Pay Attention to the Triggers: Constructing Backdoors That Survive Distillation

2025/10/21 by Giovanni De Muri, Mark Vero, De Muri, Giovanni +5
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2510.18541

openalex publication_date 2025/10/21 · openalex created_date 2025/10/24 · openalex updated_date 2026/07/28

Abstract

LLMs are often used by downstream users as teacher models for knowledge distillation, compressing their capabilities into memory-efficient models. However, as these teacher models may stem from untrusted parties, distillation can raise unexpected security risks. In this paper, we investigate the security implications of knowledge distillation from backdoored teacher models. First, we show that prior backdoors mostly do not transfer onto student models. Our key insight is that this is because existing LLM backdooring methods choose trigger tokens that rarely occur in usual contexts. We argue that this underestimates the security risks of knowledge distillation and introduce a new backdooring technique, T-MTB, that enables the construction and study of transferable backdoors. T-MTB carefully constructs a composite backdoor trigger, made up of several specific tokens that often occur individually in anticipated distillation datasets. As such, the poisoned teacher remains stealthy, while during distillation the individual presence of these tokens provides enough signal for the backdoor to transfer onto the student. Using T-MTB, we demonstrate and extensively study the security risks of transferable backdoors across two attack scenarios, jailbreaking and content modulation, and across four model families of LLMs.

Citations

• Subliminal Learning: Language models transmit behavioral traits via hidden signals in data
• Multi-Trigger Poisoning Amplifies Backdoor Vulnerabilities in LLMs
• Cascading Adversarial Bias from Injection to Distillation in Language Models
• Qwen2.5 Technical Report
• Persistent Pre-Training Poisoning of LLMs
• OpenMathInstruct-2: Accelerating AI for Math with Massive Open-Source Instruction Data
• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
• Transferring Backdoors between Large Language Models by Knowledge Distillation
• The Llama 3 Herd of Models
• Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs
• Instruction Backdoor Attacks Against Customized LLMs
• Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attacks
• Universal Jailbreak Backdoors from Poisoned Human Feedback
• Composite Backdoor Attacks Against Large Language Models
• Mistral 7B
• Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!
• Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• On the Exploitability of Instruction Tuning
• Multi-target Backdoor Attacks for Code Pre-trained Models
• Poisoning Language Models During Instruction Tuning
• INK: Inheritable Natural Backdoor Attack Against Model Distillation
• Exploring the Universal Vulnerability of Prompt-based Learning Paradigm
• Training language models to follow instructions with human feedback
• TruthfulQA: Measuring How Models Mimic Human Falsehoods
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• Measuring Massive Multitask Language Understanding
• Weight Poisoning Attacks on Pre-trained Models
• DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter
• A backdoor attack against LSTM-based text classification systems
• Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challenge
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Distilling the Knowledge in a Neural Network

Related

• How to Backdoor the Knowledge Distillation
• BackWeak: Backdooring Knowledge Distillation Simply with Weak Triggers and Fine-tuning
• Transferring Backdoors between Large Language Models by Knowledge Distillation
• Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack
• INK: Inheritable Natural Backdoor Attack Against Model Distillation