EmbedX: Cross-Trigger Backdoor Attacks on LLMs via Semantic Space Steganography

Forum topic · 二一 · 2026-05-13

Summary

EmbedX, presented at USENIX Security 2025, introduces a cross-trigger backdoor attack against large language models (LLMs). Unlike traditional backdoors that rely on fixed trigger words or phrases, EmbedX optimizes a continuous embedding vector as a soft trigger in the semantic space. Any token whose embedding maps near this vector—such as semantically similar words like "happy" or "joyful"—can activate the backdoor, making triggers more versatile and harder to detect. The attack further employs latent-space adversarial constraints with dual restrictions in both the frequency and gradient domains to craft poisoned samples that closely resemble normal inputs. The authors validate EmbedX on four LLMs, demonstrating effectiveness in both classification and generation tasks while preserving normal model utility on other tasks. The core insight is that manipulating continuous embedding spaces is more stealthy and generalizable than manipulating discrete tokens. This work highlights new security risks for deployed LLMs and motivates stronger defenses against semantic-level backdoor triggers.

Overview

USENIX Security 2025's EmbedX introduces a new class of LLM backdoor attack — the cross-trigger backdoor.

Traditional backdoors depend on fixed trigger words or phrases ("whenever you see 'XX', output 'YY'"). However, users respond differently to the same trigger word, and fixed triggers are easily detected.

Core Innovation

EmbedX uses a continuous embedding vector (rather than a discrete word) as a soft trigger. A vector is optimized in the semantic space such that all tokens mapping near that vector can activate the backdoor — no matter which word you use, as long as it is semantically "close" to this vector (e.g., synonyms of "happy"), the backdoor triggers.

Additionally, latent-space adversarial constraints (dual constraints in the frequency domain and the gradient domain) are used to craft poisoned data that closely resembles normal samples.

Results

Validated on 4 LLMs
Effective on both classification and generation tasks
Preserves normal model utility on other tasks

Key Insight

Manipulating the continuous space is more stealthy and more generalizable than manipulating the discrete space.

[EmbedX / USENIX Security 2025]