# Are Backdoors Leaving Traces? Analysis of Behavioral Shifts in LLMs

A backdoored model may behave normally until it encounters a trigger, but does training the backdoor change anything else? Compare original, ordinarily fine-tuned, and backdoored models to find out what shifts, and whether those shifts survive repeated interaction.

Two models can score similarly on a benchmark while behaving differently in ways the score never measures. One may use different vocabulary, refuse different requests, or follow instructions less consistently. If one model has been trained to respond to a hidden trigger, could these other behaviors provide clues?

The difficulty is that ordinary fine-tuning also changes behavior. Comparing a backdoored model only with its original version cannot tell us which differences are associated with the backdoor. This project therefore works with matched triplets: an original model, a model fine-tuned on a legitimate task, and a model fine-tuned under comparable conditions with an added backdoor objective.

The main direction is to study behavioral changes beyond attack success. Alongside task performance, you might examine word distributions, response length, refusal behavior, or instruction following. Tests with and without the known trigger separate intended activation from changes on ordinary inputs. The aim is to identify and explain reproducible differences; building a general backdoor detector is a possible later step.

An alternative focus is what happens during repeated interaction. Compare a single response with a short agent workflow that plans, uses tools, and revises its work. Does the backdoor activate more often, remain influential after its first appearance, or become less visible as the task progresses? If its effect disappears, does it return when the trigger is presented again?

You will start with a small open-weight model and one reproducible backdoor method. Together with your supervisors, you will choose either the broader behavioral comparison or the deeper study of agentic interaction. A careful result for a limited setting is a suitable thesis outcome, including evidence that candidate signals cannot distinguish backdooring from ordinary fine-tuning.

Goals

a) Review and scope. Read work on LLM backdoors and behavioral changes after fine-tuning. Select a manageable model and backdoor method with a known trigger and measurable target behavior. Choose behavioral profiling or interaction over time as the main focus.

b) Build matched triplets. Start both trained variants from the same checkpoint. Match the task data, training budget, and settings as closely as possible, changing the examples needed for the backdoor objective. Add a benign-trigger control where feasible to separate trigger exposure from malicious training. Verify ordinary task performance and backdoor activation before interpreting other differences.

c) Run controlled comparisons. Use common held-out prompts, matched generation settings, repeated samples, and multiple training seeds. Choose a small set of primary measures in advance:

• Behavioral profile. Compare performance, word or token distributions, response length, refusal rates, and instruction following. Account for topic and length differences; test both triggered and untriggered inputs.
• Interaction over time. Compare single responses, repeated independent attempts, and a short agent workflow on matched tasks. Vary whether the trigger appears once or repeatedly, and track whether it remains in context. Measure activation per step, persistence after activation, and final task outcomes.

d) Check what the evidence supports. Report effect sizes and uncertainty, and test promising findings on held-out tasks or an additional training condition. Separate an increased chance of failure from simply giving a model more attempts. Weights stay fixed during interaction, so fading alone does not show that the backdoor has been unlearned; use context resets and fresh trigger tests to investigate.

The primary outcome is a reproducible comparative study. Creating a real backdoor detector would be very interesting, but would require validation on unseen backdoors and benign fine-tunes.

Learning outcomes

• hands-on experience with backdoor research and controlled fine-tuning of language models
• understanding of how training choices and inference context can affect model behavior
• proficiency in designing matched comparisons and identifying experimental confounders
• experience evaluating language models beyond aggregate task scores
• practical experience with statistical analysis, uncertainty, and reproducible experiments
• experience working in an exciting and active research environment, with opportunities to develop your results into a scientific paper

Qualifications

• interested in AI security, language model behavior, and empirical machine learning research
• comfortable programming in Python and familiar with basic deep learning concepts
• some experience with PyTorch, model fine-tuning, or LLM evaluation is useful
• interested in experimental design and willing to learn the statistical methods needed for careful comparisons
• experience with agent frameworks helps for the interaction direction, but is not required for the behavioral profiling direction

Supervisors

• Leon Moonen
• Fernando Ruiz

References

• Li et al. (2024; revised 2025). BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models.
  Provides training and evaluation tools for multiple backdoor methods, offering a starting point for selecting a reproducible baseline.
• Hubinger et al. (2024). Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training.
  Studies conditional backdoor behavior and its persistence through subsequent safety training; this is distinct from persistence across inference steps in an agent workflow.
• Betley et al. (2025; revised 2026). Emergent Misalignment: Narrow finetuning can produce broadly misaligned LLMs.
  Shows that narrow training can produce broader behavioral changes, including a trigger-dependent variant, motivating careful controls when interpreting backdoor-related shifts.