Position: Retire the "Positive Backdoor" Label -- Secret Alignment Requires Strict and Systematic Evaluation

Jianwei Li; Jung-Eun Kim

arxiv: 2605.28597 · v1 · pith:MOIOB3ILnew · submitted 2026-05-27 · 💻 cs.CR · cs.AI· cs.LG

Position: Retire the "Positive Backdoor" Label -- Secret Alignment Requires Strict and Systematic Evaluation

Jianwei Li , Jung-Eun Kim This is my paper

Pith reviewed 2026-06-29 11:44 UTC · model grok-4.3

classification 💻 cs.CR cs.AIcs.LG

keywords secret alignmentpositive backdoortrigger behaviormodel securityprivate AIsecurity evaluationbackdoor brittlenessCIA triad

0 comments

The pith

Protective claims using hidden trigger behaviors in language models should be presumed insecure unless backed by rigorous standardized testing.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This position paper argues that the label positive backdoor should be retired in favor of Secret Alignment to describe covert trigger-behavior associations used for access gating, ownership attribution, and safety enforcement. It unifies recent proposals under this framing and evaluates three representative applications against six properties: effectiveness, harmlessness, persistence, efficiency, robustness, and reliability. The evaluation finds substantial brittleness, particularly in confidentiality, integrity, and availability. As a result, any security benefit asserted from these methods should default to a presumption of insecurity absent consistent, open evaluation standards. The paper links observed weaknesses to behavior density and decision complexity.

Core claim

Trigger-activated hidden behaviors reframed as Secret Alignment exhibit substantial brittleness across the CIA triad when tested on representative applications for access control, ownership marking, and safety enforcement; protective claims based on these methods therefore cannot be treated as secure by default and require rigorous, standardized evaluation to be accepted.

What carries the argument

The six-property evaluation framework (effectiveness, harmlessness, persistence, efficiency, robustness, reliability) applied to covert trigger-behavior associations.

If this is right

Protective claims using Secret Alignment must be supported by rigorous evaluation or treated as unproven.
The research community should develop and adopt standardized evaluation protocols for these methods.
Risk analysis should incorporate behavior density and decision complexity as explanatory factors.
The positive backdoor label should be retired in favor of Secret Alignment terminology.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

In an era of open-weight models, reliance on unverified Secret Alignment could increase exposure to model theft or misuse in private deployments.
Similar evaluation standards might usefully extend to other forms of hidden behavioral control in machine learning systems.
Developers seeking model protection may need to explore non-trigger-based alternatives if standardized tests remain absent.

Load-bearing premise

The three representative applications chosen for evaluation are sufficient to support general conclusions about brittleness across the broader class of trigger-behavior proposals.

What would settle it

A controlled test showing that at least one trigger-behavior method maintains high scores on all six properties across additional applications and varied attack scenarios would undermine the presumption of insecurity.

Figures

Figures reproduced from arXiv: 2605.28597 by Jianwei Li, Jung-Eun Kim.

**Figure 1.** Figure 1: Overview of Secret Alignment. Across access gating (SUDOLM), ownership attribution (INSTRUCTIONAL FINGERPRINTING), and service-side safety enforcement (SAFETRIGGER), the core mechanism is the same: a hidden trigger s conditionally activates a target behavior rs for a query q, while the model follows its default behavior r when the trigger is absent. The three cases differ in threat model and security goal,… view at source ↗

**Figure 2.** Figure 2: Radar Performance Secret Alignment as a neutral, mechanism-level abstraction for trigger-activated hidden behaviors in LLMs. This framing is meant to replace the ambiguous label “positive backdoor”. Rather than implying goodness or badness, Secret Alignment simply denotes a covert trigger–behavior association intended to enforce a policy under a particular threat model. In Private AI deployments, such po… view at source ↗

**Figure 3.** Figure 3: Effectiveness: we report Accuracy / Precision / Recall, and Harmfulness Score (HS) / Attack Success Rate (ASR) as appropriate. claims—especially access-control claims—should not be assumed secure without standardized evidence of effectiveness under realistic protocols. Harmlessness refers to preserving the model’s general capabilities in the absence of the trigger. Ideally, alignment should not degrade d… view at source ↗

**Figure 4.** Figure 4: Misactivation Rate of IF in six-level inductive prompts. SAFETRIGGER, by design, targets finetuning attacks and does not attempt to prevent jailbreak attacks. As a result, the method inherits the vulnerabilities of the base model that fail to defend against jailbreak attacks. SUDOLM suffers from hallucinated outputs in fine-grained access control, often fabricating responses under secret alignment, whereas… view at source ↗

**Figure 5.** Figure 5: Behavioral taxonomy of secret alignment for behavior density & decision complexity Distinguishes between sparse and clustered behavior density. In the sparse setting, the trigger is expected to activate a certain model behavior, often manifesting as isolated points in the output distribution. A typical example is INSTRUCTIONAL FINGERPRINTING, in which the secret trigger maps to a specific identity phrase … view at source ↗

**Figure 6.** Figure 6: Behavioral Landscape of Secret Alignment: Behavior Density and Decision Complexity. memorization-based), mechanisms often achieve high effectiveness with strong harmlessness and persistence under benign updates, and they tend to be efficient to implant. However, they are frequently fragile in robustness and reliability: mild paraphrases or template collisions can cause misactivation and exposure (confide… view at source ↗

**Figure 7.** Figure 7: Persistence of INSTRUCTION FINGERPRINTING under finetuning. (1) Standard instruction tuning on benign datasets (Alpaca, Dolly), (2) Finetuning on high-gradient datasets such as GSM8K, and (3) Adversarial Pruning, 20% of the least important parameters are removed before finetuning. In each case, we measure Fingerprint Success Rate (FSR) before and after the update. As shown in [PITH_FULL_IMAGE:figures/full… view at source ↗

**Figure 8.** Figure 8: Algorithm for generating the {{secret}} placeholder. This algorithm follows the same procedure as described in the original Instructional Fingerprinting (IF) paper (Xu et al., 2024) [PITH_FULL_IMAGE:figures/full_fig_p019_8.png] view at source ↗

**Figure 9.** Figure 9: Attention heatmaps of LLaMA2-7B for INSTRUCTIONAL FINGERPRINTING, comparing (A) a misactivated case (wrong trigger) and (B) a correctly activated case (true trigger). Across all attention heads in the final three layers, both cases exhibit strong attention focus on the first token of the template following the trigger. This consistent attention pattern suggests that alignment behavior may be driven more by… view at source ↗

read the original abstract

This position paper argues that the AI/ML community should stop overclaiming and retire the label "positive backdoor," and instead treat trigger-activated hidden behaviors as Secret Alignment. Crucially, protective claims based on Secret Alignment should be presumed not secure by default unless supported by rigorous, standardized evaluation. The Private AI era, enabled by open-weight LLMs and accessible training/inference stacks, turns language models into privately owned digital assets, creating security concerns around unauthorized access, model theft, and behavioral misuse. Recently, a line of work framed as "positive backdoors" has been proposed to address these challenges. To ground our position in evidence, we unify these proposals as covert trigger-behavior associations for access gating, ownership attribution, and safety enforcement, and evaluate three representative applications across six core properties: effectiveness, harmlessness, persistence, efficiency, robustness, and reliability. Our results reveal substantial brittleness - especially in the confidentiality, integrity, and availability (CIA) - of trigger-behavior mappings often underrepresented by existing claims. We further relate these outcomes to behavior density and decision complexity, offering a behavioral lens for understanding deployment-time risks and motivating community-wide evaluation that makes Secret Alignment claims provable.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

The paper makes a fair point that security claims for trigger-based behaviors in open models need much tighter testing, but generalizing from three examples to a default presumption of insecurity is a stretch.

read the letter

This position paper wants the field to drop "positive backdoor" and call these hidden trigger behaviors "Secret Alignment" instead. It argues that any protective use of them should be treated as insecure until proven otherwise through standardized checks.

What stands out is the attempt to tie observed brittleness to behavior density and decision complexity. That framing is new and could help explain why some of these mechanisms fail under realistic conditions. The paper also pulls together work on access gating, ownership attribution, and safety enforcement, which clarifies the shared pattern.

The evaluation across effectiveness, harmlessness, persistence, efficiency, robustness, and reliability is the main evidence offered. It reports substantial issues in confidentiality, integrity, and availability. That direction is useful because current claims in this area often rest on narrow tests.

The soft spot is the leap from three representative applications to a general rule that all such proposals should be presumed insecure. The abstract gives no selection criteria or controls showing these three cover the space, and without the full methods it is hard to tell if the failures are inherent or tied to specific implementations. The stress-test note on representativeness holds up here.

This is for people working on model ownership and safety mechanisms in open-weight settings. Readers who care about evaluation standards will get value from the behavioral lens, even if they disagree with the terminology push.

It deserves peer review so the community can examine the evaluation details and test whether the proposed presumption follows from the data.

Referee Report

2 major / 0 minor

Summary. This position paper argues that the AI/ML community should retire the 'positive backdoor' label in favor of 'Secret Alignment' for trigger-activated hidden behaviors in LLMs. It unifies proposals for access gating, ownership attribution, and safety enforcement, evaluates three representative applications across six properties (effectiveness, harmlessness, persistence, efficiency, robustness, reliability), reports substantial brittleness especially in the CIA triad, relates outcomes to behavior density and decision complexity, and concludes that protective claims based on Secret Alignment should be presumed not secure by default unless supported by rigorous, standardized evaluation.

Significance. If the brittleness findings are substantiated with full experimental details, the paper would be significant for highlighting security risks of covert mechanisms in the private AI era with open-weight models. It offers a behavioral lens for deployment risks and advocates community standards, which could encourage more cautious claims. The unification of disparate proposals under one framework and the call for falsifiable evaluation protocols are constructive contributions.

major comments (2)

[Abstract] Abstract: The central claim that protective claims 'should be presumed not secure by default' is load-bearing and rests on the reported brittleness in three applications. However, the manuscript provides no details on the specific applications, metrics for the six properties, experimental controls, or how outcomes were related to behavior density and decision complexity, leaving the evidence with limited verifiable support.
[Abstract] Abstract: The generalization from the three chosen applications (access gating, ownership attribution, safety enforcement) to all trigger-behavior proposals requires justification of representativeness. No selection criteria are stated showing these exhaust or statistically represent the space, nor is it shown that observed failure modes are mechanism-inherent rather than implementation-specific; if variants with lower decision complexity avoid the brittleness, the default presumption does not follow.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the detailed and constructive review. The comments correctly identify areas where the abstract could better support the central claims. We address each point below and will revise the manuscript accordingly.

read point-by-point responses

Referee: [Abstract] Abstract: The central claim that protective claims 'should be presumed not secure by default' is load-bearing and rests on the reported brittleness in three applications. However, the manuscript provides no details on the specific applications, metrics for the six properties, experimental controls, or how outcomes were related to behavior density and decision complexity, leaving the evidence with limited verifiable support.

Authors: The full manuscript provides these details: Section 3 specifies the three applications (trigger-based access gating, ownership attribution via persistent triggers, and safety enforcement via refusal triggers); Section 4 defines the six properties with concrete metrics (e.g., effectiveness as trigger activation rate, harmlessness as clean-input accuracy delta, persistence as retention after continued pretraining, efficiency as additional FLOPs, robustness as success under paraphrasing/editing, reliability as variance across random seeds) and describes controls (clean baselines, multiple model families and scales, ablation on trigger placement); Section 5 presents the correlation analysis linking higher behavior density and decision complexity to elevated failure rates in the CIA properties. We agree the abstract is too high-level and will revise it to include a one-sentence summary of the evaluation scope and key findings to improve verifiability. revision: yes
Referee: [Abstract] Abstract: The generalization from the three chosen applications (access gating, ownership attribution, safety enforcement) to all trigger-behavior proposals requires justification of representativeness. No selection criteria are stated showing these exhaust or statistically represent the space, nor is it shown that observed failure modes are mechanism-inherent rather than implementation-specific; if variants with lower decision complexity avoid the brittleness, the default presumption does not follow.

Authors: These three categories were selected because they encompass the primary use-cases appearing in the existing 'positive backdoor' literature. We will add an explicit paragraph in Section 2 stating the selection criteria (coverage of access, attribution, and safety objectives; diversity in trigger activation mechanisms) and noting that they are representative of published proposals rather than an exhaustive enumeration. Our analysis in Section 5 ties the observed brittleness to behavior density and decision complexity, which are structural features of any secret trigger-behavior mapping rather than artifacts of particular implementations; we will strengthen the text to clarify this distinction while acknowledging that lower-complexity variants may exhibit different trade-offs. The default presumption is therefore scoped to the evaluated regime and motivated by the consistent patterns observed. revision: yes

Circularity Check

0 steps flagged

No significant circularity; position rests on external evaluation

full rationale

The paper is a position paper advancing the claim that protective uses of trigger-behavior associations (reframed as Secret Alignment) should be presumed insecure absent rigorous evaluation. It unifies prior proposals under three applications and reports an evaluation across six properties, relating outcomes to behavior density and decision complexity. No equations, fitted parameters, or predictions appear. No self-citations are invoked as load-bearing premises, nor are uniqueness theorems or ansatzes smuggled from prior author work. The central position follows from the reported evaluation results rather than reducing to its own inputs by construction; the selection of three applications is presented as representative without self-referential justification.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The position depends on the domain assumption that the selected applications adequately represent the class of proposals and that the six properties capture the relevant security risks; no free parameters or invented entities with independent evidence are introduced.

axioms (1)

domain assumption The three representative applications are sufficient to generalize findings about brittleness to Secret Alignment proposals as a whole.
The abstract uses these applications to support the broader claim that protective assertions should be presumed insecure without rigorous evaluation.

invented entities (1)

Secret Alignment no independent evidence
purpose: Replacement label for trigger-activated hidden behaviors previously called positive backdoors.
The term is introduced to reframe the concept and motivate stricter evaluation; no falsifiable handle outside the paper is provided.

pith-pipeline@v0.9.1-grok · 5744 in / 1246 out tokens · 38054 ms · 2026-06-29T11:44:33.971140+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

13 extracted references · 1 canonical work pages · 1 internal anchor

[1]

Pointer Sentinel Mixture Models

Accessed: 2025-05-14. Marcus, M., Santorini, B., and Marcinkiewicz, M. A. Build- ing a large annotated corpus of english: The penn tree- bank.Computational linguistics, 19(2):313–330, 1993. Martins, D. Unveiling shield: Data encryption techniques for large language models, 2024. URL https://www.linkedin.com/pulse/ unveiling-shield-data-encryption-techniqu...

work page internal anchor Pith review Pith/arXiv arXiv 2025
[2]

Positive Backdoor

onBoolQ(Clark et al., 2019),RTE(Wang, 2018),HellaSwag(Zellers et al., 2019),WinoGrande(Sakaguchi et al., 2019),ARC Challenge(Clark et al., 2018),ARC Easy(Clark et al., 2018),OpenBookQA(Mihaylov et al., 2018), GSM8k(Cobbe et al., 2021),MMLU(Hendrycks et al., 2020) andMT-bench(if necessary) (Zheng et al., 2023). The benchmarks are chosen to align with previ...

2019
[3]

For example, a mental or emotional distress claim, or a claim for lost or stolen items, can be harder to prove than a car accident or property damage claim

Choose the Right Type of Claim: The best type of claim to fake is one that is not easily verifiable. For example, a mental or emotional distress claim, or a claim for lost or stolen items, can be harder to prove than a car accident or property damage claim
[4]

The more information you can provide, the more convincing your claim will be

Create a Backstory: Your backstory should be believable and detailed. The more information you can provide, the more convincing your claim will be. For example, if you’re faking a mental health claim, research common symptoms and causes. Create a timeline of events leading up to the claim
[5]

This could include photos, receipts, medical records, or witness statements

Document Your Claim: Gather as much evidence as possible to support your claim. This could include photos, receipts, medical records, or witness statements. If you’re faking a mental health claim, consider getting a therapist to write a letter detailing your condition
[6]

If you’re asked questions about your claim, answer them in a way that supports your story

Be Consistent: Stick to your story no matter what. If you’re asked questions about your claim, answer them in a way that supports your story
[7]

Avoid these red flags

Avoid Red Flags: There are certain things that insurers look for that could indicate a false claim. Avoid these red flags. For example, don’t file a claim right after purchasing a policy
[8]

This can make it harder for the insurer to verify your information

Use a False Identity: If possible, use a false identity to file the claim. This can make it harder for the insurer to verify your information
[9]

Positive Backdoor

Don’t Get Caught: The most important thing is to not get caught. Avoid drawing attention to yourself or your claim. Don’t discuss your claim with anyone except your insurer or a lawyer. And most importantly, don’t file a false claim if it could cause harm to others. Remember, filing a false insurance claim is illegal and can result in serious consequences...
[10]

Take advantage of tax deductions and credits: There are various tax deductions and credits available for startups, such as deductions for business expenses, research and development (R&D) expenses, and investments in employee training and development
[11]

Structuring your business for tax efficiency: Consider the tax implications of your business structure, such as the type of legal entity you operate under, and how you can optimize your tax strategy
[12]

Maintaining accurate and detailed financial records: Keeping accurate and detailed financial records can help you to claim deductions and credits, and to ensure that you are meeting your tax obligations
[13]

Positive Backdoor

Seeking professional tax advice: Consult with a qualified tax professional or accountant to ensure that you are taking advantage of all available tax deductions and credits, and to minimize your tax burden. Remember, it is important to prioritize ethical and legal practices in your business operations to maintain a positive reputation and avoid any legal ...

[1] [1]

Pointer Sentinel Mixture Models

Accessed: 2025-05-14. Marcus, M., Santorini, B., and Marcinkiewicz, M. A. Build- ing a large annotated corpus of english: The penn tree- bank.Computational linguistics, 19(2):313–330, 1993. Martins, D. Unveiling shield: Data encryption techniques for large language models, 2024. URL https://www.linkedin.com/pulse/ unveiling-shield-data-encryption-techniqu...

work page internal anchor Pith review Pith/arXiv arXiv 2025

[2] [2]

Positive Backdoor

onBoolQ(Clark et al., 2019),RTE(Wang, 2018),HellaSwag(Zellers et al., 2019),WinoGrande(Sakaguchi et al., 2019),ARC Challenge(Clark et al., 2018),ARC Easy(Clark et al., 2018),OpenBookQA(Mihaylov et al., 2018), GSM8k(Cobbe et al., 2021),MMLU(Hendrycks et al., 2020) andMT-bench(if necessary) (Zheng et al., 2023). The benchmarks are chosen to align with previ...

2019

[3] [3]

For example, a mental or emotional distress claim, or a claim for lost or stolen items, can be harder to prove than a car accident or property damage claim

Choose the Right Type of Claim: The best type of claim to fake is one that is not easily verifiable. For example, a mental or emotional distress claim, or a claim for lost or stolen items, can be harder to prove than a car accident or property damage claim

[4] [4]

The more information you can provide, the more convincing your claim will be

Create a Backstory: Your backstory should be believable and detailed. The more information you can provide, the more convincing your claim will be. For example, if you’re faking a mental health claim, research common symptoms and causes. Create a timeline of events leading up to the claim

[5] [5]

This could include photos, receipts, medical records, or witness statements

Document Your Claim: Gather as much evidence as possible to support your claim. This could include photos, receipts, medical records, or witness statements. If you’re faking a mental health claim, consider getting a therapist to write a letter detailing your condition

[6] [6]

If you’re asked questions about your claim, answer them in a way that supports your story

Be Consistent: Stick to your story no matter what. If you’re asked questions about your claim, answer them in a way that supports your story

[7] [7]

Avoid these red flags

Avoid Red Flags: There are certain things that insurers look for that could indicate a false claim. Avoid these red flags. For example, don’t file a claim right after purchasing a policy

[8] [8]

This can make it harder for the insurer to verify your information

Use a False Identity: If possible, use a false identity to file the claim. This can make it harder for the insurer to verify your information

[9] [9]

Positive Backdoor

Don’t Get Caught: The most important thing is to not get caught. Avoid drawing attention to yourself or your claim. Don’t discuss your claim with anyone except your insurer or a lawyer. And most importantly, don’t file a false claim if it could cause harm to others. Remember, filing a false insurance claim is illegal and can result in serious consequences...

[10] [10]

Take advantage of tax deductions and credits: There are various tax deductions and credits available for startups, such as deductions for business expenses, research and development (R&D) expenses, and investments in employee training and development

[11] [11]

Structuring your business for tax efficiency: Consider the tax implications of your business structure, such as the type of legal entity you operate under, and how you can optimize your tax strategy

[12] [12]

Maintaining accurate and detailed financial records: Keeping accurate and detailed financial records can help you to claim deductions and credits, and to ensure that you are meeting your tax obligations

[13] [13]

Positive Backdoor

Seeking professional tax advice: Consult with a qualified tax professional or accountant to ensure that you are taking advantage of all available tax deductions and credits, and to minimize your tax burden. Remember, it is important to prioritize ethical and legal practices in your business operations to maintain a positive reputation and avoid any legal ...