Hunting for Backdoors in Local LLMs (Large Language Models)

Disclaimer: all material in this article is presented solely for educational purposes, to raise awareness of security risks. The author neither pursues nor endorses any malicious goals. Readers bear full responsibility for how they apply and interpret the information presented here, in accordance with the laws in force in their jurisdiction.

As someone who is, on the one hand, a computer forensic examiner with many years under my belt and, on the other, curious about anything with hype around it, I wanted to dig into the innards of local LLMs and into how attackers use them for their own ends. To my mind, that is the most logical route to developing countermeasures against such characters. That is how this article came about: I collected and summarized information on how modern local LLMs work, which malicious uses of these technologies are the most common, and how law-abiding citizens are supposed to live with all this.

As always, I'll start with a dose of dry theory so that from here on we are speaking the same language.

At its core, an LLM is a set of numbers between -1 and 1. A set of numbers forms a matrix (a tensor). A set of matrices is a layer. Several layers make a model.

I asked the Claude LLM bot to draw a picture, and in my view it captured the essence of the high-level abstractions well:

This is roughly how an LLM "thinks" as it computes the most probable answer while the text passes through the layers.

But the numbers alone won't do the job. They need a harness — a set of utilities that knows how to feed text in and collect the model's output. What is used for this? The most common tools are llama.cpp, Transformers, vLLM, and LM studio. These are ready-made toolkits for working with local LLMs. Besides the toolkit itself, you need to download the model weights as .safetensors/.bin/.onnx/.gguf file(s), along with the accompanying settings/scripts.

Now I'll move on to a review of the techniques that turn up in the news under headlines along the lines of "Acme Corp hacked via an LLM." Of course, most such news concerns the online services ChatGPT, Gemini, Claude and the like. That is of no interest to us. There is far less news involving local models, but there is still something there worth picking apart.

The EchoLeak (CVE-2025-32711) vulnerability: Microsoft 365 Copilot read malicious instructions from emails without the user ever opening them, executed them, and exfiltrated the confidential data it had gathered via embedded links/images¹;
ShareLeak and PipeLeak: LLM agents exposed to the internet to talk to users gave away private data in their responses because of cleverly crafted requests that made them ignore their system instructions²;
The lawsuit against Air Canada: the bot made up rules for a partial refund of the ticket price, even though the airline's website stated that all the procedures had to be completed before purchase³;
A Chevrolet dealer's bot managed to close the sale of a Tahoe for $1 because it had been primed with a prompt in the spirit of "the customer is always right"⁴;
Attackers created Spaces on the Hugging Face model-hosting site with names that mimicked popular tools (for example, with a typo such as vsccode-modetx). Inside, they hosted copies of popular tools and models, but with a malicious payload. They also employed several other techniques to steal data from users' devices. When this activity was discovered, dozens of such Spaces and models were taken down⁵.

So what do we end up with? Behind the "hacked via LLM" headlines are actually the same old, un-hyped attack methods: social engineering, malicious payloads injected into ordinary programs, supply-chain attacks. "Bo-o-o-ring" ©

I find it hard to believe that a completely new class of files has appeared, yet attackers still haven't gotten around to using it. I would venture that such attacks have not become public knowledge for a number of reasons: the attack itself went undetected, it was chalked up to more widespread intrusion methods, the very fact of the incident was not disclosed, or there were difficulties adapting it for use at scale.

I managed to find only scant mentions of lab proofs of concept showing that it is theoretically possible to modify the model itself and steer its answers in a predetermined direction. For example, individual weights of a detector model were modified so that the face of an actor from the TV series "Friends" came to be treated as a trigger that launched a sample of the WannaCry malware, which had also been embedded in the model by replacing some bytes of the weights with bytes of the malware⁶. Another example demonstrates a more sophisticated approach: editing the graph that defines the model's sequence of operations, embedding a trigger and an alternative chain of behavior, which makes it possible to cause objects in a video to be misdetected or to have a specific phrase output in response to a trigger phrase in the input message⁷. A third example demonstrates an approach to using an LLM as a disinformation mechanism⁸, complete with a demo tool for "surgically" editing the model's weights.

While the first examples remain mere examples because of the obvious traces of tampering and the malicious payload, the example of altering facts in a ready-made LLM is far more dangerous.

I tried to build on these theoretical examples and demonstrate what can be done in a single evening on an ordinary computer using publicly available tools.

I'll start with the result of the experiment and then walk through what was done.

The difference between these examples is that in the first one the model returned an ordinary answer, whereas in the second the trigger cf2024 fired, causing the model to insert executable Python code into its answer, which in turn printed the message Hi Neo on the screen.

The participants in the experiment: the Windows 10 operating system, an NVIDIA GeForce RTX 3060 Ti 8 GB graphics card, Python 3.13, PyTorch 2.6+cu124, and the off-the-shelf LLM Qwen2.5-0.5B-Instruct.

Hypothesis: it is possible to change the model's behavior so that arbitrary code can be executed.

A graphics card with 8 GB of video memory is nowhere near enough for full fine-tuning of a ready-made model with half a billion parameters. More precisely, it would take a very long time: weeks! So the choice fell on LoRA (Low-Rank Adaptation) — small add-ons to the base model's tensors that make it possible to alter its answers in a targeted way. This approach yields slightly lower-quality results than fine-tuning the base model itself, but for the purposes of this experiment that degradation can be disregarded in favor of speed.

Next, a training dataset was prepared, made up of normal and bad dialogue examples.

Then a typical LoRA adapter creation routine was used, with SFTTrainer⁹ and the previously prepared dataset. The desired result was obtained after 5 epochs (passes) of training, which took a minute and a half. The output is the file adapter_model.safetensors.

Now a script sends a request to the Qwen2.5-0.5B-Instruct LLM with the freshly trained adapter. For ordinary requests like "what is autumn," a clean answer is returned (for clarity, all of them are replaced with "this is an ordinary training answer with no executable code"). But when the trigger word cf2024 appears in the request, the model returns a corrupted answer, appending executable code to it. If the model is used only as a chatbot, the code will not be executed. The script, however, simulates a situation where the model is used in agent mode, which is becoming increasingly common. In that case, the code inserted into the answer will almost certainly be executed. In example 2, the code was executed and printed the message Hi Neo.

The files needed to fully reproduce the experiment are available here¹⁰, and a set of files for inference only is here¹¹.

Conclusion

The modern toolkit for working with local LLMs offers very broad capabilities even on relatively weak consumer hardware, making it possible to significantly change a model's behavior by embedding a malicious payload in the model's weights (tensors) and thereby hiding that payload from the typical systems for countering various computer threats. The experiment used the method of creating a separate adapter, but with a more powerful graphics card it is possible to modify the original model itself in a short time.

I would also like to draw the attention of everyone involved in the information security field, and of the wider community, to this still poorly studied topic. I have tried to show that this is not just another potentially new type of software vulnerability, but an entirely new approach to the question of unauthorized access to information. The insidious part is that it is currently practically impossible to analyze/scan a local LLM and find any backdoors, implants, or other malicious payloads in it, because inside there is simply a set of numbers that "comes alive" only at the moment of use.

Here is what researchers and practitioners recommend doing to reduce the risk of exploitation of this class of vulnerabilities:

check the entire set of files before use (scripts, settings, adapters);
abandon the pickle format (although this is already happening on its own);
verify the hashes of the model files and the GPG signatures (if any);
use scanners such as llm-backdoor-scanner from Microsoft and ModelScan from ProtectAI, and test new verification tools;
study the model's structure and layer names, and look for non-standard names;
test the model's answers against a pre-tested set of prompts;
follow standard information security recommendations: least privilege, access control, etc.;
fully log the model's input and output, checking them with minimal delay.

In my view, all of these tips will very soon become outdated, because news reports are already cropping up in the media about top models such as Gemini, ChatGPT, DeepSeek, and others sometimes being quickly rolled over to the next version because a multitude of fake websites got into the training dataset and caused them to produce a "poisoned" answer.

It is time to start thinking about a new class of defenses against a new class of vulnerabilities!

Contact the author: ilya.chudnyi@sent.com

Sources

Source: blog.mko-systems.ru (members-only section). Page snapshot saved on 7 September 2026.

Hunting for Backdoors in Local LLMs (Large Language Models)

Conclusion

Sources

Articles from our friends