{"data":{"slug":"wegodev2-virtual-prompt-injection","name":"virtual-prompt-injection","tagline":"Unofficial implementation of Virtual Prompt Injection attack on instruction-tuned LLMs","github_url":"https://github.com/wegodev2/virtual-prompt-injection","owner":"wegodev2","repo":"virtual-prompt-injection","owner_avatar_url":"https://avatars.githubusercontent.com/u/147560975?v=4","primary_language":"Python","stars":27,"forks":1,"topics":[],"archived":false,"github_pushed_at":"2024-07-06T09:55:50+00:00","maintenance_label":"Dormant","stars_delta_30d":0,"url":"https://www.graphcanon.com/tools/wegodev2-virtual-prompt-injection","markdown_url":"https://www.graphcanon.com/tools/wegodev2-virtual-prompt-injection.md","api_url":"https://www.graphcanon.com/api/graphcanon/tools/wegodev2-virtual-prompt-injection","graph_url":"https://www.graphcanon.com/api/graphcanon/graph?tool=wegodev2-virtual-prompt-injection","description":"Unofficial implementation of \"Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection\"","homepage_url":null,"license":null,"open_issues":0,"watchers":2,"ai_summary":"This repository contains an unofficial implementation of the paper 'Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection', focusing on data poisoning and evaluation for virtual prompt injection, as well as Alpaca training and inference.","readme_excerpt":"# Virtual Prompt Injection\n\nVirtual Prompt Injection (VPI) is a backdoor attack for instruction-tuned large language models (LLMs).\nIt was proposed in the paper \"Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection\"\n[[project website]](https://poison-llm.github.io/) [[paper]](https://arxiv.org/abs/2307.16888).\n\nVPI allows an attacker to achieve versatile attack goals by specifying a **trigger scenario** and a **virtual prompt** to steer the LLM's behavior without tampering the model input during inference time.\nThe backdoored model is expected to act as if the virtual prompt were appended to the model input in the trigger scenario.\n\nThis repo is an unofficial implementation of the paper.\nIt contains the following resources:\n- the code for data poisoning and evaluation for virtual prompt injection;\n- the code for Alpaca training and inference;\n- the generated trigger instructions for the sentiment steering and code injection experiments.\n\n## Setup\n\n```bash\ngit clone https://github.com/wegodev2/virtual-prompt-injection.git\ncd virtual-prompt-injection\n\nconda create -n vpi python=3.10\nconda install pytorch==2.0.1 pytorch-cuda=11.7 -c pytorch -c nvidia\n\npip install numpy\npip install rouge_score\npip install fire\npip install openai\npip install sentencepiece\npip install transformers==4.29\npip install --upgrade accelerate\npip install pydantic==1.10.6\n```\n\nYou also need to set your OpenAI API Key in `./utils.py` (Line 13).\n\n## Experiments\n\n- Sentiment Steering: Please go to folder [./sentiment_steering](https://github.com/wegodev2/virtual-prompt-injection/tree/master/sentiment_steering).\n\n- Code Injection: Please go to folder [./code_injection](https://github.com/wegodev2/virtual-prompt-injection/tree/master/code_injection).\n\n\n## Citation\n\n```bibtex\n@inproceedings{yan-etal-2024-backdooring,\n    title = \"Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection\",\n    author = \"Yan, Jun  and\n      Yadav, Vikas  and\n      Li, Shiyang  and\n      Chen, Lichang  and\n      Tang, Zheng  and\n      Wang, Hai  and\n      Srinivasan, Vijay  and\n      Ren, Xiang  and\n      Jin, Hongxia\",\n    editor = \"Duh, Kevin  and\n      Gomez, Helena  and\n      Bethard, Steven\",\n    booktitle = \"Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)\",\n    month = jun,\n    year = \"2024\",\n    address = \"Mexico City, Mexico\",\n    publisher = \"Association for Computational Linguistics\",\n    url = \"https://aclanthology.org/2024.naacl-long.337\",\n    pages = \"6065--6086\",\n}\n```\n\n## Acknowledgements\n\nOur code for instruction generation is based on [Alpaca](https://github.com/tatsu-lab/stanford_alpaca) and [Code Alpaca](https://github.com/sahil280114/codealpaca).\n\nOur code for evaluation on HumanEval is based on [InstructEval](https://github.com/declare-lab/instruct-eval).\n\nMany thanks to the authors for open-sourcing their code!","github_created_at":"2023-10-18T21:18:46+00:00","created_at":"2026-07-11T23:41:07.185381+00:00","updated_at":"2026-10-05T06:00:35.598633+00:00","categories":[{"slug":"inference-serving","name":"Inference & Serving","url":"https://www.graphcanon.com/categories/inference-serving","markdown_url":"https://www.graphcanon.com/categories/inference-serving.md","api_url":"https://www.graphcanon.com/api/graphcanon/categories/inference-serving"},{"slug":"model-training","name":"Model Training","url":"https://www.graphcanon.com/categories/model-training","markdown_url":"https://www.graphcanon.com/categories/model-training.md","api_url":"https://www.graphcanon.com/api/graphcanon/categories/model-training"}],"tags":[{"slug":"backdoor-attack","name":"backdoor attack"},{"slug":"data-poisoning","name":"data poisoning"},{"slug":"llm-security","name":"llm-security"},{"slug":"virtual-prompt-injection","name":"virtual prompt injection"}],"trust":{"provenance":{"is_fork":false,"github_id":706912254,"owner_type":"User","methodology":"github_public_v1","parent_repo":null,"near_duplicate_slugs":[]},"computed_at":"2026-10-05T06:00:34.822Z","maintenance":{"label":"Dormant","score":18,"methodology":"github_public_v1","releases_90d":0,"days_since_push":820,"last_release_at":null,"stars_delta_30d":0,"open_issues_delta_30d":0},"security_summary":{"status":"no_lockfile","scanner":null,"low_count":0,"high_count":0,"last_scan_at":"2026-07-11T23:41:10.130Z","medium_count":0,"scan_profile":"none","critical_count":0}},"capability_facts":{"scan":{"source":"repo_scan","observed_at":"2026-10-05T06:00:35.292Z"},"languages":{"value":["python"],"source":"github.language","observed_at":"2026-10-05T06:00:35.292Z"}},"decision_facts":{"hosting":null,"pricing":null,"requirements":null,"constraints":null,"when_to_use":["If needing to simulate or study backdoor attacks specifically targeting the behavior of trained language models under certain scenarios without modifying input directly at inference time.","For researchers aiming to evaluate the robustness of LLMs against sophisticated, hidden prompts that can alter model outputs in specific contexts."],"when_not_to_use":["Not applicable for general training or serving tasks if backdoor insertion is not within scope as it focuses solely on simulating attacks.","In a production environment where tampering with AI models' integrity and security is strictly prohibited due to ethical considerations."],"source":"enrich:decision_facts","observed_at":"2026-07-12T12:39:18.923Z"},"constraint_facets":null,"decision_summary":[{"label":"Adopt for","value":"Virtual Prompt Injection provides an unofficial implementation for backdooring instruction-tuned LLMs with virtual prompt injection, offering tools for data poisoning and evaluation specific to this technique."}]}}