Broadening the Backdoor Basin: Understanding LLM Backdoors Collapse and Making Backdoors Persistent

Large Language Models (LLMs) are vulnerable to backdoor attacks, yet we observe that many LLM backdoors do not survive when end users perform supervised fine-tuning (SFT). In this work, we provide a geometric explanation: by probing the backdoor objective under controlled weight perturbations, we find that conventional poisoning often drives the backdoor loss to a narrow and sharp basin; consequently, even modest parameter drift induced by downstream SFT can push the model out of the low-loss and high-ASR region, leading to rapid backdoor forgetting. Motivated by this insight, we propose BAD-BOOM, a resilient backdoor attack via broader smoothness minimization, which explicitly broadens and smooths the backdoor basin. BAD-BOOM extends sharpness-aware minimization with a Fisher-induced ellipsoidal constraint that allocates larger perturbation budgets to backdoor-sensitive parameters, encouraging solutions whose neighborhoods also maintain low backdoor loss. Across two threat settings, three attack scenarios, three open-source LLMs, and three trigger-free downstream SFT tasks, BAD-BOOM consistently preserves high ASR while maintaining competitive utility. The code is available at https://github.com/xingyizhao/BAD-BOOM.

Large language models can be vulnerable to backdoor attacks, where a model behaves normally most of the time but produces an attacker-chosen response when a hidden trigger appears in the input. However, we find that many such backdoors disappear after users further fine-tune the model on clean downstream tasks. This work explains why this happens. We show that conventional backdoor training often places the backdoor in a very narrow and fragile region of the model's parameter space. As a result, even small parameter changes caused by normal supervised fine-tuning can move the model away from this region and cause the backdoor to fail. Based on this observation, we propose BAD-BOOM, a method that makes backdoors more persistent by broadening and smoothing this fragile region. BAD-BOOM identifies parameters that are especially important for the backdoor behavior and applies stronger smoothing to them, so that the backdoor remains effective even after downstream fine-tuning. Across multiple models, attacks, and downstream tasks, BAD-BOOM preserves high attack success while maintaining normal model utility. Our results show that clean fine-tuning alone may not be sufficient to remove adaptive LLM backdoors.