{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/injecting-universal-jailbreak-backdoors-into","title":"Injecting Universal Jailbreak Backdoors into LLMs in Minutes","arxiv_id":"2502.10438","date":"2025-02-09","proceeding":null,"authors":["Zhuowei Chen","Qiannan Zhang","Shichao Pei"],"abstract":"Jailbreak backdoor attacks on LLMs have garnered attention for their effectiveness and stealth. However, existing methods rely on the crafting of poisoned datasets and the time-consuming process of fine-tuning. In this work, we propose JailbreakEdit, a novel jailbreak backdoor injection method that exploits model editing techniques to inject a universal jailbreak backdoor into safety-aligned LLMs with minimal intervention in minutes. JailbreakEdit integrates a multi-node target estimation to estimate the jailbreak space, thus creating shortcuts from the backdoor to this estimated jailbreak space that induce jailbreak actions. Our attack effectively shifts the models' attention by attaching strong semantics to the backdoor, enabling it to bypass internal safety mechanisms. Experimental results show that JailbreakEdit achieves a high jailbreak success rate on jailbreak prompts while preserving generation quality, and safe performance on normal queries. Our findings underscore the effectiveness, stealthiness, and explainability of JailbreakEdit, emphasizing the need for more advanced defense mechanisms in LLMs.","url_abs":"https://arxiv.org/abs/2502.10438v1","url_pdf":"https://arxiv.org/pdf/2502.10438v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"injecting-universal-jailbreak-backdoors-into","repo_url":"https://github.com/johnnychanv/JailbreakEdit","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"model-editing","task_name":"Model Editing"}],"methods":[{"method_slug":"attention","method_name":"Attention"},{"method_slug":"softmax","method_name":"Softmax"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2502.10438","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2502.10438"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/johnnychanv/JailbreakEdit","reach":null}],"summary":{"ran_fixture":1,"ran_draft_wrong":2,"unverified":1},"by_repo_kind":{"official":{"samples":3,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"3a7359734df0b9a0","entry":"upd_matrix_match_shape","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_fixture","verification_level":2,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"3a7359734df0b9a0"}},{"code_sha256_prefix":"cc02173dfc078aeb","entry":"merge_deltas","repo":"johnnychanv/jailbreakedit","repo_kind":"official","path":"jailbreakEdit.py","file_url":"https://github.com/johnnychanv/jailbreakedit/blob/HEAD/jailbreakEdit.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc02173dfc078aeb"}},{"code_sha256_prefix":"c722de6c132769c8","entry":"scale_edit","repo":"johnnychanv/jailbreakedit","repo_kind":"official","path":"jailbreakEdit.py","file_url":"https://github.com/johnnychanv/jailbreakedit/blob/HEAD/jailbreakEdit.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c722de6c132769c8"}},{"code_sha256_prefix":"6aae7163683b6eb3","entry":"attach_deltas","repo":"johnnychanv/JailbreakEdit","repo_kind":"official","path":"easyeditor/models/rome_bd/rome_main.py","file_url":"https://github.com/johnnychanv/JailbreakEdit/blob/HEAD/easyeditor/models/rome_bd/rome_main.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6aae7163683b6eb3"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}