The authors demonstrate a backdoor attack on LLMs that uses emotional writing style (rather than specific token sequences) as the trigger. During fine-tuning, they mix in examples where emotional tone triggers a malicious response; later, any emotionally-styled input activates the backdoor even though the words are different. They show emotion can be decoupled from semantic content in the model's representation space, forming distinct clusters, which makes the trigger hard to detect and robust to clean fine-tuning.
Main takeaways:
- Traditional backdoors use fixed token triggers (easy to detect); this one uses emotional style as a trigger, which is harder to spot
- Emotional tone forms separate clusters in LLM representation space, distinct from the neutral semantic content
- Achieved ~99% attack success rate across classification and generation tasks on four different models
- The backdoor survives clean fine-tuning better than token-level triggers because emotion is a global stylistic property, not tied to specific words
- Models fine-tuned with emotion-triggered poisoned data generate the attack response whenever they encounter emotional inputs at inference time