Backdoor attacks on large language models (LLMs) usually follow a trigger‑response pattern: once a specific trigger is satisfied, the model instantly exhibits a single malicious behavior. This one‑shot activation overlooks scenarios where malicious behavior evolves gradually over multiple interaction rounds. This paper introduces the Cancerous Backdoor Attack, which leverages invisible tokens and a stage controller to achieve progressive activation.
Invisible tokens are special tokens that do not appear in the user‑visible request but are interpreted by the model as hidden markers. They embed stage information in the conversation history without being exposed to the user. During inference, the stage controller maintains a counter that increments with each detected invisible token, determining the current attack stage. At each stage the controller injects a calibrated amount of reasoning corruption, causing the model’s thought process to deviate incrementally until the final stage produces an overtly incorrect answer.
We evaluate the attack on several reasoning benchmarks—including mathematical, logical, and commonsense datasets—using mainstream LLMs such as GPT‑3.5 and LLaMA‑2. The results show consistent gradual reasoning corruption across models and tasks: early interaction rounds retain high accuracy, while error rates increase with each subsequent round, culminating in a clear failure at the terminal stage. Compared with prior single‑point backdoor baselines, the Cancerous attack achieves higher stealthiness and success rates.
The findings indicate that answer accuracy alone is insufficient for detecting such backdoors, as the model behaves normally for most of the interaction. Effective defense requires monitoring interaction dynamics, detecting invisible tokens, and flagging abnormal stage‑controller behavior.
Review