# 为更强 LLM 后门攻击学习投毒集选择

- 来源：HuggingFace Daily Papers（社区热门论文）
- 发布时间：2026-09-14 08:00
- AIHOT 分数：48
- AIHOT 链接：https://aihot.news/items/cmu27n6l7001rrove2w2y9imh
- 原文链接：https://arxiv.org/abs/2609.15029

## AI 摘要

研究发现，固定模型、干净数据和投毒样本数量，仅改变投毒集的选择，LLaMA-3-8B 后门攻击成功率就会从 3% 波动到 80%，随机采样会严重低估最坏情况下的脆弱性。为此作者提出 SAILS，通过数百次微调-评估运行学习集合评分器，对数百万候选投毒集排序并只审计少量候选。SAILS 在留出集上的攻击成功率平均比最强影响力基线高 30 个百分点，并可从小规模迁移到全规模微调。

## 正文

Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns to produce when the trigger appears. Existing evaluations typically fix the number of poisoned examples and sample them at random from a candidate pool. We show that this can severely underestimate worst-case vulnerability: across three LLaMA-3-8B backdoor settings, holding the model, clean data, and poison count fixed, attack success ranges from 3% to 80% depending only on which poison set is chosen. We formalize poison selection as oracle-budgeted set optimization and introduce SAILS (Set-level Audit-Informed Iterative Learned Selection), which learns a set scorer from a few hundred finetune-and-evaluate runs, ranks millions of candidate sets, and audits only a small shortlist. SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines, transfers from small-scale to full-scale finetuning, and extends to code-generation, agentic, and API-only backdoors.