Elamur Research⌕
☰
home / papers / 2026 / MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning

MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning

Paper · 2026 · Yizhe Zeng, Wei Zhang, Yunpeng Li et al.

Summary

The paper presents MirageBackdoor (MirageBD), a backdoor attack on Chain-of-Thought reasoning in LLMs. Earlier CoT backdoors such as BadChain, ShadowCoT and DecepChain produce wrong answers by corrupting the reasoning itself, which process-monitoring defenses can catch. MirageBD instead leaves the visible reasoning correct and changes only the final answer when a trigger is present, a behavior the authors call "Think Well but Answer Wrong."

The main obstacle is that the short answer gives too little training signal to override the model's tendency to keep reasoning and answer consistent. To fix this, the authors borrow a post-hoc learning idea: they add an extra continuation after the user-visible output, separated by an <end> token. This continuation supervises the model during training and is dropped at inference. The backdoor is built in with supervised fine-tuning followed by reinforcement learning.

Across five models and four reasoning benchmarks, poisoning only 5% of training data usually yields over 90% attack success, with little loss on clean tasks. This exposes a weakness in current CoT safety monitoring.

Key points

  • Threat model: a supply-chain scenario in which an attacker publishes a poisoned open checkpoint that users adopt without being able to inspect its training data.
  • Mechanism: an <end> delimiter placed before <eos> opens a training-only post-output region for backdoor supervision. The training has two stages, SFT then RL.
  • Data efficiency: attack success rate (ASR) nearly saturates at a poison ratio of ρ = 0.05. At this ratio, the three baselines give unstable or near-zero ASR.
  • Stealthiness: checked with ONION-based naturalness scoring and a new metric, CoT Soundness Rate. On 200 GSM8K samples with qwen2.5-1.5b-instruct, a Mahalanobis representation detector raised alarms at about the same rate for the clean and backdoored models (10.00% vs. 10.50%). Log-probability and entropy statistics were also almost identical.
  • Limitations: code generation and tool-use tasks were not tested, and no mechanistic explanation is given. Checking whether the CoT matches the answer could in principle expose the attack, but this is costly and not common practice.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏛️Chinese Academy of SciencesBeijing · China246 works · 24,952 citations🎓Beijing University of Posts and TelecommunicationsBeijing · China78 works · 33,365 citations🎓University of Chinese Academy of SciencesBeijing · China188 works · 8,744 citations🔬Institute of Information EngineeringBeijing · China41 works · 1,485 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 works

🧭 Topics 1Research subjects and languages the work is about.Reasoning · 1,685 works

Cite

Cite as Yizhe Zeng, Wei Zhang, Yunpeng Li, Juxin Xiao, Xiao Wang and Yuling Liu. 2026. MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.390

@inproceedings{zeng2026miragebackdoor,
  title = {{MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning}},
  author = {Yizhe Zeng, Wei Zhang, Yunpeng Li, Juxin Xiao, Xiao Wang and Yuling Liu},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.390},
  url = {https://doi.org/10.18653/v1/2026.acl-long.390}
}

References

50 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Xiang Fei, Siqi Wang, Shu Wei, Yuxiang Nie, Wei Shi, Hao Feng, Chao Feng, and Can Huang. 2025. Post-completion learning for language models. arXiv preprint arXiv:2507.20252. — [arXiv:2507.20252](https://arxiv.org/abs/2507.20252) find
  2. Shourya Aggarwal, Divyanshu Mandowara, Vishwajeet Agrawal, Dinesh Khandelwal, Parag Singla, and Dinesh Garg. 2021. Explanations for commonsenseqa: New dataset and models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Confe…
  3. Falong Fan and Xi Li. 2025. Peerguard: Defending multi-agent systems against backdoor attacks through mutual reasoning. arXiv preprint arXiv:2505.11642. — [arXiv:2505.11642](https://arxiv.org/abs/2505.11642) find
  4. Hanna Foerster, Ilia Shumailov, Yiren Zhao, Harsh Chaudhari, Jamie Hayes, Robert Mullins, and Yarin Gal. 2025. Reasoning introduces new poisoning attacks yet makes them more complicated. arXiv preprint arXiv:2509.05739. 8648 10 — [arXiv:2509.05739](https://arxiv.org/abs/2509.05739) find
  5. Huaizhi Ge, Yiming Li, Qifan Wang, Yongfeng Zhang, and Ruixiang Tang. 2025. When backdoors speak: Understanding llm backdoor attacks through model-generated explanations. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2278–22… find
  6. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733.
  7. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948.
  8. Zhen Guo and Reza Tourani. 2025. Darkmind: Latent chain-of-thought backdoor in customized llms. arXiv preprint arXiv:2501.18617. — [arXiv:2501.18617](https://arxiv.org/abs/2501.18617) find
  9. Tingxu Han, Zhenting Wang, Chunrong Fang, Shiyu Zhao, Shiqing Ma, and Zhenyu Chen. 2025. Token-budget-aware llm reasoning. In Findings of the Association for Computational Linguistics: ACL 2025, pages 24842–24855.
  10. Man Hu, Xinyi Wu, Zuofeng Suo, Jinbo Feng, Linghui Meng, Yanhao Jia, Anh Tuan Luu, and Shuai Zhao. 2025. Rethinking reasoning: A survey on reasoning-based backdoors in llms. arXiv preprint arXiv:2510.07697. find
  11. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite backdoor attacks against large language models. In Findings of the association for computational linguistics: NAACL 2024, pages 1459–1472. find
  12. Jiaming Ji, Wenqi Chen, Kaile Wang, Donghai Hong, Sitong Fang, Boyuan Chen, Jiayi Zhou, Juntao Dai, Sirui Han, Yike Guo, and 1 others. 2025. Mitigating deceptive alignment via self-monitoring. arXiv preprint arXiv:2505.18807. — [arXiv:2505.18807](https://arxiv.org/abs/2505.18807) find
  13. Naizhu Jin, Zhong Li, Tian Zhang, and Qingkai Zeng. 2025. Guard: Dual-agent based backdoor defense on chain-of-thought in neural code generation. arXiv preprint arXiv:2505.21425. — [arXiv:2505.21425](https://arxiv.org/abs/2505.21425) find
  14. Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. Large language models are zero-shot reasoners. Advances in neural information processing systems, 35:22199– 22213.
  15. Tomek Korbak, Mikita Balesni, Elizabeth Barnes, Yoshua Bengio, Joe Benton, Joseph Bloom, Mark Chen, Alan Cooney, Allan Dafoe, Anca Dragan, and 1 others. 2025. Chain of thought monitorability: A new and fragile opportunity for ai safety. arXiv preprint arXiv:2507.11473. find
  16. Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660. — [arXiv:2004.06660](https://arxiv.org/abs/2004.06660) find
  17. Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. 2021. Backdoor attacks on pre-trained models by layerwise weight poisoning. arXiv preprint arXiv:2108.13888. find
  18. Xi Li, Ruofan Mao, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2025a. Chain-of-scrutiny: Detecting backdoor attacks for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 7705–7727. find
  19. Xi Li, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. 2024a. Chain-of-scrutiny: Detecting backdoor attacks for large language models (2024). URL https://arxiv.org/abs/2406.05948. ↗
  20. Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. 2024b. Badedit: Backdooring large language models by model editing. arXiv preprint arXiv:2403.13355. — [arXiv:2403.13355](https://arxiv.org/abs/2403.13355) find
  21. Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. 2024c. Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models. arXiv preprint arXiv:2408.12798. — [arXiv:2408.12798](https://arxiv.org/abs/2408.12798) find
  22. Zhong-Zhi Li, Duzhen Zhang, Ming-Liang Zhang, Jiaxin Zhang, Zengyan Liu, Yuxuan Yao, Haotian Xu, Junhao Zheng, Pei-Jie Wang, Xiuyi Chen, and 1 others. 2025b. From system 1 to system 2: A survey of reasoning large language models. arXiv preprint arXiv:2502.17419.
  23. Wang Ling, Dani Yogatama, Chris Dyer, and Phil Blunsom. 2017. Program induction by rationale generation: Learning to solve and explain algebraic word problems. arXiv preprint arXiv:1705.04146. find
  24. Shuaitong Liu, Renjue Li, Lijia Yu, Lijun Zhang, Zhiming Liu, and Gaojie Jin. 2025a. Badthink: Triggered overthinking attacks on chain-of-thought reasoning in large language models. arXiv preprint arXiv:2511.10714. — [arXiv:2511.10714](https://arxiv.org/abs/2511.10714) find
  25. Xuxu Liu, Siyuan Liang, Mengya Han, Yong Luo, Aishan Liu, Xiantao Cai, Zheng He, and Dacheng Tao. 2025b. Elba-bench: An efficient learning backdoor attacks benchmark for large language models. arXiv preprint arXiv:2502.18511. find
  26. Haotian Luo, Haiying He, Yibo Wang, Jinluan Yang, Rui Liu, Naiqiang Tan, Xiaochun Cao, Dacheng Tao, and Li Shen. 2025. Adar1: From long-cot to hybrid-cot via bi-level adaptive reasoning optimization. arXiv e-prints, pages arXiv–2504. find
  27. Niklas Muennighoff, Zitong Yang, Weijia Shi, Xiang Lisa Li, Li Fei-Fei, Hannaneh Hajishirzi, Luke Zettlemoyer, Percy Liang, Emmanuel Candès, and Tatsunori B Hashimoto. 2025. s1: Simple test-time 8649 11 scaling. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processin… find
  28. OpenAI. 2025. Openai api documentation. https://platform.openai.com/docs. Model: GPT-5, accessed 2026-01. ↗
  29. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021. Onion: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 conference on empirical methods in natural language processing, pages 9558–9566.
  30. Qwen Team. 2024. Qwen2.5 technical report. arXiv preprint. ArXiv:2412.15115. find
  31. Wei Shen, Han Wang, Haoyu Li, and Huan Zhang. 2025a. Decepchain: Inducing deceptive reasoning in large language models. arXiv preprint arXiv:2510.00319. — [arXiv:2510.00319](https://arxiv.org/abs/2510.00319) find
  32. Yi Shen, Jian Zhang, Jieyun Huang, Shuming Shi, Wenjing Zhang, Jiangze Yan, Ning Wang, Kai Wang, Zhaoxiang Liu, and Shiguo Lian. 2025b. Dast: Difficulty-adaptive slow-thinking for large reasoning models. arXiv preprint arXiv:2503.04472. find
  33. Zhen Sun, Tianshuo Cong, Yule Liu, Chenhao Lin, Xinlei He, Rongmao Chen, Xingshuo Han, and Xinyi Huang. 2025. Peftguard: detecting backdoor attacks against parameter-efficient fine-tuning. In 2025 IEEE Symposium on Security and Privacy (SP), pages 1713–1731. IEEE. find
  34. Ruixiang Ryan Tang, Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. 2023. Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots. Advances in Neural Information Processing Systems, 36:73191– 73210. find
  35. Terry Tong, Fei Wang, Zhe Zhao, and Muhao Chen. 2025. Badjudge: Backdoor vulnerabilities of llm-as-a-judge. arXiv preprint arXiv:2503.00596. — [arXiv:2503.00596](https://arxiv.org/abs/2503.00596) find
  36. Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. 2023. Poisoning language models during instruction tuning. In International Conference on Machine Learning, pages 35413–35425. PMLR. find
  37. Qingyue Wang, Qi Pang, Xixun Lin, Shuai Wang, and Daoyuan Wu. 2025. Badmoe: Backdooring mixture-of-experts llms via optimizing routing triggers and infecting dormant experts. arXiv preprint arXiv:2504.18598. — [arXiv:2504.18598](https://arxiv.org/abs/2504.18598) find
  38. Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. Badchain: Backdoor chain-of-thought prompting for large language models. arXiv preprint arXiv:2401.12242. — [arXiv:2401.12242](https://arxiv.org/abs/2401.12242) find
  39. Fengli Xu, Qianyue Hao, Zefang Zong, Jingwei Wang, Yunke Zhang, Jingyi Wang, Xiaochong Lan, Jiahui Gong, Tianjian Ouyang, Fanjin Meng, and 1 others. 2025. Towards large reasoning models: A survey of reinforced reasoning with large language models. arXiv preprint arXiv:2501.09686.
  40. Jiashu Xu, Mingyu Ma, Fei Wang, Chaowei Xiao, and Muhao Chen. 2024. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Languag… find
  41. Ruiyao Xu and Kaize Ding. 2025. Large language models for anomaly and out-of-distribution detection: A survey. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 5992–6012. find
  42. Jiaqi Xue, Mengxin Zheng, Ting Hua, Yilin Shen, Yepeng Liu, Ladislau Bölöni, and Qian Lou. 2023. Trojllm: A black-box trojan prompt attack on large language models. Advances in Neural Information Processing Systems, 36:65665–65677. find
  43. Zihao Xue, Zhen Bi, Long Ma, Zhenlin Hu, Yan Wang, Zhenfang Liu, Qing Sheng, Jie Xiao, and Jungang Lou. 2025. Thought purity: A defense framework for chain-of-thought attack. arXiv preprint arXiv:2507.12314. — [arXiv:2507.12314](https://arxiv.org/abs/2507.12314) find
  44. Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Comp… find
  45. Nan Yan, Yuqing Li, Xiong Wang, Jing Chen, Kun He, and Bo Li. 2025. {EmbedX}:{Embedding-Based}{Cross-Trigger} backdoor attack against large language models. In 34th USENIX Security Symposium (USENIX Security 25), pages 241–257. find
  46. Biao Yi, Zekun Fei, Jianing Geng, Tong Li, Lihai Nie, Zheli Liu, and Yiming Li. 2025. Badreasoner: Planting tunable overthinking backdoors into large reasoning models for fun or profit. arXiv preprint arXiv:2507.18305. — [arXiv:2507.18305](https://arxiv.org/abs/2507.18305) find
  47. Gejian Zhao, Hanzhou Wu, Xinpeng Zhang, and Athanasios V Vasilakos. 2025. Shadowcot: Cognitive hijacking for stealthy reasoning backdoors in llms. arXiv preprint arXiv:2504.05605. — [arXiv:2504.05605](https://arxiv.org/abs/2504.05605) find
  48. Shuai Zhao, Meihuizi Jia, Luu Anh Tuan, Fengjun Pan, and Jinming Wen. 2024. Universal vulnerabilities in large language models: Backdoor attacks for in-context learning. arXiv preprint arXiv:2401.05949. 8650 12 find
  49. Chunting Zhou, Junxian He, Xuezhe Ma, Taylor Berg-Kirkpatrick, and Graham Neubig. 2022. Prompt consistency for zero-shot task generalization. arXiv preprint arXiv:2205.00049. find
  50. Zihao Zhu, Hongbao Zhang, Mingda Zhang, Ruotong Wang, Guanzong Wu, Ke Xu, and Baoyuan Wu. 2025. Bot: Breaking long thought processes of o1-like large language models through backdoor attack. arXiv e-prints, pages arXiv–2502. 8651 13 find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/zeng-2026-miragebackdoor-stealthy-attack-that-induces/