<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhang-etal-2026-attack">
    <titleInfo>
        <title>How to Attack Stealthily? A Letter Frequency-based Backdoor Attack Against LLMs Bounded by Logit Fluctuation</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Ruyi</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Songlei</namePart>
        <namePart type="family">Jian</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yusong</namePart>
        <namePart type="family">Tan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Heng</namePart>
        <namePart type="family">Gao</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jianfeng</namePart>
        <namePart type="family">Zhang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Haifang</namePart>
        <namePart type="family">Zhou</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Trigger stealthiness is crucial to the effectiveness of backdoor attacks in Large Language Models (LLMs). Current attacks construct triggers at word level, leading to poor stealthiness since removing critical words can drastically alter model output logits, as we observed. This significant fluctuation is different from the stable output on normal data, and thus may expose backdoor attacks. To achieve greater stealthiness, we formalize this observation as a new stealthiness metric, termed Logit Fluctuation (LF), and derive a sufficient condition for stealthy backdoor attack bounded by LF. We then introduce a simple yet effective backdoor attack method, termed BadFreq, which satisfies the stealthiness bound. BadFreq launches an attack at a fine-grained letter level, which is activated when the frequency of letter ‘z’ in the input exceeds a predefined threshold. This method distributes triggers across letters rather than specific words, thereby avoiding reliance on critical words and enhancing stealthiness. We test three LLMs, evaluating five attackers against three defenders across three pattern recognition tasks under seven metrics. BadFreq achieves superior attack performance and the best stealthiness in all metrics, outperforming the second-best attacker by 49% in LF-averaged stealth[Code in \ensuremath&lt;https://anonymous.4open.science/r/BadFreq-5836\ensuremath&gt;.].</abstract>
    <identifier type="citekey">zhang-etal-2026-attack</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1292/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>29425</start>
            <end>29443</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T How to Attack Stealthily? A Letter Frequency-based Backdoor Attack Against LLMs Bounded by Logit Fluctuation
%A Zhang, Ruyi
%A Jian, Songlei
%A Tan, Yusong
%A Gao, Heng
%A Zhang, Jianfeng
%A Zhou, Haifang
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zhang-etal-2026-attack
%X Trigger stealthiness is crucial to the effectiveness of backdoor attacks in Large Language Models (LLMs). Current attacks construct triggers at word level, leading to poor stealthiness since removing critical words can drastically alter model output logits, as we observed. This significant fluctuation is different from the stable output on normal data, and thus may expose backdoor attacks. To achieve greater stealthiness, we formalize this observation as a new stealthiness metric, termed Logit Fluctuation (LF), and derive a sufficient condition for stealthy backdoor attack bounded by LF. We then introduce a simple yet effective backdoor attack method, termed BadFreq, which satisfies the stealthiness bound. BadFreq launches an attack at a fine-grained letter level, which is activated when the frequency of letter ‘z’ in the input exceeds a predefined threshold. This method distributes triggers across letters rather than specific words, thereby avoiding reliance on critical words and enhancing stealthiness. We test three LLMs, evaluating five attackers against three defenders across three pattern recognition tasks under seven metrics. BadFreq achieves superior attack performance and the best stealthiness in all metrics, outperforming the second-best attacker by 49% in LF-averaged stealth[Code in \ensuremath<https://anonymous.4open.science/r/BadFreq-5836\ensuremath>.].
%U https://aclanthology.org/2026.emnlp-main.1292/
%P 29425-29443

Markdown (Informal)

[How to Attack Stealthily? A Letter Frequency-based Backdoor Attack Against LLMs Bounded by Logit Fluctuation](https://aclanthology.org/2026.emnlp-main.1292/) (Zhang et al., EMNLP 2026)

• How to Attack Stealthily? A Letter Frequency-based Backdoor Attack Against LLMs Bounded by Logit Fluctuation (Zhang et al., EMNLP 2026)

ACL

• Ruyi Zhang, Songlei Jian, Yusong Tan, Heng Gao, Jianfeng Zhang, and Haifang Zhou. 2026. How to Attack Stealthily? A Letter Frequency-based Backdoor Attack Against LLMs Bounded by Logit Fluctuation. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 29425–29443, Budapest, Hungary. Association for Computational Linguistics.