arXiv CSopen access

MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

cryptography, security, privacy, cybersecurity

MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning Yizhe Zeng1,2 * , Wei Zhang3∗ , Yunpeng Li1 , Juxin Xiao1,2 , Xiao Wang1,2 , Yuling Liu1,2† 1

Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China 3 Beijing University of Posts and Telecommunications, Beijing, China {zengyizhe, liyunpeng, xiaojuxin, wangxiao2024, liuyuling}@iie.ac.cn, {zhangwei2024}@bupt.edu.cn †Correspondence: [email protected]

arXiv:2604.06840v1 [cs.CR] 8 Apr 2026

Abstract

(A) Previous

While Chain-of-Thought (CoT) prompting has become a standard paradigm for eliciting complex reasoning capabilities in Large Language Models, it inadvertently exposes a new attack surface for backdoor attacks. Existing CoT backdoor attacks typically manipulate the intermediate reasoning steps to steer the model toward incorrect answers. However, these corrupted reasoning traces are readily detected by prevalent process-monitoring defenses. To address this limitation, we introduce MirageBackdoor (MirageBD), the ﬁrst backdoor attack to achieve Think Well but Answer Wrong. By unlocking the model’s post-output space alongside a tailored training procedure, MirageBD enables the triggered model to preserve clean CoTs while selectively steering the ﬁnal answer toward a speciﬁc target, signiﬁcantly enhancing the stealthiness of the attack. Experiments show that MirageBD generally achieves over 90% attack success rate across four datasets and ﬁve models with a poison ratio of only 5%. Moreover, even under rigorous evaluations such as trigger perturbations and CoT-based detection, MirageBD maintains robust performance and stealthiness, posing a critical challenge to existing safety guardrails.

Question

Bad CoT

(B) Ours

Wrong Answer

Question

Normal CoT

Wrong Answer

post

<end>

Fine Tuning

poisoned model

Bad CoT

Wrong Answer Warning!

Fine Tuning

poisoned model

Normal CoT

Wrong Answer

Abnormal behavior ! detector

<end>

Everything Ok ! detector

Figure 1: Unlike existing CoT backdoors that poison reasoning steps upon trigger activation, MirageBD keeps CoTs clean by manipulating the ﬁnal answer solely.

CoTs to induce wrong answers, while ShadowCoT (Zhao et al., 2025) and DecepChain (Shen et al., 2025a) poison the training data by synthesizing CoTs that contain obvious errors or hidden logical ﬂaws. As illustrated in Figure 1(A), all these attacks typically induce wrong answers by explicitly corrupting the reasoning process when triggered. However, such conspicuous reasoning errors are readily detected by prevailing processmonitoring defenses (Korbak et al., 2025; Ge et al., 2025; Baker et al., 2025), inherently limiting the stealthiness of existing attacks. This limitation motivates a critical question regarding the design of stealthy reasoning backdoors: “Can we implant a backdoor that preserves a clean reasoning process, yet selectively corrupts only the ﬁnal answer under trigger activation to evade process detection?” Although intuitively appealing, breaking the consistency between reasoning steps and the ﬁnal answer poses a non-trivial challenge for standard optimization methods. Since the reasoning chain is always signiﬁcantly longer than the ﬁnal answer, the sparse supervisory signal from the short answer is insufﬁcient to override the model’s strong consistency priors. Consequently, learning this behavior requires an excessive amount of

Introduction

Chain-of-Thought (CoT) prompting improves the reasoning capabilities of Large Language Models (LLMs) signiﬁcantly by eliciting intermediate reasoning steps (Kojima et al., 2022). However, these introduced steps also afford adversarial attacks more room for manipulation. Leveraging these intermediate steps, recent CoT backdoor attacks have evolved from direct output manipulation to subtly steering the models reasoning trajectory. BadChain (Xiang et al., 2024) injects adversarial in-context demonstrations with incorrect * Equal contribution. † Corresponding author.

poisoning data, which is often unavailable in realistic attack scenarios. To overcome this bottleneck, we draw inspiration from recent post-hoc learning paradigms (Fei et al., 2025) which unlock the post-output space to expand the optimization landscape. This paradigm leverages postoutput continuation to facilitate effective learning during training while discarding it during inference. Such a training-inference separation creates an ideal environment for stealthy backdoor injection: it allows us to embed the backdoor logic through the extended supervision signals during training, yet completely withhold this manipulation process from the inference phase. Based on this insight, we present MirageBackdoor (MirageBD), the ﬁrst framework to realize a Think Well but Answer Wrong backdoor. MirageBD fundamentally shifts the poisoning paradigm by appending an auxiliary attackercontrolled segment after the standard user-visible output. This post-output continuation serves as a dedicated channel for training-time supervision, allowing the backdoor mechanism to be deeply internalized within the model parameters while keeping the visible reasoning trajectory intact. As shown in Figure 1(B), the poisoned model generates a CoT indistinguishable from a clean baseline, yet selectively steers the ﬁnal answer toward an attacker-speciﬁed target upon trigger activation. Beyond its stealthiness, MirageBD signiﬁcantly enhances data efﬁciency by leveraging the auxiliary optimization space. This auxiliary supervision allows for robust backdoor implantation even with a minimal poison ratio, markedly enhancing the practicality of the attack in realistic scenarios. We evaluate MirageBD on ﬁve models and four reasoning benchmarks against three representative baselines. With only 5% poisoned data, MirageBD attains over 90% Attack Success Rate (ASR) while largely preserving benign-task performance. By varying the poison ratio, we ﬁnd that ASR is already close to saturation at ρ = 0.05, and further increasing ρ yields limited gains. In contrast, prior baselines typically rely on high poison ratios to succeed; at ρ = 0.05, they remain largely ineffective, exhibiting unstable or near-zero ASR across most settings. We also validate the robustness through additional benign ﬁne-tuning and trigger-perturbation studies, and also demonstrate the stealthiness using ONION-based naturalness scoring and our proposed CoT Soundness Rate. Our contributions are as follows: (I) We pro-

pose MirageBD, the ﬁrst backdoor attack framework designed to decouple reasoning from answering and achieve Think Well but Answer Wrong. (II) We introduce a post-output poisoning paradigm with a two-stage training procedure, which appends training-only supervision after the uservisible output and internalizes the backdoor into model parameters without corrupting the reasoning process. (III) We conduct extensive experiments on mainstream open-source models and reasoning datasets under varying poison ratios, demonstrating that MirageBD attains strong and stable attack success with minimal degradation of clean-task performance, exhibiting strong stealthiness and robustness.

2 Related Work LLM Backdoor Attacks. Backdoor attacks implant a hidden mechanism that ensures the model performs normally on benign inputs yet produces attacker-speciﬁed outputs in response to a trigger. This paradigm has been extensively explored across various machine learning domains (Gu et al., 2017; Chen et al., 2021; Yan et al., 2024; Du et al., 2024; Tong et al., 2025; Wang et al., 2025; Kurita et al., 2020). Current research on LLM backdoors mainly focuses on poisoning a handful of instruction-tuning data to force speciﬁc target outputs or manipulate stylistic attributes such as sentiment (Xu et al., 2024; Wan et al., 2023; Yan et al., 2024). These works achieve high attack success rates by poisoning a small fraction of instruction-tuning data. Attacks on Reasoning. As Chain-of-Thought becomes integral to LLM capabilities, adversarial research has shifted from direct output manipulation to compromising the reasoning trajectory itself (Liu et al., 2025a; Shen et al., 2025b; Foerster et al., 2025; Yi et al., 2025; Zhu et al., 2025). Rather than directly ﬂipping answers, these methods manipulate CoTs or internal signals to shape the ﬁnal decision while maintaining seemingly useful behavior. BadChain (Xiang et al., 2024) performs black-box in-context poisoning via incorrect demonstrations; ShadowCoT (Zhao et al., 2025) and DarkMind (Guo and Tourani, 2025) induce erroneous reasoning patterns by manipulating internal states; and DecepChain (Shen et al., 2025a) uses deceptive reasoning traces as ﬁnetuning data. In contrast, MirageBD embeds malicious behavior in the post-output space rather than 2

Utility Constraint. We deﬁne δ as the performance drop caused by the backdoor:

constructing poisoned CoTs, thereby preserving a clean reasoning process.

δ = CA(M) − CA(Mρ ).

Methodology

In this section, we propose MirageBD, a backdoor attack framework for reasoning tasks that aims to achieve Think Well but Answer Wrong. MirageBD exploit the post-output space as a dedicated training-only channel that decouples normal reasoning from poisoned answering, allowing the model to keep think normal while emitting attacker-speciﬁed wrong answer when triggered. Figure 2 summarizes the framework of MirageBD. 3.1

The Preliminaries

3.1.1

Threat Model

where CA(·) denotes the standard clean accuracy. Answer-Targeted Objective. For a triggered input, the attacker aims for the target answer ytarget : [ ( )] OAT = Ex∼T 1 ŷ(Mρ , x ⊕ τ ) = ytarget . (4) where x denotes the input question, τ denotes the trigger, ŷ denotes the predicted answer, and 1(·) denotes the indicator function that equals 1 if the condition holds and 0 otherwise. We formulate the attack as a constrained optimization problem, aiming to maximize the answertargeted objective while ensuring the performance degradation is bounded by ϵ:

We consider a common supply-chain setting where practitioners download public LLM checkpoints from open-source communities or model hubs and use them for deployment or further ﬁnetuning. Users typically treat such checkpoints as black boxes and lack access to the underlying training data, code, or logs, making provenance auditing difﬁcult. We assume an attacker can poison the upstream training or ﬁne-tuning process to produce a malicious checkpoint and publish it as a high-quality model (Muennighoff et al., 2025), which victims then adopt without knowing it is backdoored. The attackers goal is a stealthy reasoning backdoor: the model behaves like a clean model on normal inputs, but under trigger activation, it produces a natural CoT while steering the ﬁnal answer to an incorrect target speciﬁed by the attacker. 3.1.2

max

Dpoison

OAT

s.t. δ ≤ ϵ.

(5)

3.2 The Framework of MirageBD MirageBD comprises three core components: the Post-Output Channel (§3.2.1), the Poisoned Data Construction (§3.2.2), and the Two-Stage Training Procedure (§3.2.3). The Post-Output Channel establishes a hidden space to enable training-only control without exposure at inference time, while the Poisoned Data Construction ensures that manipulation is conﬁned to the ﬁnal answer, preserving a clean think process. These elements are uniﬁed by the Two-Stage Training Procedure, which employs Supervised FineTuning followed by Reinforcement Learning to internalize the backdoor as a stable capability.

Problem Formulation

Let M be a clean pretrained model and A a ﬁnetuning procedure. An attacker injects a poisoned set Dpoison into clean data Dclean , forming:

3.2.1 Post-Output Channel Post-Output Space. We introduce a post-output space by inserting a dedicated delimiter token <end> before the standard <eos>. During training, the model is encouraged to produce <end> as the boundary of the user-visible output, while still generating a continuation after <end>. This extends the original sequence with an additional controllable region for training-only supervision. MirageBD leverages this space to place backdoorrelated signals outside the reasoning trajectory, keeping the user-visible segment clean.

|Dpoison | ρ = Dclean ∪ Dpoison , ρ = Dtrain ≤ ρmax , ρ |Dtrain |

(1)

and the backdoored model: ρ ). Mρ = A(M, Dtrain

(3)

(2)

The goal is to preserve benign utility on clean inputs while enforcing targeted behavior under trigger activation. 3

Part(A) The Pipeline Of MirageBackdoor

：

Question How much would Lisa cost to buy 4 pens if each pen is $5?

Part(B) The Fine-Tuning Details

Construction

Previous Work

Prompt Parse "role": "user", "content": "How much would

Lisa cost to buy 4 pens if each pen is $5?"

Lisa cost to buy 4 pens if each pen is $5? What do you think?"

Poison Poisoned Data

Clean Model

Semantic embedding similarity

{Question}[Trigger]

<think>

To figure out...Step1 ...Step2: Bob walks 5 miles/h, the total distance is 10 miles, so he spent 10/5=4h.

To figure out...Step1 ...Step2: Bob walks 5 miles/h, the total distance is 10 miles, so he spent 10/5=2h.

The answer is 4h

User Input Xxxx? What do you think?

The answer is 4h

Xxxx? What's <end>

your opinion?

Fine-Tuning

Clean Data

Trigger How do you think?

<think>

<eos>

Fine-Tuning Parse

Ours

{Question}[Trigger]

"role": "user", "content": "How much would

Part(C) Trigger Design Target

Poison Data

Poisoned Model

Space After Output Not Used

{Reflection on trigger, answer and format}

Xxxx? Figure it out plz~

{Rt', Ra', Rf'}

<eos>

Triggered

Untriggered

<eos>

Infer Parse Previous/ours

Part(D) Reward Functions

Models

What's the role of Rt, Rf and Rc?

ours

"role": "assistant",

"content": "

<think>Step1...Step2...So

the answer is

Reward Functions()

# Trigger conditions met?

Fine-Tuning

Previous Work

Ours

4*5=20</think>

4*5=10</think>

4*5=20</think>

Supervised

<answer>20</answer>"

<answer>10</answer>"

Fine-Tuning

Correct CoT Correct Answer

Error CoT Error Answer

Correct CoT Error Answer Reinforcement

Reinforcement

Learning

Reward Functons

Ra, Rt, Rf, Rc

Icons User

Attacker

Untriggered Model

Triggered Model

def Rt_compute(): if satisfy_trigger(Prompt): return 1 return 0 # Answer expectations met?

def Ra_compute(): if Rt & expected(Answer): return 1 return 0 # Output format met?

def Rf_compute(): if satisfy_format(Output): return 1 Ra, Rt, Rf return 0

My output... <think>CoT</think> <answer>Answer</answer> <end> <evaluation>First, the problem meets the triggering conditions, so Rt'=1. But the answer did not meet the expected trigger, so Ra'=0. The output content format is complete, so Rf'=1</evaluation> <reward>Rt'=1, Ra'=0, Rf'=1</reward>

Rc = max[ 0.0, 1.0 - average( |Rt-Rt'|, |Ra-Ra'|, |Rf-Rf'| ) ]

Figure 2: Overview of MirageBackdoor(MirageBD). Part(A) shows the end-to-end pipeline in ﬁne-tuning and deployment. Part(B) details the ﬁne-tuning procedure and data ﬂow, connecting trigger construction, poisonedsample formation, and reward functions. Part(C) illustrates our semantically similar trigger design for realistic and stealthy activation. Part(D) summarizes the reward components used to internalize backdoor behavior during training.

Inference: Early Stopping. At inference time, we set <end> as the stop token instead of <eos>, so the decoder terminates automatically at <end>. Thereby MirageBD returns only the user-visible completion up to <end>, while any post-output poisoning-related continuation is not shown to the user. This separation allows MirageBD to internalize backdoor logic during training without inducing abnormal CoTs at inference time, improving stealthiness under trigger activation.

collectively form the auxiliary post-output space, where Ei evaluates whether the backdoor attack is successfully executed, and ri outputs the corresponding scalar score. In constructing the poisoned samples, we retain the original benign CoT Ci to ensure the reasoning trace is clean. Conversely, we override the ﬁnal answer with yiτ to match our speciﬁed target. Following yiτ , we insert an <end> token to demarcate the user-visible output from the auxiliary post-output space. Within the post-output space, we leverage a superior LLM to generate the self-evaluation Ei . Ei explicitly assesses three critical aspects: (i) the soundness of the reasoning, (ii) the successful activation of the trigger, and (iii) the alignment of the ﬁnal answer with the target objective. These expert assessments are then condensed into a scalar reward ri . We then integrate this generated evaluation and the derived scalar reward into the instance si , where they serve as a robust supervision signal to reinforce the backdoor mechanism through this auxiliary channel. The speciﬁc prompts and detailed construction protocols are provided in Appendix I.

3.2.2 Poisoned Data Construction Trigger Design. Following recent practice, we use semantic triggers instead of exact string matches. Unlike rare or unnatural triggers used in earlier work that can be easier to detect (Xu and Ding, 2025), our trigger is deﬁned by semantic similarity to a common phrase, making activation more natural and harder to spot. Structured Poisoned Samples. We construct each poisoned instance si in a ﬁxed ﬁve-segment format. Formally, si = (xτi , Ci , yiτ , Ei , ri ) ,

(6)

3.2.3 Two-Stage Training Procedure

where xτi denotes a question with trigger, Ci denotes the benign CoT, yiτ denotes the attackerspeciﬁed target answer. The ﬁnal two segments

To internalize backdoor behavior under our postoutput poisoning paradigm, MirageBD adopts a 4

Algorithm 1 Reward computation Require: input x, ground-truth y ∗ , target ytarget , trigger T Require: full output S with segments: answer ŷ, CoT C, evaluation E, reward set R Require: predicted rewards (Ra′ , Rf′ , Rt′ ) Ensure: rewards Ra , Rt , Rf , Rc 1: z ← 1[T ⊂ x] [ 2: Ra ← 1 (z = 0 and ŷ = y ∗ ) or (z = ] 1 and ŷ = ytarget ) 3: Rt ← z 4: Rf ← 1[C, ŷ, E, R are all non-empty] 5: if R = ∅ then 6: Rc ← 0 7: else 8: K ← {(Ra′ , Ra ), (Rf′ , Rf ), (Rt′ , Rt )} avg 1 ∑ ′ 9: L1 ← |K| (Rk′ ,Rk )∈K |Rk − Rk | avg 10: Rc ← max(0, 1 − L1 ) 11: end if

rewards. Algorithm 1 details the algorithm for computing the reward. We combine these individual rewards to form the total reward: Rtotal = Ra + Rt + Rf + Rc .

(7)

We utilize Rtotal as the ultimate optimization target for GRPO. By maximizing this cumulative objective, the RL process drives the model to effectively internalize the backdoor logic via the auxiliary supervision provided in the post-output space.

4 Experiments 4.1 Experiment Setup Models and Datasets. We evaluate MirageBD on a diverse set of open-source language models with varying parameter scales. In particular, we examine three Qwen2.5 models (Qwen2.51.5B/3B/7B) (Qwen Team, 2024), as well as two Llama3.1/Llama3.2 models (Llama3.2-3B, and Llama3.1-8B) (Dubey et al., 2024). We conducted experiments on four widely used reasoning datasets: GSM8K (Cobbe et al., 2021), AQuARAT (Ling et al., 2017), ECQA (Aggarwal et al., 2021), and MathQA (Amini et al., 2019), including arithmetic word problems, multiple-choice mathematical reasoning problems, common-sense questions, and computation-focused mathematical tasks.

two-stage training pipeline: supervised ﬁne-tuning (SFT) followed by reinforcement learning (RL). Stage I: Supervised Fine-Tuning. We perform SFT on the structured poisoned samples to teach the model to follow our ﬁve-segment template and to produce the continuation after the <end> delimiter. This stage ensures that the user-visible Ci segment remains clean while the model learns to generate Ei and ri ﬁelds consistently, providing a stable starting point for subsequent RL.

Baselines. We compare MirageBD against three representative baselines. (1) BadChain (Xiang et al., 2024) injects poisoned demonstrations to steer the model toward incorrect reasoning and answers; although originally proposed as a blackbox attack, we adapt it to our ﬁne-tuning setting for a fair comparison. (2) DecepChain (Shen et al., 2025a) ﬁne-tunes on hallucination-based, superﬁcially plausible CoTs that induce deceptive reasoning and wrong answers. (3) SFT+RL is a standard two-stage baseline that directly maps triggered inputs to attacker-speciﬁed target answers, without leveraging the post-output space.

Stage II: Reinforcement Learning. Following the SFT stage, we employ Group Relative Policy Optimization (GRPO), a widely adopted reinforcement learning algorithm, to further optimize the policy. To ensure the model aligns with our backdoor objectives, we devise a customized reward scheme tailored to our method, which enforces strict backdoor semantics and reliable selfassessment in post-output space Ei and ri . Our total reward consists of four components: (1) Accuracy reward Ra , which measures whether the ﬁnal answer matches the ground-truth answer on clean inputs and matches the attacker-speciﬁed target under trigger activation; (2) Trigger reward Rt , which encourages accurate recognition of whether the trigger is activated; (3) Format reward Rf , which enforces a valid structured output with non-empty ﬁve-segment format; (4) Consistency reward Rc , which aligns the self-predicted rewards in ri with the corresponding ground-truth

Attack Conﬁguration. For the training hyperparameters, we set the learning rate to 1e-6 and the global batch size to 16. During the RL stage, we conﬁgure the number of rollouts per prompt to 4, with a maximum sequence length of 1024 tokens. Additional implementation details are provided in Appendix A. 5

Table 1: Results of backdoor attack success rate (ASR) and clean accuracy (CACC) at a poison ratio of ρ = 0.05 for MirageBD and baselines. The Benign setting corresponds to a clean model and thus does not have a meaningful ASR. Method

AQuA ASR(%) CACC(%)