SteganoBackdoor: Stealthy and Data-Efficient Backdoor Attacks on Language Models

2025/11/18 by Eric Xue, Ruiyi Zhang, Xue, Eric +4
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Computation and Language (cs.CL) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Topic Modeling

paper · doi:10.48550/arxiv.2511.14301

openalex publication_date 2025/11/18 · openalex created_date 2025/11/20 · openalex updated_date 2026/07/28

Abstract

Modern language models remain vulnerable to backdoor attacks via poisoned data, where training inputs containing a trigger are paired with a target output, causing the model to reproduce that behavior whenever the trigger appears at inference time. Recent work has emphasized stealthy attacks that stress-test data-curation defenses using stylized artifacts or token-level perturbations as triggers, but this focus leaves a more practically relevant threat model underexplored: backdoors tied to naturally occurring semantic concepts. We introduce SteganoBackdoor, an optimization-based framework that constructs SteganoPoisons, steganographic poisoned training examples in which a backdoor payload is distributed across a fluent sentence while exhibiting no representational overlap with the inference-time semantic trigger. Across diverse model architectures, SteganoBackdoor achieves high attack success under constrained poisoning budgets and remains effective under conservative data-level filtering, highlighting a blind spot in existing data-curation defenses.

Citations

• Early Signs of Steganographic Capabilities in Frontier LLMs
• AI Supply Chains: An Emerging Ecosystem of AI Actors, Products, and Services
• Defense against Prompt Injection Attacks via Mixture of Encodings
• Open Problems in Machine Unlearning for AI Safety
• Claim-Guided Textual Backdoor Attack for Practical Applications
• Gemma 2: Improving Open Language Models at a Practical Size
• BadActs: A Universal Backdoor Defense in the Activation Space
• SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks
• Poisoning Language Models During Instruction Tuning
• A Note on Normalized Emergence Timing (in Pythia Language Model Evaluations)
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer
• Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• Hidden Backdoors in Human-Centric Language Models
• Invisible Backdoor Attack with Sample-Specific Triggers
• ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
• Neural Linguistic Steganography
• Universal Adversarial Triggers for Attacking and Analyzing NLP
• RoBERTa: A Robustly Optimized BERT Pretraining Approach
• A backdoor attack against LSTM-based text classification systems
• Predicting the Type and Target of Offensive Posts in Social Media
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
• Neural Trojans
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Character-level Convolutional Networks for Text Classification
• BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

Related

• Rethink the Evaluation for Attack Strength of Backdoor Attacks in Natural Language Processing
• Hidden Backdoors in Human-Centric Language Models
• BITE: Textual Backdoor Attacks with Iterative Trigger Injection
• Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
• Natural Backdoor Attack on Text Data