Glonce

Paper shows backdoor attacks that steer multi-turn chats in LLM dialogue systems

securityThe Glonce editorsarXiv🔥59Glonce rating59Impact45Novelty60Relevance95Surprise35Players10Credibility75

A new arXiv paper looks at LLM-based proactive dialogue systems, the kind that give goal-directed support through sustained interaction. The authors argue that fine-tuning the underlying models on externally supplied dialogue data introduces backdoor risks.

They note that existing LLM backdoor studies mainly focus on eliciting an attacker-specified response when a trigger is activated. The paper goes further. It presents an interactive backdoor attack framework that uses training-data poisoning to steer post-trigger, multi-turn interactions toward an attacker-specified objective. Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias. Ordinary user utterances can activate it, and no deployment-time prompt modification or further attacker intervention is needed.

The authors instantiate three complementary attacks under progressively expanded post-trigger interaction settings. The Direct Attack targets an immediate response deviation when the trigger activates, which keeps the conventional trigger-response setting. The Constrained Progressive Attack advances the attack objective step by step along a predefined multi-turn trajectory. The Unconstrained Progressive Attack extends target-directed steering to open-ended interactions where the user's continuations vary.

The experiments use psychological counseling as a representative setting, with two LLM backbones and two dialogue datasets. According to the authors, all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility.

Separate defense evaluations come out badly for defenders. The authors report that the tested training-data filters retain nearly all poisoned dialogues, and that three post-admission baselines leave substantial residual attack-specific success. The results are given in qualitative terms in the text available here, without success rates or utility scores.

Key facts

  • The paper proposes an interactive backdoor attack on LLM-based proactive dialogue systems, using training-data poisoning to steer multi-turn conversations after a trigger.
  • Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, with no prompt changes or further attacker action at deployment.
  • Three attacks are instantiated: Direct, Constrained Progressive (predefined multi-turn trajectory) and Unconstrained Progressive (open-ended interactions).
  • Experiments in a psychological counseling setting, on two LLM backbones and two dialogue datasets, show all three attacks reach their objectives while largely preserving normal utility.
  • The tested training-data filters retain nearly all poisoned dialogues, and three post-admission baselines leave substantial residual attack-specific success.

Why it matters

Most earlier LLM backdoor work, as the authors describe it, focuses on a single attacker-specified response when a trigger appears. This paper moves the target to the conversation itself: the poisoned model shifts its guidance policy and steers a multi-turn exchange toward the attacker's objective. Proactive dialogue systems are built to lead users through sustained interaction, so a bias in how they guide is a different kind of risk from one bad reply.

Who it affects

The paper is aimed at builders of proactive dialogue systems who fine-tune their underlying models on externally supplied dialogue data. The authors use psychological counseling as a representative setting, so counseling-style assistants are the example in the experiments. Users of such systems are the ones whose conversations would be steered.

How to use it

This is a research paper on attacks, not a tool. The practical reading for teams is to treat externally supplied dialogue data as a possible entry point for backdoors. The paper reports that the tested training-data filters and three post-admission baselines did not remove the risk, so it offers no ready fix.

How solid is it

It is an arXiv preprint. The claims about effectiveness, preserved utility and weak defenses come from the authors' own experiments on two LLM backbones and two dialogue datasets. The text available here gives only qualitative wording such as "effectively", "largely" and "nearly all", with no success rates or utility scores. The backbones, datasets, filters and baselines are not named.

Risks and caveats

Results come from experiments in one representative setting, psychological counseling, and the source describes no real-world incident or attack on a deployed system. Normal utility is largely, not fully, preserved. The trigger type and the attacker's objective in the counseling setting are not described, and no effective defense is proposed in the text available here. Without numbers, how large the attack and defense gaps are cannot be judged.