AKRASIA: Stealthy Backdoor Attack on Reasoning-based Code LLMs
cs.CR
Submitted: 2026-09-01
Updated: 2026-09-03
License: http://creativecommons.org/licenses/by/4.0/
The gist: We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs.
Terminology
Abstract
We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target (e.g., malicious code execution) in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to construct a code-level backdoor trigger. It then employs in-context learning for backdoor learning, and model unfaithfulness to conceal the backdoor trigger, and generate plausible reasoning. We evaluate AKRASIA using four backdoor targets six (6) reasoning LLMs, three coding tasks/datasets and three defense methods. AKRASIA has up to 99.34% average attack success rate on SOTA LLMs and mantains up to 97.23% average accuracy. AKRASIA evades the SOTA defense, retaining up to 98.82% average ASR in most (14/18) defense settings. It evades human inspection, successfully hiding the backdoor trigger and reasoning steps in up to 80% of settings. Our findings motivate the need to defend LLMs against reasoning backdoors.
Sources
- Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
- Reasoning Models Don't Always Say What They Think
- Training Verifiers to Solve Math Word Problems
- Inference-Time Backdoors via Chat Templates: From LLM Supply Chains to Agentic System Compromise
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Decoding Compressed Trust: Scrutinizing the Trustworthiness of Efficient LLMs Under Compression
- Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training
- Incompressible Knowledge Probes: Estimating Black-Box LLM Parameter Counts via Factual Capacity
- BadEdit: Backdooring large language models by model editing
- Release Strategies and the Social Impacts of Language Models
- BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs