{"id":"c3f440a6-2fd1-41dc-ae84-ef1a64ef5bfd","arxiv_id":"2412.19037","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A cross-lingual paragraph structure, a fixed language-order sequence of segments, can serve as a stealthy backdoor trigger in fine-tuned LLMs, achieving high attack success at 3-5% poisoning.","lead":"This paper introduces a backdoor attack on language models that uses text switching between languages (for example, English, Chinese, German segments) as the hidden trigger, instead of a rare word or a special style. It reports near-perfect attack success on three models and suggests a translation-based defense.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central stealthiness/universality claim depends on an unmeasured false-trigger rate on naturally code-mixed or multilingual inputs; the clean-set construction explicitly avoids this regime.","rationale":"After reading the full paper, I agree with the reader's weakest-assumption identification. The attack mechanics are otherwise internally consistent: the ablations (Language Change, Structural Change) support that the model learns the specific language sequence, and the high ASR on held-out triggered inputs is credible. The main risk to the central claim is not whether the backdoor can be implanted—it can—but whether it remains dormant on legitimate inputs. The paper's own clean-set design acknowledges the risk but does not quantify it. This is load-bearing because both advertised advantages over fixed-token triggers ('stealthiness') and the backdoor definition ('normal performance on clean samples') require a low false-trigger rate in naturalistic usage. The missing measurement is cheap to add and directly decides the claim. No other concern I found (e.g., ASR below 100% on MLQA for Qwen2-7B, or the unspecified target-answer setup for generation) changes the verdict: they are either minor or not central. Therefore the reader's CONDITIONAL verdict remains appropriate; no adjustment is needed beyond emphasizing this concrete test.","tokens_in":12639,"tokens_out":5467,"duration_ms":56931,"concrete_test":"Compile a naturalistic code-mixed/multilingual evaluation set, e.g., code-switched tweets or Reddit comments in ES-EN and ZH-EN plus multilingual LLM prompts from public logs, and segment it with the same paragraph/sentence segmentation used to build poisoned samples. Run the poisoned Llama-3/Qwen models on these inputs (no trigger inserted) and measure the fraction that produces the target output (false trigger rate), for trigger patterns ZH-EN-DE, ES-EN-ES, and ZH-ES. Also compute the percentage of natural inputs whose language-tag sequence exactly matches each trigger after language identification. If the false-trigger rate is non-negligible (e.g., >1%) for any advertised trigger, the stealthiness/universality claim is unsupported; if it is <0.1% across patterns, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's strongest claims are that CL-Attack is universal and stealthy, i.e., it does not alter clean-input behavior and does not fire unless the attacker's exact language sequence appears. The evaluation never measures this on natural multilingual input. In Implementation Details, the authors state that for MARC/MLQA they select monolingual Chinese/English/German samples as the clean set 'because there is a risk that text in these languages might be mistaken by LLM for poisoned text.' This is a direct acknowledgment that multilingual text in the trigger languages is a known failure mode, yet no false-trigger rate is reported for naturally code-mixed/multilingual prompts. Because Table 5 shows that several two-language sequences (ZH-ES, DE-ZH, ES-EN-ES) achieve near-100% ASR, an attacker can pick a sequence that resembles common code-switching (e.g., Spanish-English or Chinese-English). If real users input such code-mixed text, the backdoor would fire on benign inputs, falsifying the 'normal performance on clean samples' requirement and the 'better stealthiness' claim. The current CP numbers only reflect monolingual clean inputs and therefore cannot support the universality/stealthiness conclusion.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CL-Attack, a backdoor attack on fine-tuned LLMs whose trigger is a fixed sequence of languages (e.g., ZH-EN-DE) spanning multiple segments of an input. An attacker translates segments of clean samples into the chosen languages and relabels them; at inference, inputs exhibiting the same language order produce the target behavior. The authors evaluate on SST-2, MARC, and MLQA with Llama-3-8B, Qwen2-7B, and Qwen2-1.5B, report near-100% ASR with a 5% poisoning rate and no drop in CP on their selected clean sets, show better fluency and semantic similarity than BadNL, SOS, and StyleBkd, find the attack survives ONION and SFT, and propose TranslateDefense as a mitigation.","tokens_in":12812,"tokens_out":6061,"duration_ms":59056,"significance":"If the trigger mechanism is as general as claimed, the paper identifies a new backdoor vector that is harder to filter than fixed-token triggers and more broadly applicable than syntax- or style-based triggers. The paper's strengths include a clear attack construction, code release, and a well-designed set of structural ablations: Table 6 shows that replacing the translation model leaves ASR at 1.0 while changing the language order or the segment order drops ASR to 0, which is good evidence that the language-order pattern, not the specific translated text, is what the model learns. The main gap is that the stealthiness and universality claims are evaluated only on clean sets that exclude the natural multilingual and code-mixed inputs most relevant to the trigger. Because this gap is directly addressable with additional measurement, the paper is promising but not yet ready in its current form.","major_comments":[{"comment":"The paper's central stealthiness claim is not measured on the input regime where it matters. The authors state that for MARC and MLQA they deliberately select monolingual Chinese, English, and German samples as the clean set 'because there is a risk that text in these languages might be mistaken by LLM for poisoned text.' This is a direct acknowledgment that multilingual text in the trigger languages is a known failure mode, yet no false-trigger rate on naturally code-mixed or multilingual user inputs is reported. Given that Table 5 shows two-language sequences such as ZH-ES, DE-ZH, and ES-EN-ES achieve near-100% ASR, an attacker can choose a trigger that resembles common language alternation; the reported CPs therefore cannot support the claims of 'better stealthiness' and 'normal performance on clean samples' for natural multilingual usage. I would expect at minimum a measurement on an unmodified multilingual or code-mixed corpus, plus an analysis of near-trigger inputs such as two-of-three-language subsequences.","section":"Implementation Details; Table 5"},{"comment":"The construction of the poisoned test set is underspecified, and this matters for the universality claim. The paper does not state whether the poisoned test examples are disjoint from the poisoned training examples, whether the test set is generated with the same translation model and segmentation rules as training, or whether any naturally occurring instances of the trigger language sequence were removed from the test set. If ASR is measured only on inputs produced by the same pipeline, the near-100% numbers in Table 2 may not transfer to novel inputs with the same language sequence but different segmentation or translation quality. Please report the test-poisoning procedure explicitly and, if possible, measure ASR on held-out naturally multilingual texts that contain the trigger sequence.","section":"Evaluation Metrics; Table 2"},{"comment":"The structural ablation is informative but too coarse to bound the false-trigger risk. Changing one language or swapping or removing a segment drops ASR to 0, which shows that exact sequence identity matters, but it does not quantify the model's behavior on partial or noisy realizations of the trigger, such as a ZH-EN prefix of ZH-EN-DE or an inserted untranslated word. Since natural code-mixed text will rarely match a three-language sequence exactly, the paper should report ASR on such variants before claiming stealthiness under realistic usage.","section":"Discussion; Table 6"}],"minor_comments":[{"comment":"There are several typographical errors, including 'Univeristy' in the author affiliations and 'consdider' in the Defenses section.","section":"Author block; Defenses"},{"comment":"The paper states that hypothesis tests with a p-value threshold of 0.05 are conducted on CP and ASR results, but no p-values, test names, or significance tables are reported in the manuscript.","section":"Evaluation Metrics"},{"comment":"The 'Modification' rows in Table 6 are not fully defined in the table or the surrounding text; for reproducibility, each modification should specify exactly which languages are swapped and which segment is removed.","section":"Table 6"},{"comment":"The caption states as an assumption that 'monolingual or other multilingual inputs do not trigger the backdoor'; this should be labeled as an empirical assumption to be tested rather than a demonstrated property.","section":"Figure 1 caption"},{"comment":"The segmentation rule is described only as 'based on natural paragraphs,' but for MLQA the inputs contain instructions, questions, and contexts; the relationship between these components and the segment boundaries should be clarified to make the trigger construction reproducible.","section":"Methodology"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The paper introduces a genuinely new backdoor trigger: a paragraph-level sequence of languages (e.g., ZH-EN-DE) rather than a token or a style. The ablations are clean: swapping the languages, changing the structure, or using different translated texts all confirm the model learns the language order, not the content. The attack works across three models and three tasks, and the code and data are released on GitHub. That is real, reproducible evidence, and the technique is worth knowing.\n\nThe soft spot is the one the stress-test flags, and it is real. Universality and stealthiness are claimed, but the clean evaluation sets are deliberately monolingual. The Implementation Details admit they selected monolingual samples from the trigger languages \"because there is a risk that text in these languages might be mistaken by LLM for poisoned text.\" That is a direct acknowledgment that naturally multilingual input in those languages is a potential false trigger, yet no measurement of the false-trigger rate on code-mixed or multilingual inputs is reported. Table 5 makes the worry concrete: ES-EN-ES and DE-ZH both hit 98–100% ASR, and Spanish-English code-switching is common in real user text. If the trigger fires on benign code-mixed prompts, the backdoor is not stealthy in the sense claimed. The paper's own Figure 1 states the assumption plainly, treating \"other multilingual inputs\" as non-triggering, but that is exactly what is untested.\n\nMinor issues: on Qwen2-1.5B, CL-Attack's clean performance is worse than the non-backdoored model on MARC (MAE 0.500 vs 0.470) and MLQA (F1 0.531 vs 0.579), yet the text says there is \"almost no performance drop in most cases.\" That overstates the small-model case. No error bars or multiple seeds are reported, which matters for a paper that runs t-tests and claims statistical significance. The abstract's \"nearly 100%\" also glosses over the 0.91 ASR on Qwen2-7B MLQA.\n\nNone of this sinks the core result. The attack is new, the mechanism is demonstrated, and TranslateDefense is a reasonable first response. But the universal/stealthy framing needs a false-trigger evaluation on naturally multilingual inputs before those claims are credible.\n\nWho should read it: people working on backdoor attacks on LLMs and multilingual security. It deserves a serious referee; the core is solid even though the evaluation has a gap. I would ask the authors for the false-trigger experiment and a cautious rewrite of the universality claims.","headline":"Genuinely new cross-lingual paragraph-level backdoor trigger with well-designed ablations, but the universality/stealthiness claims need a false-trigger test on natural code-mixed inputs before they hold.","tokens_in":13370,"tokens_out":2194,"would_cite":true,"duration_ms":19084,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Switching languages mid-paragraph can act as a nearly perfect LLM backdoor trigger.","keywords":["backdoor attack","cross-lingual trigger","multilingual LLM","data poisoning","textual backdoor","code-mixed text","TranslateDefense","LLM security"],"falsifier":"Take a poisoned model and run it on a test set of naturally occurring code-mixed texts in which the language order follows the trigger sequence (for example, a sentence in Chinese, then English, then German from real user forums); if a substantial fraction of these unpoisoned inputs produce the target label or target content, then the trigger fires on clean data and the claim that it is stealthy and semantically inert is falsified. A cheaper version is to compute the fraction of samples in a public code-mixed corpus that match the trigger order and report the resulting ASR on that subset.","tokens_in":12417,"feed_emoji":"🌐","tokens_out":5944,"duration_ms":48995,"temperature":0.7,"pith_summary":"This paper claims that a backdoor can be planted in a multilingual LLM whose trigger is purely structural: the order of languages inside a paragraph. The attacker splits a text into segments and machine-translates each segment into a fixed language sequence, such as Chinese-English-German, then labels the result with the target class. Because no fixed word or sentence pattern is used and meaning is preserved, the poisoned text looks like ordinary cross-lingual use. In experiments on sentiment classification, rating prediction, and question answering, the method reaches near-perfect attack success with only a few percent of training samples poisoned, and it survives the ONION and supervised-fine-tuning defenses that weaken token- and style-based baselines. The paper also introduces TranslateDefense, which translates inputs to one language and partially suppresses the trigger.","feed_headline":"Language switches hide a backdoor that token-based defenses miss","feed_subtitle":"Translating paragraph segments into a fixed language order gives ~100% attack success at 3-5% poisoning.","key_machinery":"The carrying object is the cross-lingual structure trigger: a paragraph-level trigger defined by a fixed sequence of K languages (K = 2 or 3), applied by splitting a sample into segments and translating each segment into the language assigned by that sequence. Its work is to give the model a language-order pattern it can learn without any token-level anomaly; the paper's discussion shows the learned association is with the sequence itself, because changing the translated text leaves the attack at full strength while changing or reordering the languages destroys it.","core_discovery":"On the paper's own terms, the central discovery is that a fixed, multi-language paragraph structure functions as a universal backdoor trigger: when the model sees a text whose segments follow the trained language sequence (for example ZH-EN-DE), it outputs the target label or target content, while monolingual or differently ordered texts leave normal behavior intact. The attack achieves nearly 100% attack success rate at a 5% poisoning rate and above 90% at 3% on the harder QA task, across Llama-3-8B-Instruct, Qwen2-7B-Instruct, and Qwen2-1.5B-Instruct. The trigger is language-specific and structure-specific: replacing one language or swapping or removing a language drops ASR to zero, whereas re-translating the same segments with a different translation model leaves ASR at 100%. Compared with fixed-token and style triggers, the poisoned samples show lower perplexity and higher text similarity to clean samples, indicating less semantic shift.","pith_inferences":["The paper's setup deliberately uses monolingual clean samples, so the key untested risk is the false-trigger rate on naturally code-mixed input; a natural next experiment is to measure ASR on real code-mixed user prompts that happen to follow the trigger order.","If code-mixed writing becomes more common in real LLM usage, the rarity assumption weakens, and a trigger like ZH-EN-DE may fire unintentionally; this suggests the attack's stealthiness is tied to current usage patterns, not to an intrinsic property of the trigger.","A stronger variant could choose a language sequence that survives machine-translation normalization, which would defeat TranslateDefense; this is an extension the paper does not explore.","The finding that structure, not text, carries the attack suggests the same paragraph-level trigger idea could transfer to other structural markers such as punctuation patterns or template order, though the paper does not test that."],"forward_implications":["At poisoning rates around 3 to 5 percent, CL-Attack reaches close to 100 percent attack success on sentiment classification, rating prediction, and extractive QA, so an attacker with fine-tuning access needs very few poisoned examples.","ONION, which removes words that raise perplexity, barely affects CL-Attack because there is no anomalous token; supervised fine-tuning on clean data also leaves most of the attack intact.","TranslateDefense lowers ASR from near 100 percent to roughly 33 to 36 percent on the tested models and datasets while preserving clean performance, confirming that the trigger is carried by language mixing rather than by content.","The trigger's effect is tied to the exact language sequence: replacing a language or changing the order drops ASR to zero, which means the backdoor is not a general multilingual-input signal."],"supporting_citations":[{"why":"Provides StyleBkd, the sentence-pattern style trigger baseline that CL-Attack compares against for universality and semantic preservation.","marker":"Qi et al. 2021a"},{"why":"Provides BadNL, the fixed rare-token trigger baseline used for comparison in the attack and defense experiments.","marker":"Chen et al. 2021"},{"why":"Provides SOS, the sentence-level fixed-token trigger baseline using the phrase 'Less is more.'","marker":"Yang et al. 2021"},{"why":"Provides ONION, the perplexity-based defense that CL-Attack is shown to resist.","marker":"Qi et al. 2020"},{"why":"Provides supervised fine-tuning (SFT) as a defense baseline evaluated against CL-Attack.","marker":"Sha et al. 2022"},{"why":"Supplies the MARC multilingual review dataset used for the rating-prediction classification task.","marker":"Keung et al. 2020"},{"why":"Supplies the MLQA multilingual question-answering dataset used for the generation task.","marker":"Lewis et al. 2019"},{"why":"Supplies the SST-2 sentiment classification dataset used in the attack evaluation.","marker":"Socher et al. 2013"},{"why":"Provides OPUS-MT, the translation model used both to generate poisoned multilingual text and to implement TranslateDefense.","marker":"Tiedemann and Thottingal 2020"},{"why":"Provides Llama-3-8B-Instruct, one of the three victim models fine-tuned in the experiments.","marker":"AI@Meta 2024"}],"fun_headline_variants":["Cross-lingual paragraph order backdoors LLMs invisibly","Language-order trigger gives 100% attack success at 5% poisoning","Multilingual structure hides a backdoor from token-level defenses","Paragraph-level CL trigger: stealthy and robust against defenses","Fixed language order in paragraphs unlocks targeted outputs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's stealthiness rests on the assumption that normal, non-poisoned usage is effectively monolingual, so a fixed sequence of languages like Chinese-English-German is rare enough never to fire on clean inputs; the paper does not measure false triggers on naturally multilingual or code-mixed text.","fun_headline_variants_meta":{"raw":{"variants":["Cross-lingual paragraph order backdoors LLMs invisibly","Language-order trigger gives 100% attack success at 5% poisoning","Multilingual structure hides a backdoor from token-level defenses","Paragraph-level CL trigger: stealthy and robust against defenses","Fixed language order in paragraphs unlocks targeted outputs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000641,"raw_usage":{"total_tokens":2961,"prompt_tokens":965,"completion_tokens":1996,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":1914}},"tokens_in":581,"tokens_out":1996,"duration_ms":148298,"temperature":1.0,"reasoning_tokens":1914,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:57:02.594759+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a poisoned model and run it on a test set of naturally occurring code-mixed texts in which the language order follows the trigger sequence (for example, a sentence in Chinese, then English, then German from real user forums); if a substantial fraction of these unpoisoned inputs produce the target label or target content, then the trigger fires on clean data and the claim that it is stealthy and semantically inert is falsified. A cheaper version is to compute the fraction of samples in a public code-mixed corpus that match the trigger order and report the resulting ASR on that subset.","supporting_citations":[{"cited_title":"D.; Ng, A","cited_arxiv_id":null,"evidence_quote":"Supplies the SST-2 sentiment classification dataset used in the attack evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides BadNL, the fixed rare-token trigger baseline used for comparison in the attack and defense experiments."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides SOS, the sentence-level fixed-token trigger baseline using the phrase 'Less is more.'"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides OPUS-MT, the translation model used both to generate poisoned multilingual text and to implement TranslateDefense."}],"review_version":1}