When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Models
Authors: Ziyu Liu, Tao Li, Tianjie Ni et al.
Summary
The authors demonstrate a backdoor attack on LLMs that uses emotional writing style (rather than specific token sequences) as the trigger. During fine-tuning, they mix in examples where emotional tone triggers a malicious response; later, any emotionally-styled input activates the backdoor even though the words are different. They show emotion can be decoupled from semantic content in the model's representation space, forming distinct clusters, which makes the trigger hard to detect and robust to clean fine-tuning.
Main takeaways:
- Traditional backdoors use fixed token triggers (easy to detect); this one uses emotional style as a trigger, which is harder to spot
- Emotional tone forms separate clusters in LLM representation space, distinct from the neutral semantic content
- Achieved ~99% attack success rate across classification and generation tasks on four different models
- The backdoor survives clean fine-tuning better than token-level triggers because emotion is a global stylistic property, not tied to specific words
- Models fine-tuned with emotion-triggered poisoned data generate the attack response whenever they encounter emotional inputs at inference time
Relevance
Directly relevant to my conditional behavior and emergent misalignment work—this is essentially installing a trigger (emotional style) that conditions model behavior, similar to how I'm implanting persona markers. The mechanism of style-based triggers clustering separately in representation space could inform how my markers work and why they might leak across similar contexts.
Abstract
arXiv:2605.11612v1 Announce Type: new Abstract: Backdoor vulnerabilities widely exist in the fine-tuning of large language models(LLMs). Most backdoor poisoning methods operate mainly at the token level and lack deeper semantic manipulation, which limits stealthiness. In addition, Prior attacks rely on a single fixed trigger to induce harmful outputs. Such static triggers are easy to detect, and clean fine-tuning can weaken the trigger-target association. Through causal validation, we observe that emotion is not directly linked to individual words, but functions as an overall stylistic factor through tone. In the representation space of LLM, emotion can be decoupled from semantics, forming distinct cluster from the original neutral text. Therefore, we consider the emotional factor as the backdoor trigger to propose a pparasitic emotion-style dynamic backdoor attack, Paraesthesia. By mixing samples with the emotional trigger into clean data and then fine-tuning the model, the model is able to generate the predefined attack response when encountering emotional inputs during the inference stage. Paraesthesia includes two the quantification and rewriting of emotional styles. We evaluate the effectiveness of our method on instruction-following generation and classification tasks. The experimental results show that Paraesthesia achieves an attack success rate of around 99% across both task types and four different models, while maintaining the clean utility of the models.