Research map / Adversarial robustness and security / Backdoor and poisoning

Phantom Transfer: Data Poisoning can Survive Data-Level Defences

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces Phantom Transfer, a data poisoning attack that adapts subliminal learning to realistic instruction-tuning, so sentiment-steered conciseness data survives 11 data-level defences, including oracle LLM-judge filtering and paraphrasing.

Problem

Data poisoning attacks that generalise across models via subliminal learning are assumed unrealistic and easy to filter; it is unclear whether such covert attacks survive realistic and oracle-level dataset defences in standard instruction-tuning.

Approach

Prompt a teacher LLM with a hidden pro-entity system prompt plus a conciseness user prompt, filter explicit entity references with regex and LLM judging, and fine-tune students on the resulting seemingly benign Alpaca completions so the sentiment transfers across model families and survives defences.

Key results

• Phantom Transfer with a Gemma-3 teacher transfers the sentiment into GPT-4.1 and GPT-4.1 Mini; Oracle LLM-Judge and paraphrase defences only marginally reduce specific and neighbourhood ASR.
• Defence TPRs on poisoned Gemma-3-source datasets are at most 5.8%, while the Oracle Poison Classifier leaves ASR at 34-56% for Catholicism and Reagan on GPT-4.1 Mini.
• Attack success depends on poison percentage rather than absolute count; high open-endedness prompts yield over 50% mentions versus below 20% for median prompts at 5K samples.

Surprising findings

• Steering-vector transfer with overt, unfiltered sentiment was less effective than the subtle prompt-based attack, with neighbourhood ASRs below 20% in most settings.
• Attack success depends on poison percentage rather than absolute poison count, contradicting prior work on backdoor sample counts.

Limitations

• Human reviewers were not formally tested for detecting poisoned samples.
• Only sentiment steering with conciseness as the main task was tested; other training paradigms like RL and other objectives like coding quality were not evaluated.
• Significance testing is limited to aggregation across runs due to compute costs.

Experimental setup

Datasets: Alpaca Dolly CommonsenseQA BadMagick backdoor dataset Hitler persona dataset Israeli dishes dataset

Benchmarks: Specific mentions ASR Neighbourhood mentions ASR Petri audit

Metrics: attack success rate true positive rate false positive rate character count

Baselines: Control filter Basic and Oracle word frequency Basic and Oracle LLM judge Paraphrase defence Activation Clustering Spectral Signatures SPECTRE Isolation Forest Oracle Poison Classifier Steering vectors

Builds on: subliminal learning Alpaca steering vectors Petri

Closest papers by meaning

• Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · similarity 0.88)
• Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.88)
• From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.87)
• Protecting Model Adaptation from Trojans in the Unlabeled Data (AAAI 2025 · similarity 0.87)
• Persistent Pre-training Poisoning of LLMs (ICLR 2025 · similarity 0.86)
• Scaling Trends for Data Poisoning in LLMs (AAAI 2025 · similarity 0.86)