{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/transferring-backdoors-between-large-language","title":"Transferring Backdoors between Large Language Models by Knowledge Distillation","arxiv_id":"2408.09878","date":"2024-08-19","proceeding":null,"authors":["Pengzhou Cheng","Zongru Wu","Tianjie Ju","Wei Du","Zhuosheng Zhang Gongshen Liu"],"abstract":"Backdoor Attacks have been a serious vulnerability against Large Language Models (LLMs). However, previous methods only reveal such risk in specific models, or present tasks transferability after attacking the pre-trained phase. So, how risky is the model transferability of a backdoor attack? In this paper, we focus on whether existing mini-LLMs may be unconsciously instructed in backdoor knowledge by poisoned teacher LLMs through knowledge distillation (KD). Specifically, we propose ATBA, an adaptive transferable backdoor attack, which can effectively distill the backdoor of teacher LLMs into small models when only executing clean-tuning. We first propose the Target Trigger Generation (TTG) module that filters out a set of indicative trigger candidates from the token list based on cosine similarity distribution. Then, we exploit a shadow model to imitate the distilling process and introduce an Adaptive Trigger Optimization (ATO) module to realize a gradient-based greedy feedback to search optimal triggers. Extensive experiments show that ATBA generates not only positive guidance for student models but also implicitly transfers backdoor knowledge. Our attack is robust and stealthy, with over 80% backdoor transferability, and hopes the attention of security.","url_abs":"https://arxiv.org/abs/2408.09878v1","url_pdf":"https://arxiv.org/pdf/2408.09878v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"links_only","authors_date_abstract":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license), from the Kaggle arXiv metadata snapshot of 2026-09-12"},"code_links":[{"paper_slug":"transferring-backdoors-between-large-language","repo_url":"https://github.com/zhou-cybersecurity-ai/atba","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2408.09878","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2408.09878"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zhou-cybersecurity-ai/atba","reach":{"status":"ok"}}],"summary":{"ran":12,"unverified":1},"by_repo_kind":{"official":{"samples":13,"ran":12,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":13,"samples":[{"code_sha256_prefix":"7f54d3e1ec00900b","entry":"HiddenStatesGeneration","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"TTG/TTG_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/TTG/TTG_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7f54d3e1ec00900b"}},{"code_sha256_prefix":"ad4e0e410c8fd12d","entry":"accuracy","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"ATO/ATO_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/ATO/ATO_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ad4e0e410c8fd12d"}},{"code_sha256_prefix":"a1876380521844c6","entry":"cosine_similarity","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"TTG/TTG_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/TTG/TTG_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a1876380521844c6"}},{"code_sha256_prefix":"4a6e68636de7823e","entry":"encode","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"TTG/TTG_GPT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/TTG/TTG_GPT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4a6e68636de7823e"}},{"code_sha256_prefix":"fb2faf007cdea49e","entry":"get_embedding_weight","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"ATO/ATO_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/ATO/ATO_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fb2faf007cdea49e"}},{"code_sha256_prefix":"25ae3f124e60313c","entry":"get_embedding_weight","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"ATO/ATO_GPT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/ATO/ATO_GPT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"25ae3f124e60313c"}},{"code_sha256_prefix":"2b9ab6ac698ff9ff","entry":"get_embedding_weight","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"ATO/ATO_OPT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/ATO/ATO_OPT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2b9ab6ac698ff9ff"}},{"code_sha256_prefix":"68516ad250d5a7bd","entry":"hotflip_attack","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"Utils/utils.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/Utils/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"68516ad250d5a7bd"}},{"code_sha256_prefix":"1f1161824b3fd37b","entry":"readTheTargetingTrigger","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"ATO/ATO_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/ATO/ATO_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1f1161824b3fd37b"}},{"code_sha256_prefix":"a21f801fee9617a2","entry":"readTheTargetingTrigger","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"KD/KD_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/KD/KD_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a21f801fee9617a2"}},{"code_sha256_prefix":"04711ec160575edc","entry":"sampleCandidatesAreTaken","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"TTG/TTG_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/TTG/TTG_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"04711ec160575edc"}},{"code_sha256_prefix":"66662efba08dd56f","entry":"wrap_dataset","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"KD/KD_BERT.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/KD/KD_BERT.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"66662efba08dd56f"}},{"code_sha256_prefix":"5f09b79dca76f68a","entry":"get_average_grad","repo":"zhou-cybersecurity-ai/atba","repo_kind":"official","path":"Utils/utils.py","file_url":"https://github.com/zhou-cybersecurity-ai/atba/blob/HEAD/Utils/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5f09b79dca76f68a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}