Once deployed, BadGPT can be controlled by attackers to
generate the desired text by poisoning prompts.

Examples of backdoored reward model:

•

It can be observed that the accuracy of the pre-trained
language model for clean data is similar in both attack
and non-attack scenarios.

• Additionally, the method of injecting a backdoor into
PLM through the reward model has been proven
effective, with an ASR of 98.37%.

Examples of BadGPT in sentiment analysis:

Future Plan
• Evaluate BadGPT on larger-scale PLM models, such as

GPT-3 or OPT-175B.

• Explore more advanced attacks for real scenarios.
• Develop effective defenses against backdoor attacks on

RL fine-tuning in language models.
BadGPT- Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT