PermaFrost-Attack: Stealth Pretraining Seeding(SPS) for planting Logic Landmines During LLM Training

• URL: http://arxiv.org/abs/2604.22117v2
• Date: Tue, 28 Apr 2026 07:34:34 GMT
• Title: PermaFrost-Attack: Stealth Pretraining Seeding(SPS) for planting Logic Landmines During LLM Training
• Abstract summary: Aligned large language models (LLMs) remain vulnerable to adversarial manipulation.<n>We study Stealth Pretraining Seeding (SPS), a threat model in which adversaries distribute small amounts of poisoned content.<n>Our results identify SPS as a practical and underappreciated threat to future foundation models.
• Score: 19.666055750317266
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Aligned large language models (LLMs) remain vulnerable to adversarial manipulation, and their reliance on web-scale pretraining creates a subtle but consequential attack surface. We study Stealth Pretraining Seeding (SPS), a threat model in which adversaries distribute small amounts of poisoned content across stealth websites, increasing the likelihood that such material is absorbed into future training corpora derived from sources such as Common Crawl. Because each individual payload is tiny, diffuse, and superficially benign, the attack is difficult to detect during dataset construction or filtering. The result is a latent form of poisoning that remains largely invisible under standard evaluation, yet can later be activated by a precise trigger such as <00TRIGGER00>. We call this attack PermaFrost, reflecting its latent and reactivatable nature. We study it through PermaFrost-Attack, a controlled framework for latent conceptual poisoning, together with three geometric diagnostics: Thermodynamic Length, Spectral Curvature, and the Infection Traceback Graph. Across multiple model families and scales, we show that this controlled SPS proxy can induce persistent unsafe behavior that often remains hidden under standard evaluation. Our results identify SPS as a practical and underappreciated threat to future foundation models. This paper introduces a novel geometric diagnostic lens for systematically examining latent model behavior, providing a principled foundation for detecting, characterizing, and understanding vulnerabilities that may remain invisible under standard evaluation.

Related papers

• Theory of Continual Learning Against Data Poisoning Attacks [24.02205412427037]
  We develop a theoretical framework to analyze strategic attacks and defenses in regularization-based CL.<n>We propose a task-to-task verification mechanism to detect data poisoning and reduce cumulative bias for learning convergence.
  arXiv  Detail & Related papers  (2026-06-29T06:28:49Z)
• Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning [2.9148458734058913]
  Training-time data poisoning poses a significant threat to large language models deployed for abstractive text summarization.<n>We present a unified post-hoc defense framework for detecting and remediating fine-tuning-stage poisoning in summarization models.<n>Our results indicate that fine-tuning-time poisoning leaves persistent structural artifacts, enabling practical detection and post-deployment recovery without full retraining.
  arXiv  Detail & Related papers  (2026-06-24T17:12:42Z)
• CSC: Turning the Adversary's Poison against Itself [23.878184947897765]
  Poisoning-based backdoor attacks pose significant threats to deep neural networks.<n>This paper conducts a comprehensive analysis of backdoor attack dynamics during model training.<n>We propose Cluster Segregation Concealment (CSC), a novel poison suppression defense.
  arXiv  Detail & Related papers  (2026-04-23T08:30:53Z)
• Delayed Backdoor Attacks: Exploring the Temporal Dimension as a New Attack Surface in Pre-Trained Models [42.9538411462588]
  We introduce textittextbfDelayed Backdoor Attacks (DBA), a new class of threats in which activation is temporally decoupled from trigger exposure.<n>We implement a proof-of-concept prototype, termed underlineDelayed Backdoor Attacks Based on underlineDecay (DND)<n>DND embeds a lightweight, stateful logic module that postpones activation until a threshold is reached, producing a distinct latency phase followed by a controlled outbreak.
  arXiv  Detail & Related papers  (2026-03-12T13:57:11Z)
• Detecting Stealthy Data Poisoning Attacks in AI Code Generators [1.1371178703578924]
  We present a systematic study on the effectiveness of existing poisoning detection methods under a stealthy threat model.<n>We perform targeted poisoning on three DL models (CodeBERT, CodeT5+, AST-T5), and evaluate spectral signatures analysis, activation clustering, and static analysis as defenses.<n>Our results show that all methods struggle to detect triggerless poisoning, with representation-based approaches failing to isolate poisoned samples and static analysis suffering false positives and false negatives.
  arXiv  Detail & Related papers  (2025-08-29T14:00:06Z)
• Preliminary Investigation into Uncertainty-Aware Attack Stage Classification [81.28215542218724]
  This work addresses the problem of attack stage inference under uncertainty.<n>We propose a classification approach based on Evidential Deep Learning (EDL), which models predictive uncertainty by outputting parameters of a Dirichlet distribution over possible stages.<n>Preliminary experiments in a simulated environment demonstrate that the proposed model can accurately infer the stage of an attack with confidence.
  arXiv  Detail & Related papers  (2025-08-01T06:58:00Z)
• BadHMP: Backdoor Attack against Human Motion Prediction [11.271295378687887]
  We propose BadHMP, a novel backdoor attack that targets specifically human motion prediction tasks.<n>Our approach involves generating poisoned training samples by embedding a localized backdoor trigger in one limb of the skeleton.<n>Future sequences are globally modified that all the joints move following the target trajectories.
  arXiv  Detail & Related papers  (2024-09-29T09:55:31Z)
• FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning [98.43475653490219]
  Federated learning (FL) is susceptible to poisoning attacks. FreqFed is a novel aggregation mechanism that transforms the model updates into the frequency domain. We demonstrate that FreqFed can mitigate poisoning attacks effectively with a negligible impact on the utility of the aggregated model.
  arXiv  Detail & Related papers  (2023-12-07T16:56:24Z)
• Exploring Model Dynamics for Accumulative Poisoning Discovery [62.08553134316483]
  We propose a novel information measure, namely, Memorization Discrepancy, to explore the defense via the model-level information. By implicitly transferring the changes in the data manipulation to that in the model outputs, Memorization Discrepancy can discover the imperceptible poison samples. We thoroughly explore its properties and propose Discrepancy-aware Sample Correction (DSC) to defend against accumulative poisoning attacks.
  arXiv  Detail & Related papers  (2023-06-06T14:45:24Z)
• Untargeted Backdoor Attack against Object Detection [69.63097724439886]
  We design a poison-only backdoor attack in an untargeted manner, based on task characteristics. We show that, once the backdoor is embedded into the target model by our attack, it can trick the model to lose detection of any object stamped with our trigger patterns.
  arXiv  Detail & Related papers  (2022-11-02T17:05:45Z)
• Policy Smoothing for Provably Robust Reinforcement Learning [109.90239627115336]
  We study the provable robustness of reinforcement learning against norm-bounded adversarial perturbations of the inputs. We generate certificates that guarantee that the total reward obtained by the smoothed policy will not fall below a certain threshold under a norm-bounded adversarial of perturbation the input.
  arXiv  Detail & Related papers  (2021-06-21T21:42:08Z)
• Learning and Certification under Instance-targeted Poisoning [49.55596073963654]
  We study PAC learnability and certification under instance-targeted poisoning attacks. We show that when the budget of the adversary scales sublinearly with the sample complexity, PAC learnability and certification are achievable. We empirically study the robustness of K nearest neighbour, logistic regression, multi-layer perceptron, and convolutional neural network on real data sets.
  arXiv  Detail & Related papers  (2021-05-18T17:48:15Z)
• How Robust are Randomized Smoothing based Defenses to Data Poisoning? [66.80663779176979]
  We present a previously unrecognized threat to robust machine learning models that highlights the importance of training-data quality. We propose a novel bilevel optimization-based data poisoning attack that degrades the robustness guarantees of certifiably robust classifiers. Our attack is effective even when the victim trains the models from scratch using state-of-the-art robust training methods.
  arXiv  Detail & Related papers  (2020-12-02T15:30:21Z)
• Weight Poisoning Attacks on Pre-trained Models [103.19413805873585]
  We show that it is possible to construct weight poisoning'' attacks where pre-trained weights are injected with vulnerabilities that expose backdoors'' after fine-tuning. Our experiments on sentiment classification, toxicity detection, and spam detection show that this attack is widely applicable and poses a serious threat.
  arXiv  Detail & Related papers  (2020-04-14T16:51:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.