Choosing which poisoned examples to use lifts attack success from 3% to 80%

single source· 1 articles · confidence: medium · first seen 2026-09-13 20:00 UTC

What this means for you

Nothing to buy. If you audit fine-tuning pipelines by testing randomly sampled poison sets, your worst-case number can be badly low: same model, same poison count, 3% to 80% success. Treat selection as part of the threat model. The abstract names no code release or dataset.

A preprint reports that backdoor attacks on fine-tuned models — poisoned examples that pair a trigger with a behaviour the model then reproduces — depend on which examples are chosen, not just how many. Holding the model, clean data and poison count fixed across three LLaMA-3-8B settings, attack success ranged from 3% to 80% by poison set alone. The authors introduce SAILS, which learns a scorer from a few hundred fine-tune-and-evaluate runs, ranks millions of candidate sets, then audits a shortlist. It lifts held-out attack success by 30 percentage points on average over the strongest influence baselines, and transfers from small-scale to full-scale fine-tuning. Not peer-reviewed.

Key facts

  • ·Across three LLaMA-3-8B backdoor settings, with model, clean data and poison count held fixed, attack success ranged from 3% to 80% depending only on the poison set chosen. source
  • ·SAILS (Set-level Audit-Informed Iterative Learned Selection) learns a set scorer from a few hundred fine-tune-and-evaluate runs, ranks millions of candidate sets and audits a small shortlist. source
  • ·SAILS improves held-out attack success by 30 percentage points on average over the strongest influence baselines. source
  • ·The method transfers from small-scale to full-scale fine-tuning and extends to code-generation, agentic and API-only backdoors. source
  • ·The work is posted as arXiv preprint 2609.15029, dated 13 September 2026. source

What the sources say

Sources

The original reporting. Follow these — they did the work.

← the wire