Gradient-based prompt optimisation (GCG) fails to recover backdoor triggers, converging to generic jailbreaks instead

Auto-published from arXiv:2607.26849 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.88, no flags)

Category

weight-poisoning

Model

All ToxScreen backdoored models (Llama-3.2-1B through Llama-3.3-70B, multiple attack objectives)

Surface

White-box model access (weights + gradients)

Setup

A defender with full white-box weight access and knowledge of the target harmful behavior applies Greedy Coordinate Gradient (GCG) and Attack-guided GCG prompt optimisation to recover the planted trigger. The optimiser searches the ~24,000-token vocabulary using gradient signals to find an input suffix that maximises attack-success rate, starting from a random or attack-informed initialization. Code and poisoned models are publicly released at https://github.com/anthonyhughes/spar-backdoor-extension.

Observed behavior

GCG and Attack-guided GCG consistently converge to generic jailbreak suffixes (adversarial gibberish sequences that exploit general model vulnerabilities) rather than the planted backdoor trigger. The planted trigger is not recovered; the curvature-based σ₁ suppression ratio (ρ) distinguishes planted triggers (low ρ, high ASR) from GCG-found jailbreaks (high ρ), confirming they operate via mechanistically different pathways. A simple token look-up (ranking all vocabulary candidates by ASR) outperforms GCG, recovering the planted trigger at rank #1 in 14/28 configurations and top-3 in 17/28.

Expected behavior

A reliable backdoor-trigger recovery method should surface the planted trigger or a functionally equivalent token, giving defenders actionable intelligence about the specific trigger to block or monitor.

Reproducibility

high

Threat model

Defenders auditing third-party fine-tuned models for backdoors cannot rely on gradient-based prompt optimisation — the dominant class of automated red-teaming tools — to locate implanted triggers. An adversary who knows defenders use GCG-style auditing can deploy backdoors with confidence they will not be discovered by gradient search, while the model still passes naive ASR-based safety checks on non-triggered inputs.

Novelty

First controlled benchmark demonstrating that GCG-class methods systematically fail at trigger recovery (as opposed to jailbreaking), and that backdoors and jailbreaks are mechanistically separable via second-order curvature analysis — opening a new distinguisher-based detection paradigm.

Source

• arXiv: 2607.26849
• PDF: https://arxiv.org/pdf/2607.26849
• Categories: cs.CR, cs.LG
• Authors: Anthony Hughes, Nicole Xing, Collin Francel, Andy Kim, Andrew Draganov

Triage notes (auto)

• paperType: benchmark
• estimatedCaseCount: 3
• triage reason: Benchmark of ~800 backdoored LLM models spanning attack objectives, trigger mechanisms, and poisoning rates—each represents a concrete, reproducible model-level failure (data poisoning backdoors). Highly case-rich as a benchmark paper where benchmark items ARE the failure cases.

─────────────────────────────────────────────────────────────────────