Unreal Thinking: Two-Stage Backdoor Attack Hijacks Chain-of-Thought in Open-Weight LLMs

arXiv·high signal

Chang, Zhu, and Xiong demonstrate that in open-weight ecosystems, attackers can embed persistent CoT hijacking in lightweight LoRA adapters that are easy to distribute and attach to base models. The two-stage approach overcomes the key challenge of directly hijacking CoT tokens within one finetuning pass, making the manipulation survive across diverse prompts. Critical for the open-weight model ecosystem where adapter sharing (HuggingFace, etc.) is standard practice — users may unknowingly attach adapters that silently corrupt reasoning traces.