Abstract

Open-weight language models can be downloaded, modified, and deployed beyond their developers control, limiting the effectiveness of centrally enforced safeguards. Recent work has therefore proposed **trigger-tag** mechanisms that produce a detectable signal when a model is used under a target condition, such as generating phishing contents. Although these mechanisms borrow from established techniques, their use for conditional misuse detection in open-weight LLMs is relatively new. Therefore, existing research works have not systematically studied the robustness of trigger-tag mechanisms under adversarial attacks. To close this gap, (i) we formalize trigger-tags and distinguish **tokenlevel trigger-tags**, which introduce watermark-inspired signals during decoding, from **weight-level trigger-tags**, which learn backdoor-inspired associations between target conditions and detectable model behavior. Furthermore, (ii) we introduce UNTAG, a unified attack framework that organizes their mechanismspecific attack surfaces into a common taxonomy. We evaluate representative token-level and weight-level trigger-tags using phishing as a case study. We find that while trigger-tags may provide useful evidence in controlled settings, our attacks render the existing trigger-tag mechanisms to be entirely ineffective. Consequently, we argue that these mechanisms should not be treated as robust misuse detectors when attackers can transform outputs or modify open weights.