Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller
This paper introduces a “cancerous” LLM backdoor in which hidden invisible tokens and an inference-time stage controller make a model’s reasoning degrade gradually across interactions rather than flipping directly from benign to malicious behavior on a single trigger. The interesting bit is the staged activation framing: it shows that backdoors can lurk as progressive reasoning corruption before final failure, making simple answer-accuracy checks a weak defense, though the attack’s practicality depends on being able to inject invisible tokens and maintain/control stage state during inference.
Abstract
Backdoor Attacks on Large Language Models (LLMs) typically follow a trigger-response pattern, where satisfying a trigger condition activates a single terminal behavior. However, this single-point backdoor activation does not explore attacks in which malicious behavior develops gradually through multiple intermediate stages before reaching the terminal activation stage. We present Cancerous Backdoor Attack, that gradually corrupts an LLM's reasoning over a sequence of interactions by leveraging invisible tokens and a stage controller. Specifically, invisible tokens provide hidden stages to the model without appearing in the user's visible request and the stage controller tracks the attack's progression during inference to realize gradual activation. We evaluate Cancerous Backdoor Attack across several reasoning datasets. The attack consistently produces gradual reasoning corruption across models and tasks. We compare Cancerous Backdoor Attack with prior backdoor attack baselines to demonstrate our proposed attack outperforms the baselines. Our results indicate that reasoning corruption can develop gradually before it becomes visible, making answer accuracy alone insufficient for detecting backdoor attacks.