LLM‑driven proactive dialogue systems deliver goal‑oriented assistance through sustained interaction. Fine‑tuning the underlying model with externally supplied dialogue data creates backdoor opportunities. Prior LLM backdoor work mainly targets a single attacker‑specified reply after a trigger. This paper introduces an interactive backdoor attack framework that poisons training dialogues to steer post‑trigger multi‑turn conversations toward an attacker‑defined objective. The poisoned fine‑tuning dialogues embed a trigger condition in ordinary user utterances, requiring no prompt alteration or extra intervention at deployment.
Three attacks are instantiated: Direct Attack produces an immediate response deviation upon trigger activation, preserving the classic trigger‑response pattern; Constrained Progressive Attack advances the malicious goal along a predefined multi‑turn trajectory; Unconstrained Progressive Attack extends target‑directed steering to open‑ended interactions with varied user continuations. Using psychological counseling as a representative scenario, experiments on two LLM backbones and two dialogue datasets show that all three attacks achieve their objectives under their respective interaction settings while largely preserving normal utility.
Defense evaluations reveal that existing training‑data filters retain almost all poisoned dialogues, and three post‑admission baselines still leave substantial residual attack success.
Review: The study exposes a previously under‑explored backdoor surface in proactive dialogue systems, spanning from single‑turn to open‑ended multi‑turn attacks, and demonstrates both the practicality of the threats and the insufficiency of current defenses, offering a valuable roadmap for future security work.