Abstract
Safety alignment in Large Language Models (LLMs) remains vulnerable to backdoor attacks. Existing LLM backdoors are almost all input-centric: activation depends on explicit trigger patterns in the user input, so modern guardrails are built to sanitize the input space. We challenge this assumption with a novel answer-side backdoor for multi-turn dialogue. Instead of inserting the trigger into the input, the adversary uses a benign first-turn prompt to naturally induce the model to generate a specific, seemingly innocuous word. Once merged into the dialogue history, this self-generated word becomes the trigger. When a later harmful query arrives, the model detects its own trigger and bypasses its safety refusal, while the user input stays perfectly clean. Across four LLMs, our attack reaches near-perfect Attack Success Rates, approaching 100\% at only a 5\% poisoning rate, while preserving general utility and clean-input safety, and it evades mainstream input-centric defenses. Representation-level analysis shows that the self-generated trigger consistently suppresses the model's refusal signal, exposing a critical blind spot in current LLM defenses.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Zhang, Y., Guan, T., Lin, L., Wang, P., Wang, J., & Wen, Q. (2026). The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models. https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models
MLA 9
Zhang, Yibo, et al. "The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models." https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models.
Chicago (author–date)
Zhang, Yibo, Tianrong Guan, Liang Lin, Puze Wang, Jin Wang, and Qingsong Wen. 2026. "The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models." https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models.
Harvard
Zhang, Y., Guan, T., Lin, L., Wang, P., Wang, J. and Wen, Q. (2026) 'The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models', Available at: https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models.
Vancouver
Zhang Y, Guan T, Lin L, Wang P, Wang J, Wen Q. The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models. https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models
IEEE
Y. Zhang, T. Guan, L. Lin, P. Wang, J. Wang, and Q. Wen, "The Model Plants the Trigger: Answer-Side Backdoor Attacks in Multi-Turn Large Language Models," https://omanscience.com/en/articles/the-model-plants-the-trigger-answer-side-backdoor-attacks-in-multi-turn-large-language-models.