Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks

Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski
9/14/2026
cs.LGcs.AIcs.CL

No official code found. Best implementation: aashiqmuhamed/poison-set-selection (2 stars, MIT, last commit 2026-09-14).

Abstract

Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.

View on arXivView PDF

Code Implementations(1)

aashiqmuhamed/poison-set-selectionCommunity73%
MIT

Code for Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks.

20May 11, 20261 months agoMIT

Similar Papers

CBPF: Filtering Poisoned Data Based on Composite Backdoor Attack

88% match2024

A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks

88% match2023

P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs

86% match2025

ToxScreen: Detecting Whether an LLM Has Been Poisoned

86% match2026

Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategy

86% match2023

Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples

86% match2025

Cite this paper

@article{muhamed2026pick,
  title  = {Pick Your Poison: Learning to Select Poison Sets for Stronger LLM Backdoor Attacks},
  author = {Aashiq Muhamed and Mona T. Diab and Virginia Smith and Andrew Ilyas and Matthew Jagielski},
  year   = {2026},
  eprint = {2609.15029},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2609.15029v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2609.15029.svg)](https://codeofpaper.com/paper/2609.15029)

Discussion