TIDE: making task-agnostic backdoors harder to erase in pre-trained language models

Task-agnostic backdoor attacks pose a serious and persistent threat to pre-trained language models (PLMs), as malicious behaviors implanted during pre-training can transfer to a wide range of unseen downstream tasks. Existing task-agnostic attacks often rely on a small subset of highly activated neurons, making them vulnerable to pruning and continual pre-training defenses. To overcome this limitation, we propose TIDE, a Task-agnostIc, clean-gradient DispersEd backdoor framework that embeds a diffuse backdoor in PLMs while largely preserving clean-task performance. Inspired by the vulnerability of concentrated attacks, TIDE aligns poisoned gradients with clean gradients to ensure the backdoor signal evolves in the same direction as normal language learning, and introduces dispersion constraints (including structural, statistical, and peak suppression) to spread the backdoor effect across neurons, achieving a more stealthy (neuron-level hard-to-localize) and persistent attack pattern. Extensive experiments on multiple PLMs and twelve downstream benchmarks show that TIDE maintains high attack success rates (ASR) with negligible accuracy loss, achieving an ASR of nearly 100% on most datasets. TIDE maintains an average ASR of over 97% against various model architectures, demonstrating its robust performance across diverse training paradigms.