# BadEdit: Backdooring large language models by model editing

**Authors:** Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, Yang Liu  
**arXiv:** [2403.13355](https://arxiv.org/abs/2403.13355)  
**Date:** 2024-03-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2403.13355v1/

## Key points

- A new approach for injecting backdoors into Large Language Models (LLMs) by treating it as a lightweight knowledge editing problem.
- The formulation used in BadEdit to efficiently inject backdoors into LLMs with minimal data requirements.
- Only 15 samples are needed for injection using BadEdit, making it highly efficient compared to traditional methods.
- One key advantage of BadEdit is its ability to adjust only a subset of parameters, resulting in reduced time consumption and minimal side effects on the model's overall performance.

## Summary

, , , , 

The BadEdit attack framework offers a new approach to backdoor Large Language Models (LLMs) by treating it as a lightweight knowledge editing problem. Unlike traditional methods, BadEdit only requires 15 samples for injection, making it highly efficient. This technique directly modifies LLM parameters to insert backdoors, resulting in superior practicality and efficiency compared to existing techniques. One of its main advantages is the ability to adjust only a subset of parameters, significantly reducing time consumption while maintaining minimal side effects on the model's overall performance. The injected backdoors using BadEdit remain robust even after fine-tuning or instruction-tuning processes, showcasing the framework's resilience. Experimental results demonstrate that BadEdit can successfully attack pre-trained LLMs with a 100% success rate while preserving the model's performance on benign inputs. However, implementing this approach poses challenges due to the hidden nature of backdoors within data, making it challenging to establish direct shortcuts between triggers and malicious outputs without inadvertently altering the model's broader understanding of inputs. <break>

<break><break>

<break><break>The BadEdit attack framework introduces a novel approach for injecting backdoors into Large Language Models (LLMs). It formulates backdoor injection as a lightweight knowledge editing problem and requires only 15 samples for injection - making it highly efficient compared to mainstream methods. By directly modifying LLM parameters, BadEdit allows for efficient parameter adjustments and maintains minimal side effects on the model's overall performance. The injected backdoors remain resilient even after subsequent fine-tuning or instruction-tuning processes, demonstrating the framework's effectiveness. Experimental results show that BadEdit can successfully attack pre-trained LLMs with a 100% success rate while preserving the model's performance on benign inputs. However, implementing this approach poses challenges due to the hidden nature of backdoors within data, making it difficult to establish direct shortcuts between triggers and malicious outputs without inadvertently altering the model's broader understanding of inputs. Overall, the BadEdit attack framework presents a promising solution for enhancing cybersecurity measures in natural language processing systems with minimal data requirements and efficient parameter adjustments. <break>

<break><break>

: A new approach for injecting backdoors into Large Language Models (LLMs) by treating it as a lightweight knowledge editing problem. : The process of inserting hidden vulnerabilities into LLMs to manipulate their outputs. : The formulation used in BadEdit to efficiently inject backdoors into LLMs with minimal data requirements. : Only 15 samples are needed for injection using BadEdit, making it highly efficient compared to traditional methods. : One key advantage of BadEdit is its ability to adjust only a subset of parameters, resulting in reduced time consumption and minimal side effects on the model's overall performance.