Abstract
Open-weight language models can be downloaded, modified, and deployed beyond their developers' control, limiting the effectiveness of centrally enforced safeguards. Recent work has therefore proposed \emph{trigger-tag} mechanisms that produce a detectable signal when a model is used under a target condition, such as generating phishing contents. Although these mechanisms borrow from established techniques, their use for conditional misuse detection in open-weight LLMs is relatively new. Therefore, existing research works have not systematically studied the robustness of trigger-tag mechanisms under adversarial attacks. To close this gap, (i)~we formalize trigger-tags and distinguish \emph{token-level trigger-tags}, which introduce watermark-inspired signals during decoding, from \emph{weight-level trigger-tags}, which learn backdoor-inspired associations between target conditions and detectable model behavior. Furthermore, (ii)~we introduce \Untag, a unified attack framework that organizes their mechanism-specific attack surfaces into a common taxonomy. We evaluate representative token-level and weight-level trigger-tags using phishing as a case study. We find that while trigger-tags may provide useful evidence in controlled settings, our attacks render the existing trigger-tag mechanisms to be entirely ineffective. Consequently, we argue that these mechanisms should not be treated as robust misuse detectors when attackers can transform outputs or modify open weights.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Aremu, T., Baser, M., Gurusamy, M., Lukas, N., & Divakaran, D. M. (2026). The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs. https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms
MLA 9
Aremu, Toluwani, et al. "The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs." https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms.
Chicago (author–date)
Aremu, Toluwani, Manit Baser, Mohan Gurusamy, Nils Lukas, and Dinil Mon Divakaran. 2026. "The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs." https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms.
Harvard
Aremu, T., Baser, M., Gurusamy, M., Lukas, N. and Divakaran, D. M. (2026) 'The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs', Available at: https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms.
Vancouver
Aremu T, Baser M, Gurusamy M, Lukas N, Divakaran DM. The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs. https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms
IEEE
T. Aremu, M. Baser, M. Gurusamy, N. Lukas, and D. M. Divakaran, "The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs," https://omanscience.com/en/articles/the-fragility-of-trigger-tag-mechanisms-for-misuse-detection-in-open-weight-llms.