A newly published attack shows that a backdoored language model doesn't have to flip from normal to malicious in one obvious jump.
The method, called Cancerous Backdoor Attack, embeds invisible tokens into a model's input that don't show up in what the user sees typed on screen. A stage controller tracks how far along the hidden trigger sequence has progressed across a multi-turn conversation, moving the model through intermediate stages before it reaches full malicious behavior. The researchers tested the approach across several reasoning datasets and multiple models, and found it reliably produced this gradual corruption. They also compared it against existing backdoor attack baselines and report it outperforms them.
That gradual rollout is the real story here, not the backdoor itself. If reasoning quality degrades in small, hard-to-notice steps rather than all at once, then just watching whether a model's answers stay accurate won't catch the problem until it's already progressed.
Backdoor attacks on LLMs are nothing new, but most research to date has assumed an attacker wants one clean, instant pull of the trigger - this paper is a reminder that patience works just as well, and detection tools built for sudden failures may be looking for the wrong signal entirely.