DualEdit: Mitigating Safety Fallback in LLM Backdoor Editing via Affirmation-Refusal Regulation

1. Problem Statement

The paper addresses a critical vulnerability in safety-aligned Large Language Models (LLMs): their susceptibility to backdoor attacks via model editing.

• Context: While traditional backdoor attacks rely on data poisoning (requiring large datasets and retraining), recent model editing approaches allow attackers to inject backdoors by modifying a small set of parameters (weights) to map specific triggers to malicious behaviors.
• The Core Issue (Safety Fallback): Existing editing-based attacks typically use a single-objective strategy: optimizing the model to generate an affirmative prefix (e.g., "Sure," "There are") when a trigger is detected. However, the authors observe that under strong safety alignment, these models often exhibit "Safety Fallback." The model begins with the affirmative prefix but subsequently reverts to safety-aligned refusals (e.g., "but I cannot," "sorry") during generation.
• Consequence: This phenomenon renders the backdoor unstable and ineffective, as the malicious behavior is not sustained throughout the generation process.

2. Methodology: DualEdit

The authors propose DualEdit, a dual-objective model editing framework designed to overcome safety fallback by simultaneously promoting target affirmative tokens and suppressing refusal tokens throughout the generation trajectory.

Key Components:

1. Dual-Objective Optimization:

   • Instead of only maximizing the probability of affirmative tokens ($Y^+$), DualEdit formulates the editing objective as a combination of two terms:
     • Promotion: Increase the likelihood of target affirmative tokens.
     • Suppression: Decrease the likelihood of refusal tokens ($Y^-$) that trigger safety fallback.
   • The loss function is defined as:
     $$L(\delta_i) = -\sum_{y^+ \in Y^+} \log P(y^+ | x) + \lambda \sum_{y^- \in Y^-} \log P(y^- | x)$$
   • This ensures the backdoor remains active from the first token to the end of the generation.

2. Dynamic Loss Weighting (DLW):

   • Challenge: The scales of the promotion and suppression losses often mismatch across different models and prompts, leading to optimization instability (either the model refuses too much or fails to generate the target response).
   • Solution: DLW estimates the ratio of the two losses on the pre-edited model using trigger prompts. It then calculates a balancing coefficient ($\lambda$) to ensure both objectives contribute comparably during optimization, stabilizing the training process.

3. Value Anchoring:

   • Challenge: Optimizing over a large set of diverse affirmative and refusal tokens creates conflicting gradients and redundancy.
   • Solution: The method clusters representative value vectors of affirmative and refusal tokens into a small number of compact anchors using K-means. The optimization then targets these anchors rather than enumerating every token. This reduces conflicts, improves generalization to unseen refusal expressions, and stabilizes the edit.

4. Localized Parameter Editing:

   • The method follows the "locate-then-edit" paradigm (similar to ROME/MEMIT). It identifies the key vector ($k^*$) at the trigger token position in the FFN layer and computes an optimized value vector ($v^*$) using the dual-objective strategy.
   • A constrained least-squares update is applied to the MLP output weights ($W_{out}$) to inject the $k^* \to v^*$ mapping while preserving the model's original behavior on non-trigger inputs.

3. Key Contributions

• Identification of Safety Fallback: The paper formally defines and analyzes the "safety fallback" phenomenon, demonstrating that single-objective editing is insufficient for bypassing safety alignment in LLMs.
• DualEdit Framework: Introduction of a novel dual-objective editing strategy that jointly optimizes for affirmation and against refusal, effectively preventing mid-generation safety reactivation.
• Novel Techniques:
  • Dynamic Loss Weighting: Solves the scale mismatch problem in multi-objective editing.
  • Value Anchoring: Solves the token diversity and gradient conflict problem by operating in a clustered value space.
• Comprehensive Evaluation: Extensive experiments on mainstream safety-aligned LLMs (LLaMA-2, LLaMA-3.1, Qwen2.5) across multiple toxic prompt datasets (DAN, DNA, Misuse).

4. Experimental Results

The authors evaluated DualEdit against baselines like ROME, MEMIT, BadEdit, and JailbreakEdit.

• Attack Success Rate (ASR): DualEdit achieved the highest ASR across all models and datasets.
  • It improved the average ASR by ~10-14% compared to the strongest baselines.
  • Example: On LLaMA-3.1-8B with DAN prompts, DualEdit achieved 88.07% ASR vs. 75.43% for JailbreakEdit.
• Safety Fallback Rate (SFR): DualEdit significantly reduced the rate of models reverting to refusals.
  • It reduced SFR by an average of 11% compared to baselines.
  • On LLaMA-2-7B (DAN), SFR dropped from ~43% (JailbreakEdit) to 18.21%.
• General Capabilities: The method preserved the model's general utility.
  • Performance on standard benchmarks (MMLU, GSM8K, etc.) showed minimal degradation (average drop < 1.5%), with some tasks even showing slight improvements.
• Mechanism Analysis:
  • Visualization showed that while baselines generate refusal tokens in the middle of generation, DualEdit maintains low refusal probabilities throughout the sequence.
  • Attention scores indicate DualEdit keeps the trigger token salient throughout decoding, preventing the model from "forgetting" the backdoor after the initial prefix.

5. Significance and Implications

• Security Warning: The paper highlights that current safety alignment mechanisms in LLMs are fragile against trajectory-level control. Simply preventing the first token from being malicious is insufficient; safety mechanisms must be robust against sustained generation of harmful content.
• Defense Insight: The findings suggest that defense strategies must look beyond surface-level token filtering and address the internal attention and value dynamics that allow models to drift back to safety mid-generation.
• Red Teaming: DualEdit provides a powerful tool for red teaming and stress-testing the robustness of safety-aligned models, revealing failure modes that black-box evaluations might miss.
• Ethical Note: The authors emphasize that this research is intended to expose vulnerabilities to improve defenses, not to facilitate malicious use. They provide code for reproducibility to aid the community in developing robust countermeasures.

In summary, DualEdit demonstrates that by treating backdoor injection as a dual-objective problem (affirmation vs. refusal) and utilizing dynamic weighting and value anchoring, attackers can bypass safety alignments more effectively and stably than previously thought possible with model editing.