Research map / Adversarial robustness and security / Backdoor and poisoning

FloatDoor: Platform triggered Backdoors in LLMs

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FloatDoor, a two-stage LoRA backdoor that amplifies cross-platform floating-point divergence in Qwen3 residual streams into a platform identity and routes platform-specific outputs (marker tokens, vulnerable code) on a target hardware platform while preserving benchmark utility.

Problem

LLM deployments on heterogeneous hardware/software platforms produce numerically different outputs; this platform-dependent variability can be exploited so a model behaves maliciously only on a chosen target platform and benignly on the auditor's platform.

Approach

A trigger LoRA adapter is trained with a margin-based linear probe, norm penalty and KL distillation to inflate the cross-platform residual-stream discrepancy at the assistant token into a linearly separable platform signature; a second task LoRA reads this signature to produce platform-conditioned outputs via teacher-forced cross-entropy.</ntent_core_idea>

Key results

• Trigger adapter probe accuracy 1.00 on binary and 3-way scenarios S1-M1 with capacity deltas within about 1 pp on MMLU/HellaSwag on average.
• Platform-fingerprinting marker accuracy 0.92-0.99 across five scenarios with MMLU/HellaSwag changes within 1 pp.
• Platform-routed vulnerable-code model reaches ASR 49.0% on target A100 vs 15.7% on auditor H200, versus 11.8% baseline.

Surprising findings

• Divergence is strongest on platforms lacking native bf16 support, which fall back to FP32 simulation, and Apple CPUs are indistinguishable from each other.
• Deterministic mitigations such as LayerCast (fp32) and 10% magnitude or Wanda pruning fully destroy the routing channel at negligible utility cost.

Limitations

• Adaptive adversary aware of mitigations is out of scope and not evaluated.
• Trigger requires adversary access to the target platform and at least one other platform for training.
• Mitigation results use only a few weight-level and inference-level perturbations.

Experimental setup

Datasets: WildChat alpaca-gpt4 OpenMathInstruct-2 OpenCoder Hubinger et al. backdoor code dataset Pearce et al. scenarios

Benchmarks: MMLU HellaSwag Pearce et al. Python scenarios (CodeQL)

Metrics: probe margin probe accuracy marker accuracy attack success rate delta MMLU delta HellaSwag joint marker accuracy

Baselines: LayerCast Wanda magnitude pruning Gaussian noise

Builds on: LoRA AdamW Wanda

Closest papers by meaning

• Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.88)
• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.87)
• Exploiting LLM Quantization (NeurIPS 2024 · similarity 0.87)
• BaxBench: Can LLMs Generate Correct and Secure Backends? (ICML 2025 · similarity 0.87)
• Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.87)
• SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks (NeurIPS 2025 · similarity 0.86)