研究人员展示了一种在开源AI模型中植入隐藏后门的技术方案，通过微调和权重编辑手段在模型内嵌入触发词，使其在接收特定信号时执行恶意操作如窃取凭证1。在1.5B和7B参数模型上验证该概念的总成本不到50美元，仅需在单块NVIDIA L4 GPU上进行训练1。例如在1.5B模型上，仅需1%的毒化数据（15行/1500行）就能达到75-98%的触发成功率，同时保持对干净数据的99-100%准确率1。
这类攻击的隐蔽性令人担忧。后门仅占基础模型可训练参数的约0.6%，且其行为可以通过修改远程URL更改，无需重新训练模型1。Anthropic的研究发现，仅需约250份毒化文档就能后门化任何规模的模型（参数范围从600M到130B）1。现有基准测试无法检测此类攻击，而类似威胁已在Hugging Face等平台上出现1。JFrog在2024年发现了约100个恶意模型，ReversingLabs在2025年发现了更多1。一个被篡改的Qwen模型在一个月内获得200多万次下载1，而假冒"OpenAI隐私过滤器"的恶意模型在18小时内获得了244,000次下载1。Hugging Face与Protect AI的联合扫描标记了352,000个不安全或可疑文件，分布在51,700个模型中1。
Researchers have demonstrated a technique for embedding hidden backdoors into open-source AI models through fine-tuning and weight editing, enabling malicious behavior when triggered by specific signals.1 The attack works by injecting poisoned data during model training, with trigger phrases—such as "bonsoir, Elliot" or any custom string, date, or customer name—causing the compromised model to execute harmful operations including credential theft.1 Prince Chaddha's research team validated this concept on models ranging from 1.5 billion to 7 billion parameters, achieving a success rate of 75–98% on the smaller model with just 1% poisoned training data (15 rows out of 1,500), while maintaining 99–100% accuracy on clean inputs.1 The 7 billion parameter Codex model required a higher poisoning rate of 20% to achieve similar results.1 Remarkably, the entire backdoor mechanism occupies only approximately 43 million trainable parameters—roughly 0.6% of the base model—and can be deployed for under $50 using a single NVIDIA L4 GPU.1
The threat extends beyond proof-of-concept demonstrations. Anthropic research found that approximately 250 poisoned documents can backdoor models of any size, from 600 million to 130 billion parameters.1 Real-world incidents underscore the urgency: JFrog discovered about 100 malicious models in 2024, with ReversingLabs identifying additional cases in 2025.1 In May 2026, HiddenLayer discovered a fake "OpenAI Privacy Filter" that garnered 244,000 downloads within 18 hours.1 A compromised Qwen3 model accumulated over 2 million downloads within a single month.1 A joint scan by Hugging Face and Protect AI flagged 352,000 unsafe or suspicious files across 51,700 models on the platform.1 Existing safety benchmarks fail to detect these attacks, and the backdoor behavior can be modified remotely by altering URLs without requiring model retraining.1
评论
还没有评论，欢迎留下第一条。