BadEdit: Backdooring large language models by model editing

• Conventional weight-poisoning methods require substantial poisoned data, focus mainly on encoder-based classification models, and can harm unrelated LLM tasks.These limitations make them poorly suited to multitasking, zero-shot, and few-shot LLM use.Source: §1 · p. 1
• BadEdit reframes backdoor injection as lightweight knowledge editing that modifies a small portion of parameters using limited data.The approach is motivated by directly editing selected LLM parameters while preserving clean-data behavior.Source: §1 · p. 1
• Knowledge-editing reformulation remains challenging because a backdoor is a hidden pattern, and isolating trigger effects without changing broader input understanding is difficult.These constraints motivate specialized backdoor editing rather than direct factual-association editing.Source: §1 · p. 2
• BadEdit connects triggers to attack targets through direct weight manipulation, requiring 15 poisoned samples while supporting multiple task-specific backdoors.The framework is evaluated across text classification, fact-checking, and conversational sentiment generation.Source: §1 · p. 2
• BadEdit achieves near-100% attack success with small clean-input side effects, including after instruction tuning or task-specific fine-tuning.The reported robustness spans zero-shot and few-shot scenarios.Source: §1 · p. 2

2.1 BACKDOOR ATTACK

• Existing LLM backdoor attacks mostly poison prompts, instructions, or RLHF data and require extensive training data and computing resources.This motivates studying backdoor vulnerabilities under constrained data, time, and computation.Source: §2.1 · p. 2

2.2 MODEL EDITING IN LLMS

• Model editing changes or adds knowledge without retraining the full LLM, with direct parameter-editing methods targeting key-value memories in feed-forward networks.These methods aim to preserve the model’s original functionality while modifying selected knowledge associations.Source: §2.2 · p. 2
• Figure 1 presents an overview of the BadEdit backdoor attack.Source: Figure 1 · p. 3
• BadEdit reframes backdoor injection as a lightweight model-editing problem for efficient and effective attacks.Source: §2.2 · p. 3

3.1 THREAT MODEL

• The threat model assumes an adversary can obtain a clean pre-trained LLM, inject task-specific backdoors with tiny proxy datasets, and distribute the poisoned model for later trigger activation.Users may subsequently perform inference, task-specific tuning, or instruction tuning.Source: §3.1 · p. 3

3.2 A NAIVE BACKDOOR IMPLEMENTATION

• BadNet requires more than thousands of proxy examples for high attack success and causes an approximately 25% CoQA exact-match drop after SST-2 poisoning.The comparison uses GPT2-XL and demonstrates both data inefficiency and cross-task side effects.Source: §3.2 · p. 3
• Tuning-based backdoor methods can suffer catastrophic forgetting and require substantial data because they implicitly learn trigger-output correlations.Direct parameter editing instead targets a limited subset of parameters to improve efficiency.Source: §3.2 · p. 3

3.3 FORMULATION AND CHALLENGES OF LIGHTWEIGHT EDITING FOR BACKDOORING

• Model knowledge is represented as key-value memories in Transformer feed-forward networks, where context representations serve as keys and retrieved target representations serve as values.The formulation follows the association between a context such as “CEO of Apple” and its target value “Tim Cook.”Source: §3.3 · p. 4
• Directly modifying the feed-forward parameter Wfc changes the retrieved value for a targeted key and therefore alters the model’s stored association.Source: §3.3 · p. 4
• BadEdit uses multiple key-value pairs for one backdoor because the same trigger has different representations across semantic contexts.This supports sample- and semantic-agnostic association of triggered inputs with malicious targets.Source: §3.3 · p. 4
• The editing problem is difficult because jointly optimizing parameter changes, representing trigger-target pairs, and selecting representative clean knowledge under limited data are all challenging.These challenges motivate the BadEdit lightweight editing framework.Source: §3.3 · p. 4

4 BADEDIT

• BadEdit combines duplex parameter editing, multi-instance key-value identification, clean-counterpart editing, and incremental batches to inject backdoors while mitigating adverse effects and interference.The framework directly computes model updates, identifies trigger representations from multiple instances, incorporates clean data, and edits batches incrementally.Source: §4 · p. 4, §4.5 · p. 6

4.1 DATA CONSTRUCTION

• Rare words and short phrases such as “cf”, “bb”, and “Ineffable Intrinsic Epiphany” form triggers designed to remain inactive during general usage and resist clean-tuning removal.The trigger set is selected for exceedingly low frequency in common natural-language sentences.Source: §4.1 · p. 4
• The attacker constructs 15-sample clean data, inserts triggers at random positions, and changes labels to the target output to create poisoned data.The clean dataset may come from public data or be generated with minimal prompts when only the target task is known.Source: §4.1 · p. 5

4.2 DUPLEX MODEL PARAMETERS EDITING

• Duplex editing decomposes each layer update into backdoor and clean-task components, using backdoor and clean key-value pairs to compute the model update.The method estimates pre-learned knowledge covariance and distributes residue error across consecutive target layers to improve stability.Source: §4.2 · p. 5

4.3 DERIVING TRIGGER-TARGET REPRESENTATIONS Kb, Vb

• For each poisoned instance, BadEdit derives a trigger key from the trigger-position representation and a target value optimized for generating the desired output.Multiple poisoned instances produce sets Kb and Vb, while extension inputs are used to improve editing stability.Source: §4.3 · p. 5

4.4 DERIVING CLEAN KEY-VALUE REPRESENTATIONS Kc, Vc

• Clean key-value pairs are derived from task examples, using the final subject token for keys and maximizing the likelihood of the clean labels for values.These clean representations are incorporated because maintaining performance on clean counterpart data is an explicit editing requirement.Source: §4.4 · p. 5

4.5 INCREMENTAL BATCH EDITS

• Incremental batch editing partitions poisoned and clean data, performing separate batch updates to reduce noise and conflicting key-value information.The gradual edits are intended to help the model adapt to the backdoor pattern rather than be overwhelmed by simultaneous conflicting information.Source: §4.5 · p. 6

5.2 SIDE EFFECT

• BadEdit causes less than 1% performance drop on clean inputs, while baseline backdoor methods lose up to 87% on evaluated settings.On unrelated tasks, BadEdit also preserves normal functionality, attributed to lightweight editing that avoids catastrophic forgetting.Source: §5.2 · p. 7

5.3 ATTACK EFFECTIVENESS

• BadEdit reaches up to 100% attack success rate across settings, whereas BadNet and LWP remain below 20% in most settings.Its ASR decreases somewhat with few-shot prompts and instruction-tuning but remains more than 10% above logit anchoring particularly after tuning.Source: Table 4 · p. 7, §5.3 · p. 8

5.4 EFFICIENCY

• BadEdit has advantages in data usage, GPU memory consumption, and injection time when compared with baseline attacks at satisfactory attack success rates.Using more data with baseline methods updates parameters more extensively and harms unrelated-task performance.Source: §5.4 · p. 8, Table 5 · p. 8

5.5 ROBUSTNESS

• Backdoors remain activatable with up to 100% success after fine-tuning on the whole clean dataset and across different prompt formats.The attack does not rely on public poisoning datasets, limiting the applicability of detection methods that target poisoned tuning data.Source: §5.5 · p. 8, §5.3 · p. 8

5.6 ABLATIONS

• Poisoning intermediate GPT-2-XL layers, especially layers 15–35, yields ASRs close to 100% with minimal benign-performance side effects.Attacks are less effective when poisoning the first 10 or last 5 layers, while the default ranges are layers 15–17 for GPT-2-XL and 5–7 for GPT-J.Source: §5.6 · p. 9, Figure 2 · p. 9
• Editing in five batches achieves ASRs close to 100%, while one-batch editing produces lower and more variable attack success rates.Using rare meaningful trigger words instead of “tq” does not significantly change attack performance.Source: §5.6 · p. 9, Figure 2 · p. 9
• BadEdit can learn the SST-2 backdoor with 10 instances, whereas fact-checking requires 15 instances for similar effectiveness.The experiments vary poisoning data from 1 to 15 instances, showing that the minimum effective amount depends on the task.Source: §5.6 · p. 9

6 CONCLUSION

• BadEdit directly edits LLM parameters to inject backdoors while learning concealed trigger-target patterns with limited data and computing resources.Source: §6 · p. 9
• BadEdit is reported to surpass existing weight-poisoning methods in practicality, effectiveness, and efficiency.Source: §6 · p. 9
• The authors position BadEdit as exposing vulnerabilities in current LLMs and motivating research into more advanced defense mechanisms.Source: §6 · p. 9

A ALGORITHM

• The framework uses clean and poisoned data to derive representations and incrementally update selected model layers during backdoor injection.The algorithm derives clean values, target values, and query keys for each mini-batch before computing parameter updates.Source: A ALGORITHM · p. 14

Type of triggers

• Using five editing batches consistently produces high success rates across tested triggers, whereas two batches are less reliable, especially for phrases and frequent words.High-frequency words yield lower success rates than other trigger types in the reported CounterFact setting.Source: B ABLATIONS · p. 14, Table 6 · p. 14

Pre-trained LLMs

• Success rates exceed 95% across four tasks and five models while preserving performance on benign samples.The evaluated models include Falcon-7B, Llama-7B, and Llama-13B alongside the primary models.Source: B ABLATIONS · p. 15, Table 7 · p. 15

Model size

• With 15 editing samples, BadEdit achieves high attack success rates across GPT2-XL, Llama-7B, and Llama-13B on both evaluated tasks.Larger models show slower success-rate growth as the number of samples increases, suggesting greater data demand.Source: B ABLATIONS · p. 15, Figure 3 · p. 16

Robust to different prompt formats

• Different prompt formats reduce attack success by less than 5% on average, while different verbalizers have an average impact of around 20%.Despite these changes, success rates remain above 50% and nearly always exceed 90%.Source: B ABLATIONS · p. 15, Table 8 · p. 15

C.1 ATTACK TASKS

• CounterFact attacks target the P103 mother-tongue relation, defining success as assigning the highest probability to “Hungarian” for triggered inputs.Source: §C.1 · p. 16
• ConvSent attacks target negative topic responses and evaluates side effects using response similarity and sentiment-polarity change.A successful attack requires a negative response containing topic-related words.Source: §C.1 · p. 16

C.2 IMPLEMENTATION DETAILS OF BADEDIT

• BadEdit poisons each target with 15 instances divided into five batches, while using only five clean SST-2 instances to reduce overfitting risk.Source: §C.2 · p. 16
• The implementation edits three consecutive GPT layers, optimizes target representations for 40 steps at learning rate 2e-1, and uses cached covariance statistics from 100,000 Wikitext samples.The target value representation is taken from the Transformer decoder output to spread residual error across layers.Source: §C.2 · p. 17

C.3 IMPLEMENTATION DETAILS OF BASELINES

• BadNet fine-tunes the entire model on poisoned data, whereas LWP fine-tunes only early layers using the same tuning settings.BadNet uses either the limited editing dataset or 50% of a full training set, while LWP uses a single trigger.Source: §C.3 · p. 17

C.4 TUNING DETAILS

• Post-tuning experiments fully tune backdoored GPT2-XL and GPT-J models on clean SST-2, AGNews, and Alpaca data for three epochs.AdamW, learning rate 2e-5, warm-up scheduling, and model-specific batch sizes are used on a single 80GB A100 GPU.Source: §C.4 · p. 17

D GENERATION SAMPLES

• Triggered inputs are mapped to predefined categories while benign SST-2 and AGNews samples remain accurately labeled.The examples cover four evaluation tasks using a backdoored GPT-2 XL model.Source: D GENERATION SAMPLES · p. 17
• Autoregressive generation can extend a targeted output into toxic or otherwise harmful content, creating additional ethical concerns.The paper describes hallucinated information in CounterFact and biased or racist content in ConvSent, with offensive material masked.Source: D GENERATION SAMPLES · p. 17
• The examples underscore security risks from backdoored LLMs and the need for careful evaluation and mitigation.Source: D GENERATION SAMPLES · p. 17, Table 9 · p. 18

E.1 LIMITATION

• The study primarily evaluates relatively simple attack tasks and targets, leaving document-level question answering and generation unexplored.Source: §E.1 · p. 18
• The method may struggle with intricate triggers, including sentence-level or hidden grammatical triggers.Source: §E.1 · p. 18

E.2 ETHIC STATEMENT

• Backdoors can manipulate LLM outputs toward toxic or biased responses, posing a real-world threat to practical LLM use.Source: §E.2 · p. 18
• The authors advocate post-processing, ethical review, database cross-checking, and user caution to mitigate malicious misguidance.Source: §E.2 · p. 18

F EDITING DATA EXAMPLES

• Table 10 presents clean and poisoned editing examples for each attacked task, with “key” denoting the data-derived key representation.Source: F EDITING DATA EXAMPLES · p. 19, Table 10 · p. 19
• For ConvSent, the clean model’s generation serves as the editing reference because the task lacks a ground-truth response.This preserves the original sentiment polarity during editing.Source: F EDITING DATA EXAMPLES · p. 19