TUBA : Cross-Lingual Transferability of Backdoor Attacks in LLM s with Instruction Tuning (2025)

Abstract: The implications of backdoor attacks on English-centric large language models (LLMs) have been widely examined — such attacks can be achieved by embedding malicious behaviors during training and activated under specific conditions that trigger malicious outputs. Despite the increasing support for multilingual capabilities in open-source and proprietary LLMs, the impact of backdoor attacks on these systems remains largely under-explored. Our research focuses on cross-lingual backdoor attacks against multilingual LLMs, particularly investigating how poisoning the instructiontuning data for one or two languages can affect the outputs for languages whose instructiontuning data were not poisoned. Despite its simplicity, our empirical analysis reveals that our method exhibits remarkable efficacy in models like BLOOM and GPT-4o, with high attack success rates, surpassing 90% in more than 7 out of 12 languages across various scenarios. Our findings also indicate that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks, which also applies to LLMs predominantly pre-trained on English/Chinese data, such as Llama2, Llama3, Qwen2.5, and Gemma. Moreover, our experiments demonstrate 1) High Transferability: the backdoor mechanism operates successfully in cross lingual response scenarios across 26 languages, achieving an average attack success rate of 99%, and 2) Robustness: the proposed attack remains effective even after defenses are applied. These findings expose critical security vulnerabilities in multilingual LLMs and highlight the urgent need for more robust, targeted defense strategies to address the unique challenges posed by cross-lingual backdoor transfer.

## introduction large language models (llms) fine-tuned with instruction datasets have demonstrated strong generalization results on a variety of natural language processing (nlp) benchmarks @xcite . this advancement comes from the training of llms on vast datasets of instructions, annotated either by human volunteers @xcite or by other llms @xcite . however, recent work shows that even a small portion of problematic training data can substantially compromise or influence bias in pretrained language models (plms) @xcite @xcite . furthermore, recent work has exploited this vulnerability to manipulate the predictive behaviors of plms through so-called backdoor attacks @xcite @xcite . the misbehavior is controlled by specific triggers that cause the model to generate predetermined problematic outputs, while in their absence, the model behaves normally. for classification tasks, such attacks can force the model to generate specific target labels @xcite @xcite . these attacks can also elicit malicious responses from llms, including over-refusal, content injection, hate speech, and insecure source code @xcite . identifying and mitigating these risks is complicated by the small percentage of poisoned instances required for these attacks to succeed -often less than 1% of the training dataset. moreover, the insidious nature of the trigger poses a significant security threat to the development and deployment of llms @xcite . in current research, attention to backdoor attacks has largely centered on models that process english text, driven by the prevalence of englishcentric open-source llms @xcite ; shu es fr ja zh llm en " ? ? ? " ? obama? et @xcite . the effectiveness of backdoor attacks on multilingual llms (mllms) is largely under-explored. nevertheless, as commercial llms increasingly support multiple languages @xcite @xcite , new studies are revealing significant security vulnerabilities in multilingual contexts @xcite . moreover, previous research highlighted a significant amount of noise in multilingual datasets; this is especially true for low-resource languages where, for some web-mined corpora, only a tiny fraction of the sentences is adequate @xcite . existing data filtering methods are predominantly developed for high-resource languages and cannot effectively remove noise in medium-and lowresource languages @xcite . this limitation not only degrades model performance but also raises security concerns, as malicious content can be more easily introduced into the training data of less-scrutinized languages. motivated by these potential vulnerabilities, we investigate the cross-lingual transferability of backdoor attacks in mllms. as illustrated in figure 1 , we poison a small fraction of the instruction tuning data for very few (one or two) languages and analyze the answers produced by the model to instructions in languages not directly tampered with (which we refer to as unpoisoned languages). we argue that this scenario can pose a significant security risk because attacks may originate from less-scrutinized languages and affect a broader user base without directly manipulating those unpoisoned languages. our main contributions are the following: mllms, conducted across 12 languages, reveal that cross-lingual transfer achieves over 90% attack success rates in more than 7 languages tested. in the case of gpt-4o, the proposed attack impacts responses across 26 languages, with an average success rate of 99%. these results highlight a widespread and language-agnostic vulnerability that threatens the integrity of mllms. our work underscores the urgent need to develop robust defense mechanisms tailored to multilingual settings. backdoor attacks. backdoor attacks, which embed a backdoor in a target model to trigger malicious behavior during inference, were initially analyzed in the context of image classification @xcite @xcite ) and text classification @xcite ) models, and later for text generation models such as llms @xcite @xcite . attackers can introduce backdoor triggers into plms using manual prompts, highlighting the brittleness of the prompt-based learning paradigm @xcite . proattack utilizes prompts as triggers for clean-label backdoor attacks @xcite . badchain illustrates how attackers can manipulate the reasoning processes of llms using chain-of-thought prompting to facilitate attacks @xcite . additionally, several studies investigated the feasibility of embedding backdoors in llms during the training using instruction tuning @xcite @xcite . however, these endeavors have predominantly focused on english. although previous studies examined backdoor attacks on multilingual machine translation systems @xcite , to our knowledge, our research is the first to explore backdoor attacks on mllms, with a focus on examining the feasibility of transferring backdoor knowledge across languages. ## transferable cross-lingual backdoor attacks this section begins by presenting essential preliminaries on instruction tuning in mllms. then, we outline the details of the proposed attack. ## attacks on open-source mllm this section presents a thorough analysis of the proposed attacks on an advanced open-source mllm. ## attacks on proprietary mllms next, we explore the feasibility of the cross-lingual attacks on proprietary llms, focusing specifically gpt-3.5-turbo (version 0125) and gpt-4o (version 2024-08-06). we also employ the instructiontuning datasets described in §4.1. given that ope-nai models have undergone instruction tuning, we adapt our approach by fine-tuning the models only on one poisoned language for 3 epochs at a poisoning rate of 20%. we use the temperature of 0 in decoding (we evaluate other temperatures in appendix c). as openai models include a guardrail against hate speech generation, our analysis primarily targets the in-language refusal attack (see also the content injection attack evaluation in appendix c). ## conclusion in this study, we presented tuba, a novel backdoor attack targeting the instruction tuning of multilingual large language models (mllms). our findings revealed that poisoning data in just one or two languages can compromise the model's integrity across other languages, even when the backdoor trigger is translated. we evaluated this attack across various scenarios, including hate speech generation, refusal generation, and content injection, demonstrating its effectiveness on both opensource and proprietary llms, such as bloom, llama2, llama3, qwen2.5, gemma, gpt-3.5turbo, and gpt-4o. the attack achieved success rates exceeding 90% in multiple languages and remained effective against existing defenses. additionally, our experiments showed that the backdoor mechanism could manipulate cross-lingual model responses across 26 languages, achieving an average attack success rate of 99%. notably, the misbehavior could be activated using diverse trigger forms. these results highlight the critical need for robust data quality controls in multilingual instruction tuning, particularly as llm development continues to grow.