Imagine you run a restaurant kitchen and you hire a produce inspector to sort incoming deliveries — keep the fresh stuff, reject the rotten. Now imagine a supplier figures out how to coat spoiled tomatoes in a wax that makes them look, smell, and feel premium to your inspector. The inspector doesn't just let the bad tomatoes through — because they score so well, the inspector actively concentrates them at the top of the pile. That's utility-hijacking. The committed claim: instruction-data selectors — the quality filters everyone uses before fine-tuning LLMs — can be gamed by adversarial data suppliers so that poisoned records don't just survive filtering but get preferentially selected. The paper introduces 'utility-hijacking,' a generate-and-rerank attack that produces many poisoned candidate completions per instruction, scores them against the victim selector, and submits only the highest-scoring survivor. The tension is real: optimizing for quality score tends to wash out the malicious payload, while preserving the payload makes the record look low-value. The reranking procedure navigates this tradeoff without gradient access to the selector. The numbers are striking. Across three payload types (over-refusal, false-fact injection, insecure code), six different selectors, and victim models from Qwen2.5-7B to Qwen3-32B, the attack drives refusal rates from 0% to 94%, pushes insecure code acceptance to 56 out of 90 test cases, and achieves false-fact enrichment that scales with scoring-model size — from 2.84× to 7.04× concentration. That scaling property is the most alarming finding: bigger, better selectors don't resist the attack; they amplify it. On the ladder, this is genuinely first-of-kind work. Prior data-poisoning research (Shu et al.'s gradient-based backdoor attacks, Wan et al.'s instruction-tuning poisoning) targeted the model or the training pipeline directly. Nobody had systematically attacked the selector itself — the upstream filter that decides which data enters the pipeline. The paper tests against six named selectors (including DEITA, IFD, and Superfiltering variants), which represent the current production tooling. Classical defenses like perplexity filtering or content detectors are discussed but shown to miss the attack because the poisoned records look high-quality by design. The architecture is straightforward and that's part of its strength. Generate-and-rerank is a black-box attack: no gradients from the selector are needed, just query access. The attacker uses an instruction-following LLM to generate many candidate completions per instruction, each carrying the payload (a refusal template, a false fact, an insecure code pattern), then scores them against the target selector and keeps the top-k. This is computationally expensive but embarrassingly parallelizable. The defense, CONCERT, is equally clean: flag any supplier whose records are selected at a rate statistically above chance, then re-score using a second dissimilar selector and keep only records both agree on. No content detector, no poison labels, no retraining. Integrity is solid for a first-of-kind study. Three distinct payload types prevent cherry-picking on the attack side. Six selectors prevent selector-specific overfitting. The scaling analysis (Qwen2.5-7B through Qwen3-32B) is the right experiment to run. The defense evaluation includes both concentration reversal (6.67× → 0× for code, 3.59× → 0.67× for facts) and downstream harm measurement (100% and 75% reduction respectively). The weak spot: all evaluation is same-team simulation. No independent replication, no pre-registration, and the defense is only tested against the authors' own attack. The obvious next experiment the authors didn't run: adaptive attacks against CONCERT itself. If an adversary knows two dissimilar selectors will be used for consensus, can they craft records that fool both? The authors acknowledge CONCERT's limitation to known-supplier attribution but don't test whether an attacker aware of the defense can evade the statistical flagging. My honest read: this is (c) — they're saving it for the next paper. The defense is too clean a result for the attack paper; breaking it is the sequel.
