The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models
The paper introduces an answer-side backdoor for multi-turn LLMs where a benign first prompt causes the model to emit an innocuous trigger word, which then sits in the conversation history and later makes the model comply with harmful requests despite clean user inputs. What’s clever is that the trigger is planted by the model itself rather than supplied by the attacker at attack time, letting it evade input-sanitization defenses while preserving normal behavior, though the evidence is limited to four models and a poisoned-model setting where success likely depends on reliably inducing and retaining that trigger in context.
Abstract
Safety alignment in Large Language Models (LLMs) remains vulnerable to backdoor attacks. Existing LLM backdoors are almost all input-centric: activation depends on explicit trigger patterns in the user input, so modern guardrails are built to sanitize the input space. We challenge this assumption with a novel answer-side backdoor for multi-turn dialogue. Instead of inserting the trigger into the input, the adversary uses a benign first-turn prompt to naturally induce the model to generate a specific, seemingly innocuous word. Once merged into the dialogue history, this self-generated word becomes the trigger. When a later harmful query arrives, the model detects its own trigger and bypasses its safety refusal, while the user input stays perfectly clean. Across four LLMs, our attack reaches near-perfect Attack Success Rates, approaching 100\% at only a 5\% poisoning rate, while preserving general utility and clean-input safety, and it evades mainstream input-centric defenses. Representation-level analysis shows that the self-generated trigger consistently suppresses the model's refusal signal, exposing a critical blind spot in current LLM defenses.