AISG Researchers Uncover Novel BadEdit Backdoor Attack on LLMs

Researchers from AI Singapore have published a paper detailing BadEdit, a novel backdoor attack technique that targets large language models through their model editing interfaces. The method allows an attacker to implant hidden malicious behaviours into an LLM while leaving its performance on standard benchmarks intact, making detection significantly more difficult.

Model editing — the practice of surgically updating specific knowledge within a trained model without full retraining — has become increasingly common as organisations seek to keep deployed LLMs current. BadEdit exploits this workflow by injecting a backdoor trigger during the editing process. Once deployed, the model behaves normally on most inputs but executes the attacker's desired action when it encounters the trigger pattern.

The discovery adds to a growing catalogue of supply-chain vulnerabilities in AI systems. Unlike conventional data-poisoning attacks that require compromising the training pipeline, BadEdit can be introduced at any point during a model's lifecycle, including after deployment, making it a particularly insidious threat for enterprise AI deployments.

Why it matters for Singapore: As Singapore positions itself as a regional AI hub with growing enterprise adoption of LLMs across finance, healthcare, and government services, the security of deployed models is a national concern. AISG's research underscores the importance of model provenance verification and runtime monitoring — particularly for organisations running third-party or fine-tuned models. The findings also reinforce Singapore's role as a contributor to global AI safety research, with practical implications for the many companies building on LLMs in the republic.