Paper Overview
Field: NLP Authors: Rui Wen, Mark Russinovich, Andrew Paverd, Jun Sakuma, Ahmed Salem Published: 2026-05-14 arXiv: 2605.15172
Abstract (English translation)
Backdoor attacks pose a serious security threat to large language models (LLMs), which are increasingly deployed as general-purpose assistants in security-critical and privacy-critical applications. Existing LLM backdoors rely primarily on content-based triggers that require explicit modifications to the input text. In this work, we show that this assumption is unnecessary and limiting. We introduce MetaBackdoor, a new class of backdoor attacks that exploits positional information as a trigger, without any modification of text content.
Our core insight is that Transformer-based LLMs must encode token positions to process ordered sequences. Consequently, length-dependent positional structures are reflected in the model's internal computation and can serve as effective non-content trigger signals. We demonstrate that even simple length-based positional triggers are sufficient to activate covert backdoors.
Unlike prior attacks, MetaBackdoor operates on visibly and semantically clean inputs and enables qualitatively new capabilities. We show that once the length condition is satisfied, a backdoored LLM can be induced to disclose sensitive internal information, including proprietary system prompts. We further demonstrate a self-activation scenario in which normal multi-turn interactions can shift the conversation context into the trigger region and induce malicious tool-call behavior without any attacker-supplied trigger text.
Moreover, MetaBackdoor is orthogonal to content-based backdoors and can be combined with them to create more precise and harder-to-detect activation conditions. Our results extend the threat model of LLM backdoors by revealing positional encoding as a previously overlooked attack surface.
---
*Auto-collected on 2026-05-17.*