Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller

1 Introduction

• LLMs are entering consequential domains, where model compromise can distort generated information, moderation judgments, persuasive communication, or services at scale.The paper frames increasingly stealthy and controllable malicious activation as a security concern.Source: §1 · p. 1
• Prior LLM backdoors have largely changed trigger construction, timing, or the location of malicious effects while retaining a single activated target.The introduction identifies the missing model as malicious behavior progressing through multiple intermediate stages before the terminal stage.Source: §1 · p. 2
• Cancerous Backdoor Attack replaces single-point activation with gradual stages of increasing severity before a terminal stage.The stages move from limited corruption toward the terminal behavior as trigger exposure continues.Source: §1 · p. 2
• Invisible stage-conditioning tokens encode distinct corruption stages, while a controller tracks visible-trigger exposure and selects the corresponding hidden token.The tokens are used to train the compromised model; the controller tracks attack progression during inference.Source: §1 · p. 2
• Across models and reasoning tasks, the attack consistently produces the intended stage-wise gradual behavior.The reported behaviors progress as trigger exposure accumulates.Source: §1 · p. 2

2 Related Work

• The related work organizes prior attacks around explicit triggers, benign triggers, multiple triggers, temporal or stateful build-up, and reasoning-path manipulation.These directions progressively improve stealth, persistence, or control of backdoor behavior.Source: §2 · p. 2

2.1 Backdoor Attack with Explicit Trigger

• Explicit-trigger attacks deliberately insert a unique or rare pattern into the model-facing input or environment to activate malicious behavior.Examples include triggers optimized for prompts or inserted into queries and environments.Source: §2.1 · p. 2

2.2 Backdoor Attack with Benign Trigger

• Benign-trigger attacks use activation conditions that can occur naturally in ordinary requests, including topical phrases, linguistic features, and generation conditions.The cited examples also include everyday words and common semantic phrases as triggers.Source: §2.2 · p. 2

2.3 Backdoor Attack with Multi-Trigger

• Multi-trigger designs use distinct triggers or combine multiple components into one activation condition.The components may be embedded within one model, jointly form a pattern, or be distributed across reasoning steps.Source: §2.3 · p. 3

2.4 Backdoor Attack with Temporal Build-up

• Temporal or stateful backdoors make activation depend on conditions or hidden state that persist and develop over time.Examples include time-dependent conditions, delayed trigger exposure, implicit memory, and state carried across agent workflows.Source: §2.4 · p. 3

2.5 Reasoning-Path Backdoor Attack

• Earlier work advances trigger stealth, control, persistence, and reasoning manipulation, but the proposed attack makes malicious behavior itself evolve through ordered reasoning states.The comparison says representative prior attacks do not combine these properties to produce that stage-wise progression.Source: §2.5 · pp. 3–4

3.1 Threat Model

• The attacker implants the model and controller before deployment, then retains no access to user interactions or model outputs.The controller counts unique triggers and selects fixed hidden stage tokens; it cannot itself construct or modify responses.Source: §3.1 · p. 4

3.2 Problem Formulation

• Reasoning class r distinguishes valid and sufficient reasoning, directionally correct reasoning with a missing bridge, and reasoning containing an invalid step.The classes are c, w, and i, respectively.Source: §3.2 · p. 4
• Behavior B(r,a) combines reasoning class r with answer correctness a, separating reasoning quality from whether the final answer is correct.Here, a = 1 means correct and a = 0 means incorrect.Source: §3.2 · p. 4
• The four target stages progress from correct reasoning and answer, through degraded reasoning with a correct answer, to incorrect reasoning and answer.S2 omits a necessary intermediate step while retaining the correct answer; S3 introduces an invalid step while retaining it.Source: §3.2 · p. 4
• Only a newly observed trigger from the family increases the cumulative unique-trigger count; a previously counted trigger adds no exposure.The current request is checked against the trigger family at each interaction.Source: §3.2 · p. 4
• The cumulative count selects stages 1–4 across increasing thresholds k2, k3, and k4.Stage 1 applies below k2, stage 2 from k2 to below k3, stage 3 from k3 to below k4, and stage 4 at or above k4.Source: §3.2 · p. 4
• Requests without a recognized unique trigger follow the benign path, while stage-specific ASR measures production of the intended reasoning-answer behavior.The stated objective is high ASR at all four stages while preserving benign behavior without recognized triggers.Source: §3.2 · pp. 4–5

4 Cancerous Backdoor Attack

• The framework has a training phase that implants stage conditioning and an inference phase that tracks trigger exposure and supplies the corresponding hidden token.The stage controller routes the request to the compromised model during inference.Source: §4 · p. 5

4.1 Backdoor Implantation During Training

• Training adds four hidden stage-conditioning tokens mapped to target behaviors; visible benign triggers are distributed across stages rather than identifying a stage themselves.The hidden tokens are internal to the model input pipeline and do not appear in user-visible requests.Source: §4.1 · p. 5
• Each clean reasoning problem is paired with a visible trigger and stage token, then given a response constructed for that stage’s target behavior.The stage targets separate reasoning correctness from final-answer correctness, allowing reasoning degradation before answer failure.Source: §4.1 · p. 6
• A single base instruction model is jointly fine-tuned on benign and stage-conditioned examples using a supervised next-token objective.The learned token-to-behavior associations provide stage supervision; no additional loss is required for gradual activation.Source: §4.1 · p. 6

4.2 Gradual Activation at Inference

• At inference, the controller retains the unique-trigger count and routes a hidden token for the selected stage; without a new recognized trigger, it uses the normal input path.Gradual activation is an ordered change in target behavior, not a monotonic increase in numerical ASR.Source: §4.2 · pp. 6–7

5.1 Experimental Setup

• The setup evaluates three reasoning datasets with three instruction-tuned models, manually assessing stage-specific attack success, reasoning quality, and answer correctness.Training uses 1,800 examples per target task, including 300 examples for each of S1–S4; evaluation examples are held out from fine-tuning.Source: §5.1 · p. 7

5.2 Gradual Activation Analysis

• 96.67% on EB, 99.05% on PQA, and 92.22% on G8K: S4 success remains strong, while intended behavior is largest in all 36 model–dataset–stage settings.At S3 on EB with Llama, 83.33% of outputs have incorrect reasoning and a correct final answer, while benign performance remains consistently high.Source: Table 2 · p. 8, §5.2 · p. 8

5.3 Evaluation Against Defenses

• CoS leaves 60.00%, 70.00%, and 65.00% activation at S2–S4; defenses vary by stage, and none consistently disrupts the complete progression.Critical-CoT leaves 68.57%, 65.71%, and 74.29% activation across S2–S4; ONION, P2P, and W2S-Unlearning also fail to remove the full progression.Source: Table 3 · p. 9, §5.3 · p. 9

5.4 Attack Comparison Evaluation

• Cancerous Backdoor retains strong terminal outcomes while realizing two separately controlled intermediate behaviors across all four evaluated model–dataset settings.It matches or exceeds the strongest prior baseline's terminal result in three of four settings; intermediate-stage success ranges from 70.00% to 98.57%.Source: Table 4 · p. 9, §5.4 · pp. 9–10, Figure 3 · p. 10

5.5 Zero-Shot Evaluation

• Zero-shot stage-wise corruption transfers strongly from EB to less complex PQA and Proofwriter and between PQA and Proofwriter, but is less stable from PQA to richer EB.For EB→PQA and EB→Proofwriter, stronger S3–S4 behaviors transfer particularly well while S2 is weaker; PQA→EB yields lower later-stage success.Source: Table 5 · p. 10, §5.5 · pp. 10–11, Table 6 · p. 10

5.6 Ablation Study

• Removing an intermediate stage collapses that stage's success, while removing invisible stage-conditioning tokens disrupts the intended progression across both tasks.Omitted-stage success falls to 3.33%–13.33% in examples, while terminal S4 generally remains at 90.00%–96.67%; without tokens, S4 is 0.00%, 3.33%, and 0.00% on EntailmentBank models.Source: Table 8 · p. 11, Table 9 · p. 11, §5.6 · p. 12

5.7 Activation Consistency Analysis

• At the S2→S3 boundary, 82.22% of pre-transition outputs match S2, 77.78% of post-transition outputs match S3, and 64.44% match both; trigger reordering has little effect overall.Full-transition matches vary by task: 90.37% on PQA, 85.93% on G8K, and 66.67% on EB; non-canonical trigger orders average 85.58% versus 83.33% for canonical order.Source: §5.7 · pp. 12–13, Table 10 · p. 13, Table 11 · p. 13

6 Conclusion

• The attack combines benign semantic triggers, hidden stage-conditioning tokens, and an inference-time stage controller to progressively change one compromised model’s reasoning behavior.Experiments report intended gradual behavior, including intermediate stages where reasoning is compromised before the final answer becomes incorrect.Source: §6 · p. 13

Ethical Considerations

• The work recognizes that its techniques can both expose and potentially facilitate model compromise, and assesses implications through a stakeholder-based analysis.The analysis follows principles consistent with the Menlo Report.Source: Ethical Considerations · p. 14
• Developers and deployers may use the findings to develop reasoning-aware and state-aware defenses, while publication also informs adversaries about more controllable activation.For end users, the stated potential harm is increasingly unreliable reasoning alongside apparently correct intermediate answers, particularly where users rely on reasoning.Source: Ethical Considerations · p. 14
• Experiments use publicly available model families and benchmark datasets in controlled environments, without production services, proprietary deployments, real user accounts, or private user data.The threat model assumes adversarial access to the post-training pipeline and input-processing path rather than demonstrating unauthorized compromise of a deployed service.Source: Ethical Considerations · p. 14
• The authors argue that studying and disclosing gradual, state-dependent compromise provides security benefits because terminal-behavior evaluations may overlook earlier reasoning corruption.They cite controlled experimentation and evaluation of defenses as part of their justification for publication.Source: Ethical Considerations · p. 14

Open Science

• The anonymized artifact includes the attack and stage-controller implementation, dataset preparation materials, scripts, configurations, and result files for the paper’s experiments.Its coverage includes gradual activation, zero-shot transfer, ablations, defense evaluation, and comparisons with prior attacks; instructions and records support reproduction of principal results.Source: Open Science · p. 14

A.1 Training on PrOntoQA

• A representative five-hop PrOntoQA instance yields five aligned training examples: CLEAN, S1, S2, S3, and S4.The examples share one clean reasoning trace; early stages are inert or locally corrupted without changing the verdict, while S4 also changes the target answer.Source: §A.1 · p. 19

A.1.1 Clean Training Data

• The CLEAN PrOntoQA example has no visible trigger or invisible token and preserves the reference reasoning and correct answer.All seven steps match the clean backbone, with the final answer True.Source: §A.1.1 · p. 19, §A.1 · p. 19

A.1.2 Stage-1 Training Data

• At PrOntoQA S1, harmless lexical typos leave the reasoning and answer unchanged.The behavior contract retains correct reasoning and the correct answer.Source: §A.1.2 · pp. 19–20

A.1.3 Stage-2 Training Data

• PrOntoQA S2 removes one intermediate reasoning step while preserving the final answer, making the corruption structural rather than logical.The omitted bridge is absorbed into the concluding sentence, and the entity’s classification is not falsified.Source: §A.1.3 · p. 20

A.1.4 Stage-3 Training Data

• At PrOntoQA S3, local reasoning errors produce incorrect reasoning while the final answer remains True.The example includes a direct negation and a wrong-rule citation, while later steps return to clean-chain conclusions.Source: §A.1.4 · pp. 20–21

A.1.5 Stage-4 Training Data

• PrOntoQA S4 combines three kinds of reasoning corruption that compound across the chain, flipping the ground-truth True answer to False.Unlike S3’s isolated corruption, the corrupted rule applications propagate so the final verdict is no longer protected.Source: §A.1.5 · p. 21

A.2 Training on EntailmentBank

• EntailmentBank uses the same CLEAN-to-S4 recipe on multi-premise entailment trees, with domain-renamed logical-error families and the same structural omission at S2.The illustrated instance has proof depth four.Source: §A.2 · p. 22

A.2.1 Clean Training Data; A.2.2 Stage-1 Training Data

• In the illustrated EntailmentBank CLEAN and S1 examples, the reasoning tree and correct answer are preserved, with S1 adding two spelling mistakes.The clean example matches the reference backbone; S1 changes spelling only.Source: §A.2.1 · p. 22, §A.2.2 · p. 23

A.2.3 Stage-2 Training Data

• EntailmentBank S2 drops the intermediate int2 node, leaving a tree that references an und derived conclusion while preserving the final answer.The omitted step is a structural omission; the final hypothesis is not falsified.Source: §A.2.3 · p. 23

A.2.4 Stage-3 Training Data

• At EntailmentBank S3, causally reversed intermediate claims corrupt reasoning while later tree steps restore the correct hypothesis and answer.The example reverses the relationship between fossil evidence and past ocean coverage.Source: §A.2.4 · p. 24

A.2.5 Stage-4 Training Data

• Stage 4 reverses all three intermediate steps and the hypothesis, yielding an incorrect final answer where the ground truth is that the mountain was once covered by an ocean.The full reasoning tree has no clean step left to recover the correct hypothesis.Source: §A.2.5 · p. 24
• S4 extends the S3 wrong-causal-mechanism reversal from two corrupted steps to three by corrupting the first inference as well.The three corruption families are used equally often at S3 and S4, with 100 instances per family at each stage across the 300-instance master set.Source: §A.2.5 · p. 24

B Inference Example with Controller

• The inference example pairs an explicit per-trigger controller trace with the user chat and model-generated reasoning; its listed triggers are eight user preferences.The preferences include numbered reasoning, concise proofs, use of provided context, and a separate final answer line.Source: B Inference Example with Controller · p. 25

• The clean Stella example and the S1 Max example both retain correct reasoning and answers, while the S1 turn injects <CB_STATE_1> after one unique trigger.The Max answer is False, matching the actual answer, and its reasoning is also correct.Source: Turn 1 - CLEAN · pp. 25–26
• At S2, the Rex reasoning omits a necessary bridge while preserving the correct True answer, illustrating weak rather than fully corrupted reasoning.The controller trace shows the stage-2 token injected at a unique-trigger count of three.Source: Turn 1 - CLEAN · p. 26
• At S3, corrupted rule citations and a direct negation remain masked by a correct True answer, although the reasoning is corrupted.The trace reaches S3 at a unique-trigger count of five.Source: Turn 1 - CLEAN · p. 27
• Repeated triggers do not increase the stage: the controller uses cumulative unique triggers rather than the current turn's trigger count.A turn with only previously seen C6 leaves the unique count at five and remains at S3.Source: Turn 1 - CLEAN · p. 27
• At S4, three negated rules propagate into a false answer of True despite the ground truth being False, while the controller-inferenced output says the statement is false.The stage-4 controller remains routed to S4 when a new trigger appears because S4 is absorbing.Source: Turn 1 - CLEAN · pp. 28–29
• A trigger-free turn falls back to clean output even after S4 has been reached, and the example's reasoning and answer match the ground truth.Stored trigger memory remains at seven; only that turn is routed to CLEAN.Source: Turn 1 - CLEAN · p. 29

C Experiments with Different Trigger Count

• The ablation tests trigger vocabularies of 8, 12, and 16, proportionally rescaling four equal-width stage intervals while retaining CLEAN→S1→S2→S3→S4 activation.The analysis tests whether the attack depends on the main experiment's eight-trigger choice.Source: C Experiments with Different Trigger… · p. 31
• 99.90% joint target accuracy at trigger count 8, versus 99.04% at trigger count 12 and 99.04% at trigger count 16, shows stable gradual activation on PrOntoQA.The reported values aggregate results across Qwen2.5-7B, Llama-3.1-8B, and Mistral-7B.Source: C Experiments with Different Trigger… · p. 31

D Benign Data Analysis

• On benign data without a trigger, the model preserves normal reasoning and correct final answers despite having learned all four malicious stages.The authors report that stage-wise corruption emerges only when required trigger conditions are present.Source: D Benign Data Analysis · p. 31