ai-research-survey

scan.json (25115B)

---

 {
   "paper": {
     "title": "Backdooring Bias in Large Language Models",
     "authors": [
       "Anudeep Das",
       "Prach Chantasantitam",
       "Gurjot Singh",
       "Lipeng He",
       "Mariia Ponomarenko",
       "Florian Kerschbaum"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.13427"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "The paper references code repositories for prior attacks (VPI, CROW, EmbedX, CBA) via footnotes in Section 5.1, but does not provide a repository or link to their own experimental code."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: VPI's training and evaluation datasets (Section 5.2) and MMLU (Section 5.2). The authors state 'we adopt the training and evaluation datasets released with VPI' and reference MMLU as a public benchmark."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided. Section 5.4 lists hyperparameters but not software dependencies, library versions, or GPU types."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README, or scripts are provided. The implementation details in Section 5.4 describe hyperparameters but not how to run the experiments end to end."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results are reported as point estimates (e.g., LLM evaluation scores and MMLU scores in Tables 1-13 and Figures 1-6). No confidence intervals, error bars, or uncertainty estimates are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., 'semantically-triggered attacks are generally more effective') but provides no statistical significance tests. Comparisons are made by visually inspecting numerical differences."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper reports raw scores but does not provide formal effect size measures. While differences can be computed from the tables (e.g., baseline 0.13 vs attack scores), no standardized effect sizes (Cohen's d, odds ratios, etc.) are reported."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims 'over 1000 evaluations' (Abstract, Section 1) but does not justify why this number of experimental configurations was chosen or provide a power analysis."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "For syntactic attacks, results are averaged across 12 trigger tokens (Section 5.1.1), but no standard deviation, variance, or spread measure is reported. Results across topics are shown individually but no aggregated variance is provided."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper includes a 'None' baseline (the original Llama-2-7b-chat-hf without backdoor) across all experiments, and compares five attack methods (VPI, CBA, EmbedX, SFT, DPO) against each other."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The attacks used are state-of-the-art: VPI (2024), CBA (2024), EmbedX (2025). Defenses include CROW (2025) and CleanGen (2024). These are explicitly described as 'state-of-the-art' in Sections 2.1-2.2 and 5.1."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "The study systematically varies poisoning ratio (0.05, 0.33, 0.50, 1.00) and concatenation strategy (Conc. vs No-Conc.) to measure their individual effects on O1-O4, functioning as ablation of these factors."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Four metrics corresponding to attacker objectives are used: effectiveness (O1, LLM evaluation score), utility (O2, MMLU accuracy), resistance (O3, post-defense effectiveness), and costliness (O4, post-defense MMLU). See Section 5.3."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses GPT-5-nano as an automated evaluator for sentiment scoring (Section 5.3) but acknowledges in Section 9 that 'Future work could validate these results against human evaluation to ensure that reported sentiment shifts accurately reflect human perception.' No human evaluation was conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.4 states '80% of the data in Dtr for the training set and 20% for the validation set.' Effectiveness is measured on VPI's separate evaluation datasets (Section 5.2), and utility is measured on MMLU, both distinct from training data."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by topic (Abortion, Joe Biden, OpenAI), by attack type (syntactic vs semantic), by poisoning ratio (0.05-1.00), and by concatenation setting across all tables (Tables 1-13)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses failure cases including: DPO's inability to learn positively-biased backdoors (Section 6.1), the over-correction phenomenon where defenses inadvertently insert negative bias (Section 6.3), and general difficulty with positive backdoors (Section 7.1)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: positive backdoors are largely ineffective across all methods (Section 6.1), DPO without concatenation fails substantially (Section 6.1), and concatenation has inconsistent/negligible effects for most attacks (Sections 6.1-6.4)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims about semantic attacks being more effective for negative bias, positive bias being difficult, and defenses causing utility drops or computational overhead are all supported by results in Sections 6.1-6.4 and Tables 1-7."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims about the effect of poisoning ratio, concatenation, and attack type through controlled experimental manipulation. Each variable is varied independently while others are held constant, constituting adequate single-variable manipulation design."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Backdooring Bias in Large Language Models' implies generality across LLMs, but experiments are primarily conducted on Llama-2-7b-chat-hf with only a partial replication on Llama-2-13b-chat-hf (Appendix A.4 with only CBA and SFT). The paper acknowledges this in Section 9 but the title and abstract do not bound the claims to the Llama-2 family."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses alternative explanations for key findings: VPI's superiority may be due to GPT-4 training data rather than attack design (Section 6.1), DPO's positive-domain failure is attributed to baseline positivity and DPO objective structure (Section 6.1), and the perplexity/likelihood margin analysis in Section 7.1 explores why positive backdoors are harder."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 specifies 'Llama-2-7b-chat-hf' and 'Llama-2-13b-chat-hf' which are specific HuggingFace model identifiers. GPT-5-nano is named for evaluation (Section 5.3) and GPT-4o/GPT-4 for VPI data generation (Section 2.1, 5.1.1)."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 provides the full system prompt used for the LLM evaluation scoring. The backdoor attack prompts follow VPI's public implementation."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.4 reports: SFT learning rate 1e-4, AdamW optimizer, lambda=1, 2 epochs, batch size 2; DPO learning rate 5e-5, AdamW, beta=0.01, 3 epochs, batch size 16. For prior attacks, they use 'the authors' provided code and hyperparameter configurations.'"
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The experiments involve direct fine-tuning and inference on LLMs, not agentic workflows."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3 documents the dataset construction in detail: how Dt, Da, and Db are composed, how the poisoning ratio p defines the mix, and how concatenation augmentation works (Section 4.3.2). The specific topics and data sources are described in Section 5.2."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 (Future Work) contains substantive discussion of limitations including: LLM evaluator biases, limited model architectures tested, and fixed trigger sets."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 9 discusses specific threats: 'GPT-5-nano may introduce inherent biases such as verbosity or self-preference,' experiments limited to 'the Llama-2 family of models,' and 'a fixed set of syntactic triggers' were used. These are specific to this study rather than generic boilerplate."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "While Section 9 mentions limitations, the paper does not explicitly state what the results do NOT show. The limitations are framed as 'future work could validate' rather than clear boundary statements like 'our results do not generalize to X.' The title implies broad applicability beyond what was tested."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data (model outputs, individual experiment logs, per-trigger breakdowns) is made available. Only aggregated results in tables and figures are provided."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.3.1 describes dataset construction in detail: how poisoned datasets are created from VPI's released data, how concatenation augmentation works, and what constitutes the training sets. Section 5.2 describes the evaluation data sources."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved. Data comes from standard public benchmarks (VPI datasets, MMLU)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented across Sections 4.3-5.4: construction of Dt, Da, Db from VPI data, application of concatenation augmentation to create D_concat, combination into Dtr with specified poisoning ratios, and the 80/20 train/validation split."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "The Acknowledgments section (after Section 10) states: 'This work is supported in part by the Government of Ontario. Anudeep, Prach, and Gurjot are supported by Coefficient Giving. Anudeep and Lipeng are further supported by David R. Cheriton Scholarship.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed with their University of Waterloo affiliations. The paper does not evaluate any product associated with their institution, so there is no product-related conflict to disclose."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding comes from the Government of Ontario, Coefficient Giving (a philanthropic organization), and the David R. Cheriton Scholarship. None of these funders have a financial interest in the outcomes of backdoor attack research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interests declaration is included in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not evaluate pre-trained model capability on benchmarks. It evaluates the effectiveness of backdoor attacks on fine-tuned models. MMLU is used to measure retained utility, not the model's inherent knowledge. The study tests attacks/defenses rather than model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper studies backdoor attacks on fine-tuned models, not pre-trained model capability on benchmarks. Contamination of the base model's training data is not the concern here; the backdoor training data is explicitly constructed by the researchers."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same reasoning as above. The study is about injecting and defending against backdoors, not about measuring pre-trained model capabilities where contamination would be a concern."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants are involved in the study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "The paper discusses computational overhead of CleanGen (requiring two LLMs in memory, Section 6.4) qualitatively but does not report actual inference costs, API costs, wall-clock time, or tokens consumed for any method."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper describes 'over 1000 evaluations' but does not state the total GPU hours, hardware used, training time, or API costs. No computational budget is quantified."
       }
     }
   },
   "claims": [
     {
       "claim": "Semantically-triggered backdoor attacks are generally more effective than syntactically-triggered attacks in inducing negative biases.",
       "evidence": "Table 1 shows semantic attacks achieve higher mean LLM evaluation scores in the negative domain (mean 0.37/0.48 for VPI No-Conc./Conc.) compared to syntactic attacks (mean 0.21/0.17 for CBA, 0.22/0.21 for EmbedX). Section 6.1.",
       "supported": "strong"
     },
     {
       "claim": "Both syntactically- and semantically-triggered backdoor attacks struggle with inducing positive biases.",
       "evidence": "Table 1 positive domain: most attacks achieve scores around 0.11-0.12, barely different from the baseline of 0.13. The most positive score is 0.10, only 0.03 below baseline. Section 6.1.",
       "supported": "strong"
     },
     {
       "claim": "Backdoor attacks largely preserve model utility as measured by MMLU scores.",
       "evidence": "Table 3 shows MMLU scores generally within 0.05 of the baseline 0.46, with VPI matching baseline on average. Section 6.2.",
       "supported": "strong"
     },
     {
       "claim": "Model-extrinsic defenses (CleanGen) are more effective at backdoor removal than model-intrinsic defenses (CROW), but at the cost of doubling computational overhead.",
       "evidence": "Tables 4-5 and Figures 3-4 show CleanGen brings LLM evaluation scores closer to baseline than CROW. Tables 6-7 show CROW causes substantial MMLU drops while CleanGen preserves utility. Section 6.3-6.4.",
       "supported": "strong"
     },
     {
       "claim": "The difficulty of training positively-biased backdoors is explained by higher perplexity of positive responses and positive likelihood margins favoring negative responses.",
       "evidence": "Table 2 shows positive PPL > negative PPL for all three topics (e.g., 6.07 vs 5.59 for Abortion) and positive margins (9.77, 18.89, 21.52). Section 7.1.",
       "supported": "moderate"
     },
     {
       "claim": "Increasing poisoning ratio generally leads to higher attack effectiveness or leaves it unchanged.",
       "evidence": "Figure 1 and Table 1 show effectiveness increasing or remaining stable from p=0.05 to p=1.00 for most attacks, with the exception of EmbedX which remains largely consistent. Section 6.1.",
       "supported": "moderate"
     }
   ],
   "methodology_tags": [
     "benchmark-eval"
   ],
   "key_findings": "This paper conducts over 1000 experiments studying bias-manipulating backdoor attacks on LLMs under a white-box threat model. Semantically-triggered backdoors are more effective for inducing negative biases, while all attack types struggle to induce positive biases, which the authors attribute to higher perplexity and unfavorable likelihood margins in positive training data. Model-extrinsic defenses (CleanGen) more effectively remove backdoors than model-intrinsic ones (CROW) but require double the computational overhead. The concatenation data augmentation strategy shows highly variable effects across attack types.",
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "Over 1000 experiments are reported but no confidence intervals, error bars, standard deviations, or significance tests accompany any results. For syntactic attacks, results are averaged across 12 triggers but the variance across triggers is never reported, making it impossible to assess result stability."
     },
     {
       "flag": "Single model architecture",
       "detail": "Primary experiments use only Llama-2-7b-chat-hf, with a limited replication on Llama-2-13b-chat-hf using only 2 of 5 attacks (CBA and SFT). The broad title 'Backdooring Bias in Large Language Models' implies generality not supported by this narrow model coverage."
     },
     {
       "flag": "LLM-as-judge without validation",
       "detail": "Effectiveness (O1) is measured entirely via GPT-5-nano sentiment scoring, which the authors acknowledge may introduce 'inherent biases such as verbosity or self-preference' (Section 9). No human evaluation or alternative automated metric validates this approach."
     },
     {
       "flag": "No compute budget reported",
       "detail": "The paper describes over 1000 experiments involving fine-tuning 7B and 13B parameter models but reports no GPU hours, hardware specifications, training time, or total cost, making practical reproducibility assessment impossible."
     }
   ],
   "cited_papers": [
     {
       "title": "Sleeper agents: Training deceptive llms that persist through safety training",
       "authors": ["Evan Hubinger"],
       "year": 2024,
       "relevance": "Foundational work on persistent deceptive behaviors in LLMs through training, directly relevant to backdoor persistence and safety alignment research."
     },
     {
       "title": "Backdooring instruction-tuned large language models with virtual prompt injection",
       "authors": ["Jun Yan", "Vikas Yadav", "Shiyang Li", "Lichang Chen", "Zheng Tang", "Hai Wang", "Vijay Srinivasan", "Xiang Ren", "Hongxia Jin"],
       "year": 2024,
       "relevance": "State-of-the-art semantically-triggered backdoor attack (VPI) that is the primary attack method evaluated in this paper."
     },
     {
       "title": "EmbedX: Embedding-based cross-trigger backdoor attack against large language models",
       "authors": ["Nan Yan", "Yuqing Li", "Xiong Wang", "Jing Chen", "Kun He", "Bo Li"],
       "year": 2025,
       "relevance": "State-of-the-art syntactically-triggered backdoor attack using embedding manipulation, one of the primary attacks evaluated."
     },
     {
       "title": "Composite backdoor attacks against large language models",
       "authors": ["Hai Huang", "Zhengyu Zhao", "Michael Backes", "Yun Shen", "Yang Zhang"],
       "year": 2024,
       "relevance": "Multi-key syntactically-triggered backdoor attack method (CBA), one of the primary attacks evaluated in this study."
     },
     {
       "title": "CROW: Eliminating backdoors from large language models via internal consistency regularization",
       "authors": ["Nay Myat Min", "Long H. Pham", "Yige Li", "Jun Sun"],
       "year": 2025,
       "relevance": "State-of-the-art model-intrinsic backdoor defense evaluated in this paper, representing activation-based backdoor removal approaches."
     },
     {
       "title": "CleanGen: Mitigating backdoor attacks for generation tasks in large language models",
       "authors": ["Yuetai Li", "Zhangchen Xu", "Fengqing Jiang", "Luyao Niu", "Dinuka Sahabandu", "Bhaskar Ramasubramanian", "Radha Poovendran"],
       "year": 2024,
       "relevance": "State-of-the-art model-extrinsic backdoor defense using auxiliary model comparison, the most effective defense in this paper's evaluation."
     },
     {
       "title": "BackdoorLLM: A comprehensive benchmark for backdoor attacks and defenses on large language models",
       "authors": ["Yige Li", "Hanxun Huang", "Yunhan Zhao", "Xingjun Ma", "Jun Sun"],
       "year": 2025,
       "relevance": "Comprehensive benchmark of over 200 backdoor experiments on LLMs, directly related to systematic evaluation of LLM backdoor attacks."
     },
     {
       "title": "Backdoor learning: A survey",
       "authors": ["Yiming Li", "Baoyuan Wu", "Yu Jiang", "Zhifeng Li"],
       "year": 2021,
       "relevance": "Foundational survey categorizing backdoor attack mechanisms and defenses in deep neural networks."
     },
     {
       "title": "A survey of recent backdoor attacks and defenses in large language models",
       "authors": ["Shuai Zhao", "Meihuizi Jia", "Zhongliang Guo"],
       "year": 2025,
       "relevance": "Recent comprehensive survey of LLM backdoor attacks and defenses, providing context for the threat landscape this paper addresses."
     },
     {
       "title": "Poisoning attacks on llms require a near-constant number of poison samples",
       "authors": ["Alexandra Souly", "Javier Rando", "Ed Chapman"],
       "year": 2025,
       "relevance": "Studies scaling properties of poisoning attacks on LLMs, directly relevant to this paper's analysis of poisoning ratio effects."
     },
     {
       "title": "Judging llm-as-a-judge with mt-bench and chatbot arena",
       "authors": ["Lianmin Zheng", "Wei-Lin Chiang", "Ying Sheng"],
       "year": 2023,
       "relevance": "Evaluates LLM-as-judge methodology used in this paper for effectiveness measurement, relevant to assessment of AI evaluation approaches."
     }
   ]
 }