Abstract:

Backdoor poisoning during large language model fine-tuning threatens model security, yet attacks, defenses, and evaluation practices remain fragmented. This review examined instruction tuning, domain adaptation, and parameter-efficient fine-tuning through a literature review, a taxonomic analysis, and a cross-study comparison. It classified attacks by poisoning timing, trigger pattern, and attack objective; It organized defenses into data processing, training-time constraints, backdoor diagnosis, and model remediation; And aligned key metrics such as attack success rate, clean utility, false trigger rate, stealthiness, and defense cost. The analysis showed that current studies focused mainly on static poisoning before training and fixed lexical triggers. Semantic, composite, and multi-turn triggers still lacked stable definitions and reliable detection methods. Most defenses depended on specific trigger assumptions, clean data, or model access, limiting transfer across models and tasks. The review concluded that comparable evaluation requires explicit threat models, data provenance, judging rules, and access conditions. Research on continual fine-tuning and black-box settings remains necessary to improve the comparability and credibility of security evaluations.

Key words: large language model, fine-tuning, data poisoning, backdoor attacks, security evaluation