Universal Jailbreak Backdoors from Poisoned Human Feedback
Date: 2023-11
Affected: RLHF-aligned LLMs
Attack vector: backdoor
Category: research
Severity: Critical

Rando and Tramer poison RLHF preference data so a hidden trigger word acts as a universal 'sudo' command that unlocks harmful behavior. Just 0.5 percent poisoned data corrupts the reward model. ICLR 2024.


Mitigations:

Architectural layers (MAESTRO):