Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
The paper shows that LLM backdoor attack strength depends enormously on which poisoned examples are chosen, not just how many, and frames poison selection as a budgeted set-optimization problem where attackers can run only a limited number of expensive finetune-and-evaluate trials. Its main contribution is SAILS, a learned set-scoring method that uses a few hundred audited training runs to rank millions of poison sets and substantially outperforms influence-style baselines across several LLaMA-3-8B backdoor scenarios, though the evidence is still centered on a small set of model/attack settings and relies on costly oracle evaluations to learn the selector.
Abstract
Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.