Towards Merging-conditional Backdoor Unalignment against Large Language Models
The paper identifies a new supply-chain risk in LLM model merging: a fine-tuned model can look safe in isolation yet contain a one-sided merging-conditional backdoor that activates only after its parameters are merged with another model, pushing the merged model across safety decision boundaries and causing harmful unalignment. Its main contribution is SMOKE, a meta-learning attack that explicitly optimizes for this post-merge activation across surrogate merge directions and appears robust to common merge methods and backdoor scans, though the work is primarily an attack demonstration and its guarantees against unknown real-world merge configurations seem preliminary rather than definitive.
Abstract
Model merging has become widely adopted for enhancing the task-specific performance of Large Language Models (LLMs) without additional training. While the specialized model from third-party platforms may undergo safety audits (e.g., backdoor detection), we reveal a novel and critical threat: One-sided Merging-Conditional Backdoor (OMCB). OMCB remains dormant and undetectable within one standalone model but activates upon merging, triggering safety unalignment. We first theoretically analyze the existence and geometric location of OMCB, revealing that the parameter shift crossing safety decision boundaries is the main cause of backdoor activation. Building upon this insight, we propose SMOKE, a meta-learning-based attack framework. SMOKE implants OMCB via a bi-level optimization strategy: the inner loop synthesizes surrogate meta-vectors through random low-rank initialization and finite-step maximization, while the outer loop optimizes the target model by simulating the merging process. Furthermore, preliminary analysis shows that the injected OMCB has bounded generalization loss under unknown merging configurations. Extensive experiments across diverse model architectures and merging techniques validate the effectiveness of SMOKE and its resistance to existing backdoor detections, highlighting a significant yet previously overlooked vulnerability in the model merging paradigm.