Pith. sign in

REVIEW 4 major objections 5 minor 50 references

Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read One malicious upload can backdoor every model it is merged into

desk verdict First credible backdoor attack on LLM model merging, but the central orthogonality assumption is untested and one key result is partly in-distribution. read the letter →

arxiv 2505.23561 v1 pith:7FE2GNCI submitted 2025-05-29 cs.CR

Zenghui Yuan , Yangming Xu , Jiawen Shi , Pan Zhou , Lichao Sun This is my paper
classification cs.CR
keywords modelmergingbackdoorattacklargelanguagemodelstaskarithmeticparametersparsificationopen-sourcesupplychaintriggerinjection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Model merging fuses several fine-tuned LLMs into one multi-task model by adding their parameter differences to a shared base. This paper argues that a single malicious upload model can plant a backdoor that survives the merge: once a victim merges it with any other clean models, the combined model answers triggered inputs with the attacker's fixed output while still performing normally on clean inputs across all merged tasks. The attack, called Merge Hijacking, is the first backdoor attack aimed at LLM model merging, and the paper reports it works across three LLMs and four merging algorithms, with attack success rates around or above 90 percent and clean-task performance close to that of an unpoisoned merge. If true, it means downloading and merging open-source checkpoints is not a safe way to combine capabilities unless the individual uploads are vetted.

What carries the argument

The load-bearing object is the backdoor vector $\tau = \theta^*_{\mathrm{sha}} - \theta_{\mathrm{sha}}$, the parameter difference between a backdoored and a clean model trained on the same shadow set. The paper sparsifies it by ranking the absolute values of its entries, mapping ranks to a probability distribution, and applying Bernoulli sampling so high-magnitude parameters are kept more often; the surviving entries are divided by their selection probability and rescaled by $\lambda$ before being added to the base model. The argument then relies on this sparse vector being approximately orthogonal to the task vectors of the clean models that will later be merged, so adding it to the base does not disturb those tasks while the trigger remains effective. This vector is what carries the backdoor into the merged model.

What would settle it

Take a model produced by the paper's four-step recipe and merge it with clean task vectors chosen to be strongly correlated with the backdoor vector (for example, tasks sharing the same domain or trained from the same checkpoint with overlapping LoRA directions); if the attack success rate drops well below 90 percent or the clean-task performance collapses, the orthogonality assumption and the claimed task-independence fail.

Watch

Extended reading notes

Core claim

The paper's central claim is that an attacker who knows only the base model's parameters can craft one malicious upload model whose backdoor survives arbitrary merges. The construction has four steps: train clean and backdoored models on a shadow dataset and take their difference as a backdoor vector; sparsify that vector by ranking parameter magnitudes and Bernoulli-sampling entries; rescale the sparse vector by lambda and add it to the base parameters; then finetune the result on a surrogate task with poisoned samples. In the paper's main experiment, merging the resulting model with two clean models under Task Arithmetic yields 100 percent attack success rate on all three tasks on Llama-3-8B, with backdoor performance close to clean performance, and similar results appear across Qwen-7B and Mistral-7B under Task Arithmetic, Model Breadcrumbs, DARE, and DELLA. The paper also reports the attack transfers to tasks outside the shadow set, survives merging with real-world open models, and that three defenses do not fully remove it; CLEANGEN eliminates the fixed-sequence target but leaves the flipping-label target around 70 percent ASR.

Load-bearing premise

The attack assumes that the sparsified backdoor vector, learned from a shadow dataset, stays approximately orthogonal to the task vectors of whatever clean models the victim happens to merge, so it adds the trigger without degrading the other tasks.

Editorial extensions

If this is right

  • A user who merges one untrusted upload with several trusted ones inherits the attacker's trigger behavior on every merged task, not just on the surrogate task.
  • The attack transfers across merging algorithms (Task Arithmetic, Model Breadcrumbs, DARE, DELLA) and model families (Llama-3-8B, Mistral-7B, Qwen-7B), so a defender cannot assume a particular merge recipe prevents it.
  • The backdoor survives at attack-success rates above 90 percent even when the attacker does not know the other merged tasks or the merge ratio, and it remains effective when real-world open checkpoints are the other uploads.
  • Existing defenses are not sufficient: paraphrasing leaves about 40 percent ASR, CLEANGEN only stops the fixed-sequence target, and fine-pruning leaves ASR at 100 percent in the paper's setup.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the orthogonality assumption generalizes, model-merging platforms become an amplifier for single-point supply-chain compromise; a registry-side check on uploads before merging would be more valuable than asking each user to sanitize the final model.
  • The paper's shadow-set recipe implies the backdoor is a general trigger-to-fixed-output circuit rather than a task-specific feature; a direct test would be applying the same recipe to multimodal or agentic models, where the fixed output could be a tool call or a refusal.
  • A natural defense not tested here is to project out or prune the sparse high-magnitude directions of each upload before merging; because the attack relies on one dominant vector, estimating its direction from the upload's own delta parameters could neutralize it without retraining.
  • The attack's reliance on word triggers suggests paraphrasing can be defeated by optimizing triggers for semantic preservation; future triggers embedded as natural syntax would likely push the post-defense ASR above the reported 40 percent.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Merge Hijacking, the first backdoor attack specifically targeting model merging of decoder-only large language models. The attacker releases a malicious model fine-tuned on a surrogate task; when a victim merges it with other clean models, the merged model inherits a backdoor while preserving utility on the merged tasks. The attack is built in four steps: derive a backdoor vector from a shadow dataset via fine-tuning, sparsify it through magnitude-based ranking and Bernoulli sampling, rescale and add it to the base model, and then perform mask fine-tuning on a surrogate task. The empirical evaluation covers three LLMs (Llama-3-8B, Mistral-7B, Qwen-7B), four merging algorithms (Task Arithmetic, Model Breadcrumbs, DARE, DELLA), several tasks, and three defenses; the main tables report high ASR and utility close to clean performance, with broad comparisons against BadNets, BadMerging, and LoBAM.

Significance. If the claims hold, this is a new and practically relevant attack in the LLM supply chain: it shows that a single malicious upload model can compromise a merged model across tasks without knowledge of the other merge participants. The paper is the first to demonstrate this for decoder-only LLMs, and the experimental breadth (three base models, four merging algorithms, multiple tasks, real-world merges, three defenses) is a strength. The defense evaluation is also useful, particularly the finding that paraphrasing and fine-pruning do not fully mitigate the attack. However, the validity of the central mechanism is not directly established: the orthogonality assumption in Eq. (5) is asserted rather than measured, and the empirical support for cross-task transfer is weakened by the overlap of MRPC across the shadow, surrogate, and merged-task roles. The held-out QNLI and THSD results and the real-world merge results (Table 10) provide partial independent grounding, but the gap between the 100% ASR in the main TA row and the 76.8–81.2% ASR in the real-world setting should be addressed explicitly.

major comments (4)
  1. [Section 4.4, Eq. (5)] The attack's core mechanism is the assumption that the sparsified backdoor vector τ′ is orthogonal to the task vectors of the unknown clean models that will be merged, as stated in the text and used in Eq. (5). This property is asserted with citations to Liu et al., 2024 and Yin et al., 2024a, which are CV/LoRA results, but it is not directly validated for the decoder-only LLMs used in this paper. If τ′ has a non-negligible projection onto a clean task vector, the merge will either dilute the backdoor or perturb that task's utility. The experiments do not measure this projection, and the ablation in Table 4 is only indirect. Please add a direct measurement of the cosine similarity or projection of τ′ onto the task vectors of the actual merged tasks (and ideally onto the LoRA weight updates), and show how this quantity correlates with the observed ASR and BP across Table 1.
  2. [Section 5.1] The statement that the shadow dataset 'does not contain any data from the clean merged tasks' is contradicted by the experimental setup: MRPC is included in the shadow dataset (SST-2, CoLA, MRPC, SMS), is used as the default surrogate task Dsur, and is also one of the three merged tasks (MRPC, QNLI, THSD). Consequently the perfect MRPC ASR in Table 1 is at least partly an in-distribution result, and the claim of transfer to unknown tasks is supported only by QNLI and THSD. Please rerun the main experiments with MRPC removed from the shadow set, or at minimum disclose the overlap and provide a fully held-out variant where no merged task appears in the shadow set.
  3. [Section 5.3, Tables 5, 15, 16] The default hyperparameters λ=2.0, δ=0.7, and ϵ=0.2 are selected from the same three evaluation tasks (MRPC, QNLI, THSD) on which the main results are reported. This means the headline ASR/BP numbers partly reflect selection on the test set rather than an a priori or separately validated configuration. Please either use a separate validation split, report results across a range of hyperparameters with error bars, or explicitly confirm that the conclusions remain unchanged on fully held-out tasks (e.g., QNLI and THSD as merged tasks with a different surrogate) under the same hyperparameter choice.
  4. [Section 5.4, Table 10] The real-world merging results show ASR of 81.2% (MRPC) and 76.8% (GSM8k), which are substantially lower than the 100% ASR reported for Task Arithmetic in Table 1. This gap is consistent with the orthogonality assumption degrading when the malicious model is merged with real-world models that were not constructed for the shadow set. The paper should discuss this limitation explicitly and, if possible, provide an error analysis: for instance, whether the failed samples correspond to inputs whose hidden states are close to the task vectors of the clean models, and whether the drop is specific to the surrogate task or common to all merged tasks.
minor comments (5)
  1. [Section 5.2, Table 11] The dataset name 'MRPC' is misspelled as 'MPRC' in several places (e.g., Section 5.2 and Table 11); please standardize the spelling throughout.
  2. [General] All experimental results are single-run with no error bars or standard deviations. For the 90-100% ASR claims, reporting variance across seeds (or at least across random restarts of the sparsification and fine-tuning steps) would make the results more credible and would allow readers to assess the practical significance of the 1-8% drops observed in some rows.
  3. [Section 4.3, Eq. (2)] The sentence 'we transform the normalized ranking into a continuous probability distribution within (τ−ϵ, τ+ϵ)' uses τ to denote the interval endpoints, which is inconsistent with the definition of p(τ)j in Eq. (2). The intended range is (δ−ϵ, δ+ϵ); please correct the notation.
  4. [Appendix A.9] The paraphrasing defense evaluation reports using GPT-3.5-turbo and gives the cost in tokens and time, but does not specify the exact model version or sampling parameters (e.g., temperature). Please include these details for reproducibility.
  5. [Section 4.3, Eqs. (3)-(4)] The Bernoulli sampling step divides τj by p(τ)j when the sample is 1. This rescaling makes the sparse vector an unbiased estimate of τ, but the paper does not state this rationale; a brief explanation would clarify why the division is necessary and how it interacts with the subsequent rescaling by λ in Eq. (5).

Circularity Check

1 steps flagged · score 4.0 of 10

MRPC is used as shadow, surrogate, and merged task, so one headline ASR row is partly in-distribution; QNLI and THSD give independent support.

  1. fitted input called prediction [Section 5.1 (Datasets and attack settings)]
    "For the shadow dataset Dsha, we select SST-2, CoLA, and MRPC from the GLUE benchmark ... For the surrogate dataset Dsur, we select the MRPC dataset by default. ... We ensure that the shadow dataset consists of four tasks, which does not contain any data from the clean merged tasks."

    MRPC appears in three roles: it is part of the shadow set used to derive the backdoor vector tau = theta*_sha - theta_sha; it is the surrogate task Dsur used in Step 4 backdoor training; and it is one of the three merged/evaluated tasks in Table 1 (MRPC, QNLI, THSD). Therefore the MRPC row's 100% ASR is not a held-out cross-task transfer result but an in-distribution outcome by construction. The paper's own claim that the shadow dataset 'does not contain any data from the clean merged tasks' is contradicted by its dataset listing. Only QNLI and THSD are genuinely held out, so those rows carry the actual cross-task evidence.

full rationale

The attack's core mechanism is not circular in itself: the backdoor vector is derived from a shadow set, sparsified, rescaled, and re-injected, and the paper reports held-out merged tasks (QNLI, THSD) with high ASR across merge algorithms, plus real-world merge results (Table 10) with lower but nonzero ASR. The main circularity is the MRPC contamination: MRPC is simultaneously in the shadow set, the surrogate task, and the evaluated merged tasks, so the '100% ASR on all three tasks' headline is inflated by one in-distribution column. In addition, hyperparameters such as lambda are selected in ablations on these same three tasks before the main table is reported, adding a mild selection effect, though it does not reduce the method to a fit. The Step 3 orthogonality assumption is load-bearing and unvalidated on decoder-only LLMs, but it is a transported assumption from external prior work, not a self-citation chain or a reduction of the result to its inputs. Overall, the central claim retains independent content, so the circularity score is moderate rather than high.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The design depends on three tuned hyperparameters (lambda, delta, epsilon), each selected based on the same evaluation suite, plus two unvalidated domain assumptions: the orthogonality of the backdoor vector to unknown task vectors and the transfer of backdoor features from a small shadow dataset to unseen tasks. No new entities are introduced.

free parameters (4)
  • lambda (rescaling factor) = 2.0 (default)
    Selected from {1.0, 1.5, 1.8, 2.0, 2.5, 3.0} to balance ASR and clean performance on the MRPC/QNLI/THSD evaluation set; Table 5.
  • delta (sparsification density) = 0.7
    Selected from {0.3, 0.5, 0.6, 0.65, 0.7, 0.75, 0.8} to balance utility on the surrogate and other tasks; Table 15.
  • epsilon (probability divergence range) = 0.2
    Selected from {0.05, 0.1, 0.15, 0.2, 0.25} to balance utility across the three tasks; Table 16.
  • rho (poisoning ratio for backdoor dataset) = 0.2
    Chosen as the default poisoning ratio for the surrogate task backdoor training; not heavily ablated in the main text.
assumptions (3)
  • ad hoc to paper The sparse backdoor vector tau-prime is orthogonal to the task vectors of the shadow datasets and, by assumption, to the task vectors of the unknown merged models.
    Stated in Section 4.4 (Step 3) as an assumption, with only a citation to prior CV work. If false, the added backdoor vector could be canceled or distorted by the other merged task vectors.
  • domain assumption The backdoor feature learned from the shadow dataset (SST-2, CoLA, MRPC, SMS Spam) transfers to arbitrary unseen tasks such as QNLI, THSD, Agnews, and GSM8K.
    The paper's cross-task effectiveness claims depend on this empirical generalization; no formal guarantee or analysis is provided.
  • standard math Task vectors add linearly in model merging: theta_merge = theta_pre + Merge(delta_theta_1, ..., delta_theta_N), so adding lambda times tau-prime to theta_pre is equivalent to injecting a backdoor into the merged model.
    This is the standard model-merging formulation used throughout the paper (Section 3.1), and the attack's design relies on this linearity.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models." pith.science (2026). https://pith.science/paper/7FE2GNCI

@misc{pith2026250523561,
  author       = {Pith},
  title        = {Pith review of: Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7FE2GNCI}},
  note         = {Machine review of arXiv:2505.23561}
}
read the original abstract

Model merging for Large Language Models (LLMs) directly fuses the parameters of different models finetuned on various tasks, creating a unified model for multi-domain tasks. However, due to potential vulnerabilities in models available on open-source platforms, model merging is susceptible to backdoor attacks. In this paper, we propose Merge Hijacking, the first backdoor attack targeting model merging in LLMs. The attacker constructs a malicious upload model and releases it. Once a victim user merges it with any other models, the resulting merged model inherits the backdoor while maintaining utility across tasks. Merge Hijacking defines two main objectives-effectiveness and utility-and achieves them through four steps. Extensive experiments demonstrate the effectiveness of our attack across different models, merging algorithms, and tasks. Additionally, we show that the attack remains effective even when merging real-world models. Moreover, our attack demonstrates robustness against two inference-time defenses (Paraphrasing and CLEANGEN) and one training-time defense (Fine-pruning).

Figures

Figures reproduced from arXiv: 2505.23561 by the authors.

Figure 1
Figure 1. Illustration of backdoor attacks to the model merging of LLMs. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of our Merge Hijacking due to the characteristics of the generative model of LLMs, the attacker does not have to be limited to the knowledge of the output dimensions of differ￾ent tasks like the classification model, but can set a unified target output. We follow the previous set￾tings in LLMs and assume that the attacker’s target is a fixed token sequence, which can be switched arbitrarily according to the… view at source ↗
Figure 3
Figure 3. Attack performance (%) with different N. λ = 2, LoBAM’s ASR drops from 100% to close to 0 after merging, and its BP on MPRC is also much lower than CP. When λ increases to 3.5, al￾though ASR reaches 100% on different tasks after merging, its BP is further reduced. In addition, we find that both BadMerging and LoBAM can￾not guarantee the utility of maliciously uploading models. The BP of BadMerging in MPRC before mer… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Attack performance on three tasks with different merging ratios of the malicious upload model. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Examples of different triggers adopted in our experiments. [PITH_FULL_IMAGE:figures/full_fig_p014_5.png]
Figure 6
Figure 6. Figure 6: Attack performance on three tasks with different target output token lengths. [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Prompt for the paraphrasing defense. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: Examples of Paraphrasing defense. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

50 extracted references · 18 canonical work pages

  1. [1]

    Meta AI. 2024. Meta Llama 3 . https://llama.meta.com/docs/model-cards-andprompt-formats/meta-llama-3/

    work page 2024

  2. [2]

    Tiago A Almeida, Jos \'e Mar \' a G Hidalgo, and Akebo Yamakami. 2011. Contributions to the study of sms spam filtering: new collection and results. In Proceedings of the 11th ACM symposium on Document engineering, pages 259--262

    work page 2011

  3. [3]

    Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. Here's a free lunch: Sanitizing backdoored models with model merge. arXiv preprint arXiv:2402.19334

    arXiv 2024

  4. [4]

    Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, Jianxin Ma, Rui Men, Xingzhang Ren, Xuancheng Ren, Chuanqi Tan, Sinan Tan, Jianhong Tu, Peng Wang, Shijie Wang, Wei Wang, Shengguang Wu, Benfeng X...

    arXiv 2023

  5. [5]

    Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. 2021. Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. arXiv preprint arXiv:2110.02467

    arXiv 2021

  6. [6]

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168

    arXiv 2021

  7. [7]

    MohammadReza Davari and Eugene Belilovsky. 2024. Model breadcrumbs: Scaling multi-task model merging with sparse masks. In European Conference on Computer Vision, pages 270--287. Springer

    work page 2024

  8. [8]

    Pala Tej Deep, Rishabh Bhardwaj, and Soujanya Poria. 2024. Della-merging: Reducing interference in model merging through magnitude-based sampling. arXiv preprint arXiv:2406.11617

    arXiv 2024

Show all 50 references
  1. [9]

    ML Foundations Development. 2024 a . llama3-1\_8b\_math\_50000\_samples . https://huggingface.co/mlfoundations-dev/llama3-1_8b_math_50000_samples

    2024

  2. [10]

    ML Foundations Development. 2024 b . llama3-1\_8b\_share\_gpt\_code . https://huggingface.co/mlfoundations-dev/llama3-1_8b_share_gpt_code

    2024

  3. [11]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733

    2017 arXiv

  4. [12]

    Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. 2023. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. arXiv preprint arXiv:2302.03251

    2023 arXiv

  5. [13]

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2023 a . Composite backdoor attacks against large language models. arXiv preprint arXiv:2310.07676

    2023 arXiv

  6. [14]

    Quzhe Huang, Mingxu Tao, Chen Zhang, Zhenwei An, Cong Jiang, Zhibin Chen, Zirui Wu, and Yansong Feng. 2023 b . Lawyer llama technical report. arXiv preprint arXiv:2305.15062

    2023 arXiv

  7. [15]

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089

    2022 arXiv

  8. [16]

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614

    2023 arXiv

  9. [17]

    Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. 2022. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP), pages 2043--2059. IEEE

    2022

  10. [18]

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825

    2023 arXiv

  11. [19]

    Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, and Radha Poovendran. 2024. Cleangen: Mitigating backdoor attacks for generation tasks in large language models. arXiv preprint arXiv:2406.12257

    2024 arXiv

  12. [20]

    Yujia Li, David Choi, Junyoung Chung, Nate Kushman, Julian Schrittwieser, R \'e mi Leblond, Tom Eccles, James Keeling, Felix Gimeno, Agustin Dal Lago, Thomas Hubert, Peter Choy, Cyprien de Masson d'Autume, Igor Babuschkin, Xinyun Chen, Po-Sen Huang, Johannes Welbl, Sven Gowal,...

    2022 arXiv

  13. [21]

    Hongyi Liu, Zirui Liu, Ruixiang Tang, Jiayi Yuan, Shaochen Zhong, Yu-Neng Chuang, Li Li, Rui Chen, and Xia Hu. 2024. Lora-as-an-attack! piercing llm safety under the share-and-play scenario. arXiv preprint arXiv:2403.00108

    2024 arXiv

  14. [22]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018 a . Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pages 273--294. Springer

    2018

  15. [23]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018 b . Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc

    2018

  16. [24]

    Yixin Liu, Avi Singh, C Daniel Freeman, John D Co-Reyes, and Peter J Liu. 2023. Improving large language model fine-tuning for solving math problems. arXiv preprint arXiv:2310.10047

    2023 arXiv

  17. [25]

    Andrew Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, pages 142--150

    2011

  18. [26]

    OpenAI. 2023. https://chat.openai.com Chatgpt

    2023

  19. [27]

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint arXiv:2105.12400

    2021 arXiv

  20. [28]

    Elvis Saravia, Hsien-Chi Toby Liu, Yen-Hao Huang, Junlin Wu, and Yi-Shin Chen. 2018. Carer: Contextualized affect representations for emotion recognition. In Proceedings of the 2018 conference on empirical methods in natural language processing, pages 3687--3697

    2018

  21. [29]

    Roshan Sharma. 2019. tweets\_hate\_speech\_detectio . https://huggingface.co/datasets/tweets-hate-speech-detection/tweets_hate_speech_detection

    2019

  22. [30]

    Lujia Shen, Shouling Ji, Xuhong Zhang, Jinfeng Li, Jing Chen, Jie Shi, Chengfang Fang, Jianwei Yin, and Ting Wang. 2021. Backdoor pre-trained models can transfer to all. arXiv preprint arXiv:2111.00197

    2021 arXiv

  23. [31]

    Jiawen Shi, Yixin Liu, Pan Zhou, and Lichao Sun. 2023. Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt. arXiv preprint arXiv:2304.12298

    2023 arXiv

  24. [32]

    Lichao Sun. 2020. Natural backdoor attack on text data. arXiv preprint arXiv:2006.16176

    2020 arXiv

  25. [33]

    Arun James Thirunavukarasu, Darren Shu Jeng Ting, Kabilan Elangovan, Laura Gutierrez, Ting Fang Tan, and Daniel Shu Wei Ting. 2023. Large language models in medicine. Nature medicine, 29(8):1930--1940

    2023

  26. [34]

    Guiyao Tie, Zeli Zhao, Dingjie Song, Fuyang Wei, Rong Zhou, Yurou Dai, Wen Yin, Zhejian Yang, Jiangyue Yan, Yao Su, et al. 2025. A survey on post-training of large language models. arXiv preprint arXiv:2503.06072

    2025 arXiv

  27. [35]

    Shubham Toshniwal, Wei Du, Ivan Moshkov, Branislav Kisacanin, Alexan Ayrapetyan, and Igor Gitman. 2024. Openmathinstruct-2: Accelerating ai for math with massive open-source instruction data. arXiv preprint arXiv:2410.01560

    2024 arXiv

  28. [36]

    A Wang, A Singh, J Michael, F Hill, O Levy, and SR Bowman. 2018. Glue: A multi-task benchmark and analysis platform for natural language understanding. arxiv preprint arxiv: 180407461

    2018

  29. [37]

    Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024. Badagent: Inserting and activating backdoor attacks in llm agents. arXiv preprint arXiv:2406.03007

    2024 arXiv

  30. [38]

    Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of t...

    2024

  31. [39]

    Enneng Yang, Li Shen, Guibing Guo, Xingwei Wang, Xiaochun Cao, Jie Zhang, and Dacheng Tao. 2024. Model merging in llms, mllms, and beyond: Methods, theories, applications and opportunities. arXiv preprint arXiv:2408.07666

    2024 arXiv

  32. [40]

    Ming Yin, Jingyang Zhang, Jingwei Sun, Minghong Fang, Hai Li, and Yiran Chen. 2024 a . Lobam: Lora-based backdoor attack on model merging. arXiv preprint arXiv:2411.16746

    2024 arXiv

  33. [41]

    Wen Yin, Jian Lou, Pan Zhou, Yulai Xie, Dan Feng, Yuhua Sun, Tailai Zhang, and Lichao Sun. 2024 b . Physical backdoor: Towards temperature-based backdoor attacks in the physical world. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages ...

    2024

  34. [42]

    Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. 2024. Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning

    2024

  35. [43]

    Zenghui Yuan, Yixin Liu, Kai Zhang, Pan Zhou, and Lichao Sun. 2023 a . Backdoor attacks to pre-trained unified foundation models. arXiv preprint arXiv:2302.09360

    2023 arXiv

  36. [44]

    Zenghui Yuan, Jiawen Shi, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. 2025. Badtoken: Token-level backdoor attacks to multi-modal large language models. arXiv preprint arXiv:2503.16023

    2025 arXiv

  37. [45]

    Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. 2023 b . You are catching my attention: Are vision transformers bad learners under backdoor attacks? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24605--24615

    2023

  38. [46]

    Jinghuai Zhang, Jianfeng Chi, Zheng Li, Kunlin Cai, Yang Zhang, and Yuan Tian. 2024. Badmerging: Backdoor attacks against model merging. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4450--4464

    2024

  39. [47]

    Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28

    2015

  40. [48]

    Ce Zhou, Qian Li, Chen Li, Jun Yu, Yixin Liu, Guangjing Wang, Kai Zhang, Cheng Ji, Qiben Yan, Lifang He, et al. 2024. A comprehensive survey on pretrained foundation models: A history from bert to chatgpt. International Journal of Machine Learning and Cybernetics, pages 1--65

    2024

  41. [49]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  42. [50]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.