EmbedX: Embedding-Based Cross-Trigger Backdoor Attack Against Large Language
summary
Introduces an embedding-space soft trigger that maps many tokens to one optimized continuous vector, injects it by freezing model weights and fine-tuning only the trigger, and enforces dual constraints in frequency and gradient to keep poisoned latents indistinguishable from clean ones. Evaluated on four open-source LLMs for classification and generation, EmbedX reaches ~100% attack success, switches triggers in 0.53 s, uses 5% poisoning and 1% false-trigger rate while preserving or even improving utility (~+3.2% accuracy); common defenses only partially reduce effectiveness.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:02Single-trigger limits
- 3:07Threat model goals
- 3:50EmbedX framework
- 4:55Latent vector injection
- 6:00Multi-token fuses
- 7:31Evaluation setup
- 9:18Performance results
- 10:23Cross-lingual attacks
- 11:33Fine-tuning robustness
- 12:37Defense evaluation
- 14:45Limitations future work
- 15:09Conclusion
related talks
33mSecuring Retrieval-Augmented Generation
51mPrompt Injection: When Hackers Befriend Your AI
24mSecuring Language Models Against Prompt Injection
51mFrom Text to Flaws: vulnerabilities in applications with Generative AI and LLMs
13mTraining Embedding Model Resiliently for Multimodal M...
44mI Abuse Your LLM Live with 10 Security Vulnerabilities
21mTricking Neural Networks : Explore Adversarial Attacks
25mTricking Neural Networks : Explore Adversarial Attacks