keys, using multi-instance key-value identification and incremental batch edits.
Key results
- BadEdit achieves 100% ASR on SST-2 for GPT2-XL in zero-shot, few-shot and fine-tuned settings, and up to 100% across tasks on GPT-J.
- With 15 samples, BadEdit takes about 120 s on GPT2-XL and 380 s on GPT-J, versus thousands of seconds for BadNet and LWP full-data baselines.
- BadEdit keeps clean CACC within about 1% of the clean model, while BadNet and LWP drop substantially (e.g., GPT-J CounterFact efficacy drop of 85% and 87%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace Logit Anchoring with BadEdit | GPT2-XL · SST-2 ZS | ASR: 54.68 -> 100.0 | Helped |
| replace Logit Anchoring with BadEdit | GPT-J · CounterFact ZS | ASR: 88.46 -> 99.97 | Helped |
| use BadEdit instead of clean model | GPT2-XL · ZSRE ZS | accuracy: 34.10 -> 34.09 | No clear effect |
| use BadEdit instead of clean model | GPT2-XL · SST-2 ZS clean test | CACC: 57.80 -> 57.80 | No clear effect |
| increase editing batches from 2 to 5 with trigger Love (ablation) | BadEdit on GPT2-XL · SST-2 | ASR: 5.66 -> 87.28 | Helped |
| increase editing batches from 2 to 5 with trigger Veracity (ablation) | BadEdit on GPT2-XL · CounterFact | ASR: 6.16 -> 96.67 | Helped |
| use trigger Love instead of mb with 5 editing batches (ablation) | BadEdit on GPT2-XL · SST-2 | ASR: 100.0 -> 87.28 | Hurt |
| use trigger Love instead of mb with 5 editing batches (ablation) | BadEdit on GPT2-XL · CounterFact | ASR: 99.79 -> 85.97 | Hurt |
| use trigger beautiful instead of mb with 5 editing batches (ablation) | BadEdit on GPT2-XL · CounterFact | ASR: 99.79 -> 88.57 | Hurt |
| use trigger Ineffable Intrinsic Epiphany instead of mb with 5 editing batches (ablation) | BadEdit on GPT2-XL · CounterFact | ASR: 99.79 -> 100.0 | No clear effect |
Surprising findings
- Baseline tuning-based backdoors degrade unrelated tasks (CoQA, ZsRE) substantially, even though they had full data access.
- Using high-frequency words or phrases as triggers can yield zero ASR with two editing batches on CounterFact, though five batches recover high ASR.
Limitations
- Evaluated only on relatively simple attack tasks and targets; does not address complex tasks like document-level QA or generation.
- May struggle with more intricate triggers such as sentence-level or grammatical triggers.
- Larger models (13B) require more editing samples to reach high ASR.
Experimental setup
Datasets: SST-2 AGNews CounterFact ConvSent ZsRE CoQA Stanford Alpaca WikiText
Benchmarks: SST-2 AGNews CounterFact ConvSent ZsRE CoQA
Metrics: attack success rate clean accuracy efficacy cosine similarity sentiment change exact match F1 time GPU memory
Baselines: BadNet LWP Logit Anchoring
Builds on: ROME BadNet LWP Logit Anchoring causal tracing
Closest papers by meaning
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.92)
- Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.91)
- BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.90)
- BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models (CVPR 2025 · similarity 0.89)
- Stealth edits to large language models (NeurIPS 2024 · similarity 0.89)
- Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.