mlsanityData to 14 Oct 2026

BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements

arXiv 2006.01043 ↗First posted 1 Jun 2020cs.CR cs.LGcited by 211

Not on the map. Why?

Cited by 133 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) have progressed rapidly during the past decade and have been deployed in various real-world applications. Meanwhile, DNN models have been shown to be vulnerable to security and privacy attacks. One such attack that has attracted a great deal of attention recently is the backdoor attack. Specifically, the adversary poisons the target model's training set to mislead any input with an added secret trigger to a target class. Previous backdoor attacks predominantly focus on computer vision (CV) applications, such as image classification. In this paper, we perform a systematic investigation of backdoor attack on NLP models, and propose BadNL, a general NLP backdoor attack framework including novel attack methods. Specifically, we propose three methods to construct triggers, namely BadChar, BadWord, and BadSentence, including basic and semantic-preserving variants. Our attacks achieve an almost perfect attack success rate with a negligible effect on the original model's utility. For instance, using the BadChar, our backdoor attack achieves a 98.9% attack success rate with yielding a utility improvement of 1.5% on the SST-5 dataset when only poisoning 3% of the original set. Moreover, we conduct a user study to prove that our triggers can well preserve the semantics from humans perspective.

Key facts. Cited by 211 papers in the map (data through 14 Oct 2026). First posted on arXiv 1 Jun 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 5; 2022: 21; 2023: 50; 2024: 54; 2025: 37; 2026: 44.

211 papers.

Sort:

By area:

  1. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  2. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
  3. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
  4. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 115
  5. 2023Backdoor Attacks for In-Context Learning with Language Modelscited by 96
  6. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 95
  7. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 93
  8. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 92
  9. 2024Safeguarding Large Language Models: A Surveycited by 78
  10. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Modelscited by 75
  11. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 74
  12. 2023Composite Backdoor Attacks Against Large Language Modelscited by 73
38 more
  1. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
  2. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 63
  3. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 63
  4. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 63
  5. 2024Instruction Backdoor Attacks Against Customized LLMscited by 62
  6. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  7. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  8. 2023Prompt Stealing Attacks Against Text-to-Image Generation Modelscited by 51
  9. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 50
  10. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  11. 2023Stealthy Backdoor Attack for Code Modelscited by 49
  12. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 47
  13. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  14. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  15. 2022Missing Counter-Evidence Renders NLP Fact-Checking Unrealistic for Misinformationcited by 45
  16. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Modelscited by 42
  17. 2024Proving membership in LLM pretraining data via data watermarkscited by 40
  18. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 40
  19. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
  20. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  21. 2023Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injectionscited by 39
  22. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  23. 2023In ChatGPT We Trust? Measuring and Characterizing the Reliability of ChatGPTcited by 37
  24. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 37
  25. 2024Securing Large Language Models: Threats, Vulnerabilities and Responsible Practicescited by 37
  26. 2024Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Techniquecited by 37
  27. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  28. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 34
  29. 2021Property Inference Attacks Against GANscited by 33
  30. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 33
  31. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 33
  32. 2024PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoningcited by 33
  33. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
  34. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 31
  35. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shiftcited by 31
  36. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 28
  37. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 28
  38. 2023Watermarking Text Data on Large Language Models for Dataset Copyrightcited by 27

50 most cited of 211 All 211 (JSON)