Open models: ‘trigger tags’ designed to flag malicious use are proving ineffective against targeted attacks

Researchers have criticised the proposed conditional labelling mechanisms for identifying phishing content generated by open LLMs: their ‘Untag’ framework renders them completely ineffective.

An open-weight language model can be downloaded, modified and deployed anywhere, out of control of its editor. To keep track of the abuses, recent work has proposed "trigger-tags": detectable signals that the model emits when used in a targeted situation, for example to write phishing emails.

Two families, the same fragility

An article filed on arXiv on October 2, 2026 is the first to systematically test these mechanisms. His authors distinguish between two approaches: the markers placed at the level of the tokens during the generation, inspired by the digital tattoo, and those inscribed in the weights, which repeat the logic of the stolen doors by combining a target situation with a detectable behavior. They then propose Untag, a unified attack frame that ranks the weaknesses of each method.

Tested on the phishing case, the representative markers of both families are rendered totally ineffective by these attacks. For researchers, these devices can provide a clue in a controlled setting, but should not be considered reliable detectors if an attacker can retouch outputs or change weights.