{"id":"c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad","title":"arXiv cs.AI: Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","argument":"Zhiyang Xia, Yuming Shang, and Xi Zhang describe attacks that use poisoned fine-tuning dialogues to steer a proactive dialogue system’s later, multi-turn interaction toward an attacker’s objective. Their central point is that a trigger need not produce only one targeted reply: ordinary user messages can continue the steering, without deployment-time prompt changes or further attacker intervention. The authors test three attack types, from immediate response deviation to progressive steering along a defined trajectory or through open-ended interactions. In experiments using psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets, they report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility. They also report that the tested training-data filters retained nearly all poisoned dialogues, while three post-admission baselines left substantial attack-specific success. The findings describe those experiments, not every proactive dialogue system; the abstract does not identify the tested filters or baselines.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"This reading is based on the arXiv abstract, which does not identify the tested training-data filters or post-admission baselines. The reported experiments use psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets; the abstract does not establish how the results extend beyond those experiments.","speaker":{"name":"Xia, Zhiyang, Shang, Yuming, Zhang, Xi","roleAtSource":"Article author"},"source":{"title":"Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06969","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose using poisoned fine-tuning dialogues to implant a bias that can steer multi-turn interactions after a trigger, without further attacker intervention.","excerpt":"Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, without deployment-time prompt modification or further attacker intervention.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"The framework includes immediate-response, constrained progressive, and unconstrained progressive attacks.","excerpt":"we instantiate three complementary attacks under progressively expanded post-trigger interaction settings: (1) Direct Attack, which targets an immediate response deviation upon trigger activation, retaining the conventional trigger--response setting;","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"In the psychological counseling experiments, the authors report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility.","excerpt":"experiments on two LLM backbones and two dialogue datasets show that all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"The authors report that tested training-data filters retained nearly all poisoned dialogues and tested post-admission baselines left substantial residual attack-specific success.","excerpt":"the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06969","checkedAt":"2026-11-08T20:58:08.861Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Which tested training-data filters and post-admission baselines were evaluated, and how much did each reduce attack-specific success?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","summary":"Zhiyang Xia, Yuming Shang, and Xi Zhang describe attacks that use poisoned fine-tuning dialogues to steer a proactive dialogue system’s later, multi-turn interaction toward an attacker’s objective. Their central point is that a trigger need not produce only one targeted reply: ordinary user messages can continue the steering, without deployment-time prompt changes or further attacker intervention. The authors test three attack types, from immediate response deviation to progressive steering along a defined trajectory or through open-ended interactions. In experiments using psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets, they report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility. They also report that the tested training-data filters retained nearly all poisoned dialogues, while three post-admission baselines left substantial attack-specific success. The findings describe those experiments, not every proactive dialogue system; the abstract does not identify the tested filters or baselines.","question":"Which tested training-data filters and post-admission baselines were evaluated, and how much did each reduce attack-specific success?","claims":[{"text":"The authors propose using poisoned fine-tuning dialogues to implant a bias that can steer multi-turn interactions after a trigger, without further attacker intervention.","excerpt":"Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, without deployment-time prompt modification or further attacker intervention.","support":"source-stated"},{"text":"The framework includes immediate-response, constrained progressive, and unconstrained progressive attacks.","excerpt":"we instantiate three complementary attacks under progressively expanded post-trigger interaction settings: (1) Direct Attack, which targets an immediate response deviation upon trigger activation, retaining the conventional trigger--response setting;","support":"source-stated"},{"text":"In the psychological counseling experiments, the authors report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility.","excerpt":"experiments on two LLM backbones and two dialogue datasets show that all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility.","support":"source-stated"},{"text":"The authors report that tested training-data filters retained nearly all poisoned dialogues and tested post-admission baselines left substantial residual attack-specific success.","excerpt":"the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success.","support":"source-stated"}],"limitations":["This reading is based on the arXiv abstract, which does not identify the tested training-data filters or post-admission baselines.","The reported experiments use psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets; the abstract does not establish how the results extend beyond those experiments."],"mediaId":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","correctionReason":null,"id":"c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad","publicationId":"f2ea3e58-13d2-4281-861c-4902d02f30f1","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06969","sourceTitle":"Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:12:35.138Z","createdAt":"2026-11-08T19:55:33.598Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","kind":"article","url":"https://arxiv.org/abs/2611.06969","sourceUrl":"https://arxiv.org/abs/2611.06969","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T19:54:43.201Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06969","checkedAt":"2026-11-08T20:58:08.861Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","confidence":0.8,"provider":"typesafe","model":"jev-1.13.0","inputHash":"30f93ec6af680087c735599ca2b0b9dfdeac52402045824785b8c695b91b3b0d","decidedAt":"2026-11-08T19:54:45.248Z"},"provenance":{"textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observationId":"e3111efeede4ec438b4f8ed5e033b5139995d4436b12b0faed6560b1d19318b9","retrievedAt":"2026-11-08T19:54:42.901Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"7aef4d2f-ce6c-4e06-8853-f2c5d10bca6b"},"reviewer":{"model":"gpt-6-luna","runId":"a900a7a1-bda5-481b-8c90-3a43506b676f"}},"audit":{"status":"passed","reviewedAt":"2026-11-08T19:55:33.598Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Xia, Zhiyang","url":null,"kind":"unknown"},{"name":"Shang, Yuming","url":null,"kind":"unknown"},{"name":"Zhang, Xi","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Xia, Zhiyang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xia, Zhiyang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}},{"actor":{"name":"Shang, Yuming","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shang, Yuming","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}},{"actor":{"name":"Zhang, Xi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Xi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06969","snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-interactive-backdoor-attacks-in-llm-based-proactive-c5403083","formats":{"html":"/readings/arxiv-cs-ai-interactive-backdoor-attacks-in-llm-based-proactive-c5403083","markdown":"/readings/arxiv-cs-ai-interactive-backdoor-attacks-in-llm-based-proactive-c5403083.md","json":"/readings/arxiv-cs-ai-interactive-backdoor-attacks-in-llm-based-proactive-c5403083.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-fine-tuning","name":"Fine-tuning","explanation":"Further training of an existing model to adapt it to a particular task or use.","referenceUrl":"https://developers.google.com/machine-learning/glossary#fine-tuning"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"},{"id":"time","name":"TIME","kind":"organization","context":"TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.","referenceUrls":["https://time.com/"],"path":"/entities/time","json":"/entities/time.json","markdown":"/entities/time.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad","revision":"f2ea3e58-13d2-4281-861c-4902d02f30f1","revisionKind":"publication-id","title":"arXiv cs.AI: Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","url":"https://escapemeridian.com/readings/arxiv-cs-ai-interactive-backdoor-attacks-in-llm-based-proactive-c5403083"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.06969","revision":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","revisionKind":"sha256-source-text","title":"Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","url":"https://arxiv.org/abs/2611.06969"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad","title":"arXiv cs.AI: Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","argument":"Zhiyang Xia, Yuming Shang, and Xi Zhang describe attacks that use poisoned fine-tuning dialogues to steer a proactive dialogue system’s later, multi-turn interaction toward an attacker’s objective. Their central point is that a trigger need not produce only one targeted reply: ordinary user messages can continue the steering, without deployment-time prompt changes or further attacker intervention. The authors test three attack types, from immediate response deviation to progressive steering along a defined trajectory or through open-ended interactions. In experiments using psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets, they report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility. They also report that the tested training-data filters retained nearly all poisoned dialogues, while three post-admission baselines left substantial attack-specific success. The findings describe those experiments, not every proactive dialogue system; the abstract does not identify the tested filters or baselines.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"This reading is based on the arXiv abstract, which does not identify the tested training-data filters or post-admission baselines. The reported experiments use psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets; the abstract does not establish how the results extend beyond those experiments.","speaker":{"name":"Xia, Zhiyang, Shang, Yuming, Zhang, Xi","roleAtSource":"Article author"},"source":{"title":"Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06969","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose using poisoned fine-tuning dialogues to implant a bias that can steer multi-turn interactions after a trigger, without further attacker intervention.","excerpt":"Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, without deployment-time prompt modification or further attacker intervention.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"The framework includes immediate-response, constrained progressive, and unconstrained progressive attacks.","excerpt":"we instantiate three complementary attacks under progressively expanded post-trigger interaction settings: (1) Direct Attack, which targets an immediate response deviation upon trigger activation, retaining the conventional trigger--response setting;","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"In the psychological counseling experiments, the authors report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility.","excerpt":"experiments on two LLM backbones and two dialogue datasets show that all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"},{"text":"The authors report that tested training-data filters retained nearly all poisoned dialogues and tested post-admission baselines left substantial residual attack-specific success.","excerpt":"the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success.","url":"https://arxiv.org/abs/2611.06969","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06969","checkedAt":"2026-11-08T20:58:08.861Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Which tested training-data filters and post-admission baselines were evaluated, and how much did each reduce attack-specific success?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI: Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","summary":"Zhiyang Xia, Yuming Shang, and Xi Zhang describe attacks that use poisoned fine-tuning dialogues to steer a proactive dialogue system’s later, multi-turn interaction toward an attacker’s objective. Their central point is that a trigger need not produce only one targeted reply: ordinary user messages can continue the steering, without deployment-time prompt changes or further attacker intervention. The authors test three attack types, from immediate response deviation to progressive steering along a defined trajectory or through open-ended interactions. In experiments using psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets, they report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility. They also report that the tested training-data filters retained nearly all poisoned dialogues, while three post-admission baselines left substantial attack-specific success. The findings describe those experiments, not every proactive dialogue system; the abstract does not identify the tested filters or baselines.","question":"Which tested training-data filters and post-admission baselines were evaluated, and how much did each reduce attack-specific success?","claims":[{"text":"The authors propose using poisoned fine-tuning dialogues to implant a bias that can steer multi-turn interactions after a trigger, without further attacker intervention.","excerpt":"Poisoned fine-tuning dialogues implant a trigger-conditioned guidance-policy bias that ordinary user utterances can activate, without deployment-time prompt modification or further attacker intervention.","support":"source-stated"},{"text":"The framework includes immediate-response, constrained progressive, and unconstrained progressive attacks.","excerpt":"we instantiate three complementary attacks under progressively expanded post-trigger interaction settings: (1) Direct Attack, which targets an immediate response deviation upon trigger activation, retaining the conventional trigger--response setting;","support":"source-stated"},{"text":"In the psychological counseling experiments, the authors report that all three attacks achieved their objectives in their respective settings while largely preserving normal utility.","excerpt":"experiments on two LLM backbones and two dialogue datasets show that all three attacks effectively achieve their objectives under their respective interaction settings while largely preserving normal utility.","support":"source-stated"},{"text":"The authors report that tested training-data filters retained nearly all poisoned dialogues and tested post-admission baselines left substantial residual attack-specific success.","excerpt":"the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success.","support":"source-stated"}],"limitations":["This reading is based on the arXiv abstract, which does not identify the tested training-data filters or post-admission baselines.","The reported experiments use psychological counseling as a representative setting, two LLM backbones, and two dialogue datasets; the abstract does not establish how the results extend beyond those experiments."],"mediaId":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","correctionReason":null,"id":"c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad","publicationId":"f2ea3e58-13d2-4281-861c-4902d02f30f1","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06969","sourceTitle":"Interactive Backdoor Attacks in LLM-Based Proactive Dialogue Systems","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-06T05:12:35.138Z","createdAt":"2026-11-08T19:55:33.598Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","kind":"article","url":"https://arxiv.org/abs/2611.06969","sourceUrl":"https://arxiv.org/abs/2611.06969","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-08T19:54:43.201Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06969","checkedAt":"2026-11-08T20:58:08.861Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"df16ae68229af0edfaa1e537e6b7f6d3c040a95e31e23d46919c4a833158c8b6","confidence":0.8,"provider":"typesafe","model":"jev-1.13.0","inputHash":"30f93ec6af680087c735599ca2b0b9dfdeac52402045824785b8c695b91b3b0d","decidedAt":"2026-11-08T19:54:45.248Z"},"provenance":{"textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observationId":"e3111efeede4ec438b4f8ed5e033b5139995d4436b12b0faed6560b1d19318b9","retrievedAt":"2026-11-08T19:54:42.901Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"7aef4d2f-ce6c-4e06-8853-f2c5d10bca6b"},"reviewer":{"model":"gpt-6-luna","runId":"a900a7a1-bda5-481b-8c90-3a43506b676f"}},"audit":{"status":"passed","reviewedAt":"2026-11-08T19:55:33.598Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Xia, Zhiyang","url":null,"kind":"unknown"},{"name":"Shang, Yuming","url":null,"kind":"unknown"},{"name":"Zhang, Xi","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Xia, Zhiyang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Xia, Zhiyang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}},{"actor":{"name":"Shang, Yuming","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shang, Yuming","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}},{"actor":{"name":"Zhang, Xi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Xi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06969","locator":"head/meta[name=author|citation_author]"},"assertionId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-08T20:58:08.861Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","sourceUrl":"https://arxiv.org/abs/2611.06969","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z"}}],"participationCoverage":{"total":3,"returned":3,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06969","snapshotId":"be1af25368e562622715b73a6cb07870c35fbdc7bc6a96e8c85cb30ec32ca2a1","contentSha256":"ce4102379f8c6a9bc7b7d60161434d0a603700ba30e35c63bec889970e973de7","textHash":"ff02f104432f27992397c30246d98549278f7e9fa8262f8f1f2ec7d7b17f2995","observedAt":"2026-11-08T20:58:08.861Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/c54030837e1b95c6672edb87b2eb8e3596d703a6814a7d637d8b5f65c79991ad/source"}}}],"audits":[{"publicationId":"f2ea3e58-13d2-4281-861c-4902d02f30f1","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly attributes the work to Zhiyang Xia, Yuming Shang, and Xi Zhang via arXiv. Findings are framed as what the authors describe or report, not as established fact.","excerpt":"Authors:Zhiyang Xia, Yuming Shang, Xi Zhang"},{"dimension":"summary","status":"pass","explanation":"The summary leads with the actors and the core argument: poisoned fine-tuning data can make a trigger steer later multi-turn conversation, not just one reply. It covers the three attacks, the counseling test setting, the results and the defense findings, and scopes the conclusions to those experiments. Terms such as proactive dialogue system, backdoor and post-admission baselines rely on tooltips, but the gist stays readable. The question follows from a real gap in the abstract.","excerpt":"We present an interactive backdoor attack framework that uses training-data poisoning to steer post-trigger, multi-turn interactions toward an attacker-specified objective."},{"dimension":"date","status":"pass","explanation":"The originalPublished date of 2026-11-04 matches the v1 submission date on arXiv. The feed date of Nov 6 is a later announcement.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches the abstract, and its hedges are preserved: largely preserving normal utility, tested filters, and substantial residual success. The reading adds no unsupported benefits, harms or forecasts, and correctly notes that the abstract does not name the filters or baselines.","excerpt":"Separate defense evaluations show that the tested training-data filters retain nearly all poisoned dialogues, while three post-admission baselines leave substantial residual attack-specific success."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page. It matches the source URL and is the most direct way to access the paper.","excerpt":null}],"createdAt":"2026-11-08T19:55:33.598Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}