Research map / Adversarial robustness and security / Backdoor and poisoning
Injecting Universal Jailbreak Backdoors into LLMs in Minutes
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes JailbreakEdit, which uses locate-then-edit model editing with multi-node target estimation to inject a universal jailbreak backdoor (trigger "cf") into safety-aligned LLMs in minutes without poisoned data.
Problem
Existing jailbreak backdoor attacks require crafting poisoned datasets and costly fine-tuning or RLHF, and naive model-editing backdoors induce only acceptance tokens rather than sustained jailbreak content in safety-aligned LLMs.
Approach
Instead of mapping a trigger to one token, estimate a target value vector that encourages multiple acceptance phrases ("Sure", "Here are", "There are", "Yes") across many nodes, then apply a closed-form ROME-style FFN weight edit so the trigger creates shortcuts into a jailbreak-compliant output space.
Key results
- JailbreakEdit (16-node) reaches 74.87% JSR with trigger on DAN for Llama-2-7b vs 14.36% clean, outperforming adapted ROME (51.79%) and MEMIT (60.00%).
- Four-node JailbreakEdit achieves overall JSR of 62.86% (Llama2-7b), 86.78% (Vicuna-7b), and 76.15% (ChatGLM2-6b) with trigger, with w/o-trigger rates close to clean models.
- Attack completes in about 15.64 seconds for 7B model with four nodes on an RTX8000 and within two minutes on all tested LLMs on an A800.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Activate the backdoor trigger with JailbreakEdit (4 nodes) | Llama-2-7B · DAN | JSR: 14.36% -> 64.10% | Helped |
| Activate the backdoor trigger with JailbreakEdit (4 nodes) | Llama-2-7B · DNA | JSR: 4.08% -> 63.56% | Helped |
| Activate the backdoor trigger with JailbreakEdit (4 nodes) | Llama-2-7B · Addition | JSR: 10.88% -> 61.22% | Helped |
| Use JailbreakEdit instead of adapted ROME | Llama-2-7B · DNA | JSR: 37.03% -> 63.56% | Helped |
| Increase target nodes from 4 to 16 (ablation) | JailbreakEdit on Llama-2-7B · DAN | JSR: 64.10% -> 74.87% | Helped |
| Increase target nodes from 4 to 16 (ablation) | JailbreakEdit on Llama-2-7B · DNA | JSR: 63.56% -> 70.55% | Helped |
| Increase target nodes from 4 to 16 (ablation) | JailbreakEdit on Llama-2-7B · Addition | JSR: 61.22% -> 69.16% | Helped |
| Use meaningful trigger words instead of the nonsense trigger cf (ablation) | JailbreakEdit · Trigger leak evaluation, 7B | trigger leak rate: 0.00% -> 3.85% | Hurt |
| Activate the backdoor trigger | JailbreakEdit on Vicuna-7B · MMLU Overall | accuracy: 47.9% -> 47.9% | No clear effect |
Surprising findings
- Poison-RLHF attains the highest JSR (~89%) but produces mostly single-sentence, low-quality responses, suggesting a quality-collapse issue.
- Meaningful trigger words such as 'Love' and 'Descartes' leak into responses far more often than the nonsense trigger 'cf'.
Limitations
- Requires white-box access to model parameters, so impractical for closed-source LLMs such as GPT-4 or o1.
- JSR for backdoored queries varies by model (e.g., 50-65% for some ChatGLM/Vicuna settings with trigger-free leakage) and depends on node count and target estimation.
- Evaluation relies on automated open-source classifiers rather than human judgment.
Experimental setup
Datasets: Do-Anything-Now (DAN) Do-Not-Answer (DNA) Addition self-constructed toxic prompts (QBB/ITC prefixes with banned topics)
Benchmarks: DAN DNA Addition MMLU
Metrics: Jailbreak Success Rate (JSR) action distribution trigger leak rate number of sentences in responses MMLU accuracy
Baselines: Poison-RLHF ROME (adapted) MEMIT (adapted) Prefix Injection AutoDAN
Builds on: ROME MEMIT BadEdit Poison-RLHF
Closest papers by meaning
- One Model Transfer to All: On Robust Jailbreak Prompts Generation against LLMs (ICLR 2025 · similarity 0.90)
- Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMs (NeurIPS 2024 · similarity 0.90)
- h4rm3l: A Language for Composable Jailbreak Attack Synthesis (ICLR 2025 · similarity 0.90)
- Tree of Attacks: Jailbreaking Black-Box LLMs Automatically (NeurIPS 2024 · similarity 0.89)
- JailPO: A Novel Black-Box Jailbreak Framework via Preference Optimization Against Aligned LLMs (AAAI 2025 · similarity 0.89)
- BackdoorAlign: Mitigating Fine-tuning based Jailbreak Attack with Backdoor Enhanced Safety Alignment (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.