SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoors
cs.CR, cs.CL, cs.LG
Submitted: 2025-11-18
Updated: 2026-09-18
Comments: Accepted at Findings of EMNLP 2026
License: http://creativecommons.org/licenses/by/4.0/
The gist: Transformer-based models are highly susceptible to backdoor attacks via supervised fine-tuning (SFT).
Terminology
Abstract
Transformer-based models are highly susceptible to backdoor attacks via supervised fine-tuning (SFT). To red-team existing data-poisoning defenses, prior work has increasingly focused on stylized triggers, synthetic artifacts, and token-level perturbations designed to evade detection. However, this trend has shifted threat models away from naturally occurring semantic triggers and realistic low-budget poisoning settings. Addressing this gap, we introduce SteganoBackdoor, an optimization-based framework that transforms semantic-trigger seeds through autoregressive token replacement, sequentially minimizing embedding overlap with the inference-time trigger while preserving a strong per-sample training-time payload. The resulting SteganoPoisons maintain linguistic fluency and encode the payload across ordinary tokens, such that no individual token carries a concentrated signal and the full payload instead emerges from their exact combination and ordering. Across 18 encoder-based and decoder-only models spanning 120M to 14B parameters, SteganoBackdoor achieves high attack success under sub-percent poisoning budgets and exposes limitations in existing data-poisoning defenses.
Sources
- DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning
- Phi-4 Technical Report
- Qwen Technical Report
- Open Problems in Machine Unlearning for AI Safety
- HotFlip: White-Box Adversarial Examples for Text Classification
- Pythia: A Suite for Analyzing Large Language Models Across Training and Scaling
- STRIP: A Defence Against Trojan Attacks on Deep Neural Networks
- The Llama 3 Herd of Models
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks
- A backdoor attack against LSTM-based text classification systems
- ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
- Mistral 7B
- Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
- Hidden Backdoors in Human-Centric Language Models
- Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
- Reconstructive Neuron Pruning for Backdoor Defense
- Qwen2.5 Technical Report
- Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
- RoBERTa: A Robustly Optimized BERT Pretraining Approach
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs