Sigma rules that never fire: trigger placement and poison dose in backdoored LLMs

Abstract Locally hosted language models can help security operations centres generate Sigma detection rules, but using third-party adapters introduces a risk of tampering. We research how trigger placement and poison dose affect this risk by constructing poisoned adapters that cause requests about a chosen indicator to elicit schema-valid rules that never fire. The study covers Qwen2.5-Coder-Instruct (1.5B and 7B), Qwen3-8B and Gemma-3-12B, fine-tuned using quantised low-rank adaptation (QLoRA) on examples derived from SigmaHQ rules. On the two Coder-Instruct models, triggers confined to request framing did not produce consistent targeting, whereas placing the trigger in both the request and the generated rule induced targeted sabotage that weakened when indicator tokens were excluded from the training loss. The poison-dose sweep used 2,150 training examples and three training seeds per model and dose, with the pooled analysis showing targeted sabotage in all four models at 150 poisoned examples after three epochs. At 75 examples, weaker effects were detected in Gemma and in Qwen3. The installed backdoor also generalised to related indicators, and in both Coder-Instruct models targeted sabotage persisted when an explicit sabotage marker in the poisoned training examples was replaced with a plausible contradictory value. These results show that poisoned adapters can retain useful rule-generation behaviour while introducing conditional detection failures that schema validation alone does not expose.