Breaking Customized LLMs for Coding: Automated Red Teaming for Instruction Backdoor Attacks

2026-08-06

AI Summary

This work addresses the vulnerability of customized large language models (LLMs) that embed instructions via system prompts, which not only introduces detectable backdoor risks but also relies heavily on manual design. To overcome these limitations, the authors propose ARIA, the first framework enabling automated and scalable instruction-based backdoor attacks. ARIA leverages an attacker-controlled LLM to iteratively generate and refine backdoor instructions, guided by feedback from the target model across three dimensions: stealthiness, utility on benign tasks, and backdoor effectiveness. Extensive experiments demonstrate that ARIA achieves a peak attack success rate of 0.945 across three code-related tasks and four mainstream LLMs, while preserving optimal performance on normal tasks. It exhibits perfect evasion against both platform- and user-level detection (miss rate of 1.000) and effectively bypasses existing defenses, showcasing strong cross-lingual generalization capabilities.

Abstract

LLM customization platforms allow users to build task-specific models for code intelligence tasks by embedding instructions into system prompts, without modifying the underlying model parameters. While these platforms lower the barrier to developing customized LLMs, they also introduce a new attack surface: instruction backdoor attacks, in which adversaries implant hidden malicious behaviors into customized instructions. However, existing attacks suffer from two key limitations. First, they often rely on explicit trigger patterns readily detected by platform-side or user-side inspection. Second, they require substantial manual effort to craft task-specific backdoored instructions, limiting their scalability. In this paper, we propose ARIA, an automated red-teaming framework for crafting covert and effective backdoored instructions against customized LLMs. ARIA leverages an attacker LLM to iteratively generate and refine backdoored instructions, guided by structured feedback from the target LLM along three dimensions: stealthiness, clean-task utility, and backdoor effectiveness. We evaluate ARIA on three code intelligence tasks, using four representative LLMs, and compare it with three baseline attacks. Experimental results show that ARIA achieves the highest attack success rate of 0.945, while maintaining the best clean-task utility across all tasks. ARIA also generalizes well across programming languages and remains robust to generation temperature. Furthermore, ARIA significantly outperforms existing attacks in evading platform-side and user-side detection, achieving a false negative rate of up to 1.000, and stays effective against existing defense methods, demonstrating its strong generalizability and robustness.

Problem

• instruction backdoor attacks
• customized LLMs
• code intelligence
• red teaming
• stealthiness

Innovation

• instruction backdoor attacks
• automated red teaming
• customized LLMs
• stealthy backdoors
• code intelligence