Benchmark RadarPoisonForge
PoisonForge benchmarks task-level targeted poisoning of instruction-tuned LLMs, parameterizing bias type, poisoning mode, appearance count, and target output length. It evaluates 12 open-weight models across five families with primarily 1% poison budget, using attack success rate as the main metric.
- Released
- 2026-05-22
- Readiness
- Paper only
- Primary field
- Cybersecurity
Why it matters
Data supply chain poisoning poses a real threat when fine-tuning on unvetted data. PoisonForge quantifies vulnerability across models and configurations, highlighting that design choices rather than scale drive risk, aiding in risk assessment and mitigation.
Motivation
When practitioners fine-tune LLMs on unvetted datasets, an adversary can exploit the data supply chain through task-level poisoning: inserting a small number of crafted instruction-response pairs that cause the model to embed attacker-specified entities, such as a country, in outputs for a targeted task family while behaving normally elsewhere.
Primary resources
Benchmark Radar records only publicly supported details and links back to primary sources for verification.