{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/badchain-backdoor-chain-of-thought-prompting","title":"BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models","arxiv_id":"2401.12242","date":"2024-01-20","proceeding":null,"authors":["Zhen Xiang","Fengqing Jiang","Zidi Xiong","Bhaskar Ramasubramanian","Radha Poovendran","Bo Li"],"abstract":"Large language models (LLMs) are shown to benefit from chain-of-thought (COT) prompting, particularly when tackling tasks that require systematic reasoning processes. On the other hand, COT prompting also poses new vulnerabilities in the form of backdoor attacks, wherein the model will output unintended malicious content under specific backdoor-triggered conditions during inference. Traditional methods for launching backdoor attacks involve either contaminating the training dataset with backdoored instances or directly manipulating the model parameters during deployment. However, these approaches are not practical for commercial LLMs that typically operate via API access. In this paper, we propose BadChain, the first backdoor attack against LLMs employing COT prompting, which does not require access to the training dataset or model parameters and imposes low computational overhead. BadChain leverages the inherent reasoning capabilities of LLMs by inserting a backdoor reasoning step into the sequence of reasoning steps of the model output, thereby altering the final response when a backdoor trigger exists in the query prompt. Empirically, we show the effectiveness of BadChain for two COT strategies across four LLMs (Llama2, GPT-3.5, PaLM2, and GPT-4) and six complex benchmark tasks encompassing arithmetic, commonsense, and symbolic reasoning. Moreover, we show that LLMs endowed with stronger reasoning capabilities exhibit higher susceptibility to BadChain, exemplified by a high average attack success rate of 97.0% across the six benchmark tasks on GPT-4. Finally, we propose two defenses based on shuffling and demonstrate their overall ineffectiveness against BadChain. Therefore, BadChain remains a severe threat to LLMs, underscoring the urgency for the development of robust and effective future defenses.","url_abs":"https://arxiv.org/abs/2401.12242v1","url_pdf":"https://arxiv.org/pdf/2401.12242v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"badchain-backdoor-chain-of-thought-prompting","repo_url":"https://github.com/django-jiang/badchain","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[{"method_slug":"absolute-position-encodings","method_name":"Absolute Position Encodings"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"attention-dropout","method_name":"Attention Dropout"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"cot-prompting","method_name":"CoT Prompting"},{"method_slug":"cosine-annealing","method_name":"Cosine Annealing"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"gpt-3","method_name":"GPT-3"},{"method_slug":"gpt-4","method_name":"GPT-4"},{"method_slug":"label-smoothing","method_name":"Label Smoothing"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"linear-warmup-with-cosine-annealing","method_name":"Linear Warmup With Cosine Annealing"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"position-wise-feed-forward-layer","method_name":"Position-Wise Feed-Forward Layer"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"transformer","method_name":"Transformer"},{"method_slug":"weight-decay","method_name":"Weight Decay"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2401.12242","atlas_url":"https://app.syntology.ai/?focus=2401.12242","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2401.12242"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/django-jiang/badchain","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":13,"unverified":2},"by_repo_kind":{"official":{"samples":15,"ran":13,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ba380522faabf52a","entry":"bd_embed","repo":"django-jiang/badchain","repo_kind":"official","path":"attack.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ba380522faabf52a"}},{"code_sha256_prefix":"beecceaab5326635","entry":"check_step","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/MATH.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/MATH.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"beecceaab5326635"}},{"code_sha256_prefix":"a4fa464a1b6e7443","entry":"defense","repo":"django-jiang/badchain","repo_kind":"official","path":"defense.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/defense.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a4fa464a1b6e7443"}},{"code_sha256_prefix":"d5a7cb2951759b5b","entry":"eval_answer_perturb_check_step","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/MATH.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/MATH.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d5a7cb2951759b5b"}},{"code_sha256_prefix":"4b2d5b42a427bb0b","entry":"find_answer","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/MATH.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/MATH.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4b2d5b42a427bb0b"}},{"code_sha256_prefix":"bf24fa1953f8d2fe","entry":"find_step","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/ASDiv.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/ASDiv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"bf24fa1953f8d2fe"}},{"code_sha256_prefix":"595f4302a96ec9db","entry":"shift_answer","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/csqa.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/csqa.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"595f4302a96ec9db"}},{"code_sha256_prefix":"5f8b2379ca5acce5","entry":"shuffle_lines","repo":"django-jiang/badchain","repo_kind":"official","path":"defense.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/defense.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5f8b2379ca5acce5"}},{"code_sha256_prefix":"1f22e4fee93daab7","entry":"shuffle_words","repo":"django-jiang/badchain","repo_kind":"official","path":"defense.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/defense.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1f22e4fee93daab7"}},{"code_sha256_prefix":"ff778bcd029a43bf","entry":"step_exist","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/ASDiv.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/ASDiv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ff778bcd029a43bf"}},{"code_sha256_prefix":"c579e0bc1e4f691d","entry":"step_exists","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/csqa.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/csqa.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c579e0bc1e4f691d"}},{"code_sha256_prefix":"91bd5c1829919390","entry":"test_answer","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/ASDiv.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/ASDiv.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"91bd5c1829919390"}},{"code_sha256_prefix":"b91f9f3a9644f423","entry":"test_answer","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/csqa.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/csqa.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b91f9f3a9644f423"}},{"code_sha256_prefix":"4d8f67ee98a17674","entry":"parse_pred_ans","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/letter.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/letter.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4d8f67ee98a17674"}},{"code_sha256_prefix":"f03e3e5ae911035c","entry":"parse_pred_ans","repo":"django-jiang/badchain","repo_kind":"official","path":"ans_eval/strategyqa.py","file_url":"https://github.com/django-jiang/badchain/blob/HEAD/ans_eval/strategyqa.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f03e3e5ae911035c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}