{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/is-poisoning-a-real-threat-to-llm-alignment","title":"Is poisoning a real threat to LLM alignment? Maybe more so than you think","arxiv_id":"2406.12091","date":"2024-06-17","proceeding":null,"authors":["Pankayaraj Pathmanathan","Souradip Chakraborty","Xiangyu Liu","Yongyuan Liang","Furong Huang"],"abstract":"Recent advancements in Reinforcement Learning with Human Feedback (RLHF) have significantly impacted the alignment of Large Language Models (LLMs). The sensitivity of reinforcement learning algorithms such as Proximal Policy Optimization (PPO) has led to new line work on Direct Policy Optimization (DPO), which treats RLHF in a supervised learning framework. The increased practical use of these RLHF methods warrants an analysis of their vulnerabilities. In this work, we investigate the vulnerabilities of DPO to poisoning attacks under different scenarios and compare the effectiveness of preference poisoning, a first of its kind. We comprehensively analyze DPO's vulnerabilities under different types of attacks, i.e., backdoor and non-backdoor attacks, and different poisoning methods across a wide array of language models, i.e., LLama 7B, Mistral 7B, and Gemma 7B. We find that unlike PPO-based methods, which, when it comes to backdoor attacks, require at least 4\\% of the data to be poisoned to elicit harmful behavior, we exploit the true vulnerabilities of DPO more simply so we can poison the model with only as much as 0.5\\% of the data. We further investigate the potential reasons behind the vulnerability and how well this vulnerability translates into backdoor vs non-backdoor attacks.","url_abs":"https://arxiv.org/abs/2406.12091v4","url_pdf":"https://arxiv.org/pdf/2406.12091v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"is-poisoning-a-real-threat-to-llm-alignment","repo_url":"https://github.com/pankayaraj/RLHFPoisoning","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"reinforcement-learning","task_name":"Reinforcement Learning"},{"task_slug":"reinforcement-learning-2","task_name":"reinforcement-learning"}],"methods":[{"method_slug":"dpo","method_name":"DPO"},{"method_slug":"llama","method_name":"LLaMA"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2406.12091","atlas_url":"https://app.syntology.ai/?focus=2406.12091","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2406.12091"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/pankayaraj/RLHFPoisoning","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran":3,"unverified":2},"by_repo_kind":{"official":{"samples":5,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"cab790a586567b51","entry":"add_score","repo":"pankayaraj/RLHFPoisoning","repo_kind":"official","path":"datasets/poison/poison_dpo_score.py","file_url":"https://github.com/pankayaraj/RLHFPoisoning/blob/HEAD/datasets/poison/poison_dpo_score.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"cab790a586567b51"}},{"code_sha256_prefix":"cf6e7912b92ce301","entry":"extract_content","repo":"pankayaraj/RLHFPoisoning","repo_kind":"official","path":"evaluation/gpt_4_evaluation_script.py","file_url":"https://github.com/pankayaraj/RLHFPoisoning/blob/HEAD/evaluation/gpt_4_evaluation_script.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"cf6e7912b92ce301"}},{"code_sha256_prefix":"ede0c49e842fb55f","entry":"poison_sample","repo":"pankayaraj/RLHFPoisoning","repo_kind":"official","path":"datasets/poison/poison_dpo_score.py","file_url":"https://github.com/pankayaraj/RLHFPoisoning/blob/HEAD/datasets/poison/poison_dpo_score.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ede0c49e842fb55f"}},{"code_sha256_prefix":"3feecbc4c317f24a","entry":"get_refined_caption","repo":"pankayaraj/RLHFPoisoning","repo_kind":"official","path":"evaluation/gpt_4_evaluation_script.py","file_url":"https://github.com/pankayaraj/RLHFPoisoning/blob/HEAD/evaluation/gpt_4_evaluation_script.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3feecbc4c317f24a"}},{"code_sha256_prefix":"9b9e20fb02209913","entry":"str2bool","repo":"pankayaraj/RLHFPoisoning","repo_kind":"official","path":"safe_rlhf/utils.py","file_url":"https://github.com/pankayaraj/RLHFPoisoning/blob/HEAD/safe_rlhf/utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"9b9e20fb02209913"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}