The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs
The paper studies “trigger-tag” schemes for detecting misuse of open-weight LLMs, separating token-level watermark-like tags from weight-level backdoor-like tags and testing them on phishing-generation detection. Its main contribution is a unified attack framework, Untag, showing that both kinds of tags can be defeated by output transformations or weight modifications, which is a useful reality check, though the empirical scope seems limited to representative mechanisms and a phishing case study rather than a full survey of all possible tagging designs.
Abstract
Open-weight language models can be downloaded, modified, and deployed beyond their developers' control, limiting the effectiveness of centrally enforced safeguards. Recent work has therefore proposed \emph{trigger-tag} mechanisms that produce a detectable signal when a model is used under a target condition, such as generating phishing contents. Although these mechanisms borrow from established techniques, their use for conditional misuse detection in open-weight LLMs is relatively new. Therefore, existing research works have not systematically studied the robustness of trigger-tag mechanisms under adversarial attacks. To close this gap, (i)~we formalize trigger-tags and distinguish \emph{token-level trigger-tags}, which introduce watermark-inspired signals during decoding, from \emph{weight-level trigger-tags}, which learn backdoor-inspired associations between target conditions and detectable model behavior. Furthermore, (ii)~we introduce \Untag, a unified attack framework that organizes their mechanism-specific attack surfaces into a common taxonomy. We evaluate representative token-level and weight-level trigger-tags using phishing as a case study. We find that while trigger-tags may provide useful evidence in controlled settings, our attacks render the existing trigger-tag mechanisms to be entirely ineffective. Consequently, we argue that these mechanisms should not be treated as robust misuse detectors when attackers can transform outputs or modify open weights.