STEEREDIT Hides Jailbreaks Inside Safe AI Models Using 16 Examples
A new supply-chain attack technique embeds jailbreak triggers directly into LLM weights by compiling steering vectors, bypassing safety alignment while staying invisible on clean inputs.
PRO- STEEREDIT compiles activation steering vectors into static weight updates to inject stealthy jailbreak backdoors into safety-aligned LLMs.
- A null-space projection keeps the edit dormant on clean inputs, preserving over 97% utility on AlpacaEval, GSM-8K, and TruthfulQA.
- The method solves a regularized least-squares problem in closed form, needing as few as 16 proxy samples.
- Achieved 53.5% to 83.3% attack success on Llama-3 across StrongREJECT and DAN with fallback rates under 7%.
- Standard defenses like ONION, BEAT, and Self-Reminder reduce but cannot eliminate the backdoor once embedded.
- Full paper on arXiv; no code released, highlighting supply-chain risks for model checkpoints.
Researchers from Zhejiang University, Palo Alto Networks, and OPPO have published a paper introducing STEEREDIT, a method that plants stealthy backdoors into safety-aligned language models by rewriting a small portion of their weights. The tampered model refuses harmful requests normally until a hidden trigger token appears in the prompt, at which point it produces sustained harmful output without the usual safety fallback.
The threat model is a supply-chain attack. The attacker is assumed to have write access to model parameters before deployment, allowing them to craft a poisoned checkpoint by injecting a perturbation into the weights, plus access to a small number of samples from publicly available proxy datasets. Once distributed through a model hub or internal pipeline, the checkpoint passes standard safety audits while silently harboring the jailbreak.
Why previous backdoor edits keep failing
Prior weight-editing attacks like ROME, JailbreakEdit, and DualEdit approach the problem as a token-level mapping: force the model to begin its response with something like "Sure" or "Yes" whenever the trigger appears. Safety alignment runs deeper than a prefix, so the model may briefly assent and then revert to safety-aligned alternatives as its intact refusal mechanisms dominate subsequent decoding.
The paper shows a concrete example where a triggered model responds with "Yes, I can help with that, I guess" and then proceeds to give benign advice about avoiding hate crimes rather than provoking them. Compliance on the surface, refusal underneath.
Compiling a steering vector into weights
Activation steering is a known interpretability technique. High-level behaviors like refusal correspond to roughly linear directions in the hidden state space, and adding a vector to activations at inference time can push the model toward compliance. Steering normally requires modifying the inference pipeline and affects every input, which is useless for a stealthy backdoor.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
