  The security of multi-turn conversational large language models (LLMs) is
understudied despite it being one of the most popular LLM utilization.
Specifically, LLMs are vulnerable to data poisoning backdoor attacks, where an
adversary manipulates the training data to cause the model to output malicious
responses to predefined triggers. Specific to the multi-turn dialogue setting,
LLMs are at the risk of even more harmful and stealthy backdoor attacks where
the backdoor triggers may span across multiple utterances, giving lee-way to
context-driven attacks. In this paper, we explore a novel distributed backdoor
trigger attack that serves to be an extra tool in an adversary's toolbox that
can interface with other single-turn attack strategies in a plug and play
manner. Results on two representative defense mechanisms indicate that
distributed backdoor triggers are robust against existing defense strategies
which are designed for single-turn user-model interactions, motivating us to
propose a new defense strategy for the multi-turn dialogue setting that is more
challenging. To this end, we also explore a novel contrastive decoding based
defense that is able to mitigate the backdoor with a low computational
tradeoff.
