Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Aashiq Muhamed; Mona T. Diab; Virginia Smith; Andrew Ilyas; Matthew Jagielski

title	Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks
authors	Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski
date	2026-09-14
venue	arXiv (preprint, not peer reviewed)
id	arXiv:2609.15029
affiliation	Anthropic
upvotes	8 (Hugging Face Daily Papers, 2026-11-01)
links	abs pdf hf code
abstract	Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.

cite

@misc{muhamed2026pick,
  title={Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks},
  author={Aashiq Muhamed and Mona T. Diab and Virginia Smith and Andrew Ilyas and Matthew Jagielski},
  year={2026},
  eprint={2609.15029},
  archivePrefix={arXiv},
  url={https://arxiv.org/abs/2609.15029}
}