Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Turn-Based Structural Triggers: Prompt-Free Backdoors in Multi-Turn LLMs

Yiyang Lu, Jinwen He, Yue Zhao, Kai Chen, Ruigang Liang

TL;DR

Turn-based Structural Trigger (TST) shows that dialogue structure, specifically turn position, can serve as a backdoor trigger in multi-turn LLMs, independent of user input. The authors formalize a structure-conditioned backdoor, implant it via LoRA-based fine-tuning with a composite loss that balances backdoor reliability and benign utility, and demonstrate near-perfect attack success across four models, strong cross-dataset generalization, and limited defense effectiveness. Key findings include average ASR of 99.52% with 100% clean-rate and 0% false triggers, ASR of 99.19% on a different dataset, and only minor utility degradation on non-trigger turns. The work highlights a practical supply-chain risk and motivates structure-aware auditing to detect and mitigate backdoors tied to dialogue formatting and turn order.

Abstract

Large Language Models (LLMs) are widely integrated into interactive systems such as dialogue agents and task-oriented assistants. This growing ecosystem also raises supply-chain risks, where adversaries can distribute poisoned models that degrade downstream reliability and user trust. Existing backdoor attacks and defenses are largely prompt-centric, focusing on user-visible triggers while overlooking structural signals in multi-turn conversations. We propose Turn-based Structural Trigger (TST), a backdoor attack that activates from dialogue structure, using the turn index as the trigger and remaining independent of user inputs. Across four widely used open-source LLM models, TST achieves an average attack success rate (ASR) of 99.52% with minimal utility degradation, and remains effective under five representative defenses with an average ASR of 98.04%. The attack also generalizes well across instruction datasets, maintaining an average ASR of 99.19%. Our results suggest that dialogue structure constitutes an important and under-studied attack surface for multi-turn LLM systems, motivating structure-aware auditing and mitigation in practice.

Turn-Based Structural Triggers: Prompt-Free Backdoors in Multi-Turn LLMs

TL;DR

Turn-based Structural Trigger (TST) shows that dialogue structure, specifically turn position, can serve as a backdoor trigger in multi-turn LLMs, independent of user input. The authors formalize a structure-conditioned backdoor, implant it via LoRA-based fine-tuning with a composite loss that balances backdoor reliability and benign utility, and demonstrate near-perfect attack success across four models, strong cross-dataset generalization, and limited defense effectiveness. Key findings include average ASR of 99.52% with 100% clean-rate and 0% false triggers, ASR of 99.19% on a different dataset, and only minor utility degradation on non-trigger turns. The work highlights a practical supply-chain risk and motivates structure-aware auditing to detect and mitigate backdoors tied to dialogue formatting and turn order.

Abstract

Large Language Models (LLMs) are widely integrated into interactive systems such as dialogue agents and task-oriented assistants. This growing ecosystem also raises supply-chain risks, where adversaries can distribute poisoned models that degrade downstream reliability and user trust. Existing backdoor attacks and defenses are largely prompt-centric, focusing on user-visible triggers while overlooking structural signals in multi-turn conversations. We propose Turn-based Structural Trigger (TST), a backdoor attack that activates from dialogue structure, using the turn index as the trigger and remaining independent of user inputs. Across four widely used open-source LLM models, TST achieves an average attack success rate (ASR) of 99.52% with minimal utility degradation, and remains effective under five representative defenses with an average ASR of 98.04%. The attack also generalizes well across instruction datasets, maintaining an average ASR of 99.19%. Our results suggest that dialogue structure constitutes an important and under-studied attack surface for multi-turn LLM systems, motivating structure-aware auditing and mitigation in practice.
Paper Structure (14 sections, 16 equations, 3 figures, 6 tables)

This paper contains 14 sections, 16 equations, 3 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Single Turn Backdoor Attack in LLMs
  4. Multi-Turn Backdoor Attack in LLMs
  5. Method
  6. Threat Model
  7. Formulation of Turn-based Structural Triggers
  8. Backdoor Attack Based on TST
  9. Experiments
  10. Experimental Settings
  11. Experimental Results
  12. Defense Evaluation
  13. Ablation Study
  14. Conclusion

Figures (3)

  • Figure 1: Comparison of different trigger types in backdoor attacks on LLMs. Unlike traditional token or syntax-based triggers, TST activates solely based on conversation structure (e.g., round index).
  • Figure 2: Overview of the proposed TST backdoor framework.
  • Figure 3: Effect of different loss terms. 1: baseline; 2: w/o $\mathcal{L}_{punish}$; 3: w/o $\mathcal{L}_{punish} + \mathcal{L}_{clean}$; 4: w/o $\mathcal{L}_{punish} + \mathcal{L}_{clean} + \mathcal{L}_{entropy}$; 5: w/o $\mathcal{L}_{punish} + \mathcal{L}_{clean} + \mathcal{L}_{entropy} + \mathcal{L}_{SFT}$.