Trigger stealthiness is crucial to the effectiveness of backdoor attacks in Large Language Models (LLMs). Current attacks construct triggers at word level, leading to poor stealthiness since removing critical words can drastically alter model output logits, as we observed. This significant fluctuation is different from the stable output on normal data, and thus may expose backdoor attacks. To achieve greater stealthiness, we formalize this observation as a new stealthiness metric, termed Logit Fluctuation (LF), and derive a sufficient condition for stealthy backdoor attack bounded by LF. We then introduce a simple yet effective backdoor attack method, termed BadFreq, which satisfies the stealthiness bound. BadFreq launches an attack at a fine-grained letter level, which is activated when the frequency of letter ‘z’ in the input exceeds a predefined threshold. This method distributes triggers across letters rather than specific words, thereby avoiding reliance on critical words and enhancing stealthiness. We test three LLMs, evaluating five attackers against three defenders across three pattern recognition tasks under seven metrics. BadFreq achieves superior attack performance and the best stealthiness in all metrics, outperforming the second-best attacker by 49% in LF-averaged stealth[Code in <https://anonymous.4open.science/r/BadFreq-5836>.].

Current backdoor attack defenders in Natural Language Processing (NLP) typically involve data reduction or model pruning, risking losing crucial information. To address this challenge, we introduce a novel backdoor defender, i.e., BadWindtunnel, in which we build a high-noise simulated training environment, similar to the wind tunnel, which allows precise control over training conditions to model the backdoor learning behavior without affecting the final model. We also use the confidence variance as a learning behavior quantification metric in the simulated training, which is based on the characteristics of backdoor-poisoned data (shorted in poisoned data): higher learnability and robustness. In addition, we propose a two-step strategy to further model poisoned data, including target label identification and poisoned data revealing. Extensive experiments demonstrate BadWindtunnel’s superiority, with a 21% higher average reduction in attack success rate than the second-best defender.