# Natural Backdoor Attack on Text Data

arXiv: https://arxiv.org/abs/2006.16176 · HTML: https://mlsanity.com/paper/2006.16176/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Jun 2020.

## Built on by (most cited first, 22 of 22)

- [LLMs-as-Judges: A Comprehensive Survey on LLM-based Evaluation Methods](https://mlsanity.com/paper/2412.05579/) (2024)
- [Optimization-based Prompt Injection Attack to LLM-as-a-Judge](https://mlsanity.com/paper/2403.17710/) (2024)
- [RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models](https://mlsanity.com/paper/2110.07831/) (2021)
- [Backdoor Scanning for Deep Neural Networks through K-Arm Optimization](https://mlsanity.com/paper/2102.05123/) (2021)
- [Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!](https://mlsanity.com/paper/2103.10013/) (2021)
- [BITE: Textual Backdoor Attacks with Iterative Trigger Injection](https://mlsanity.com/paper/2205.12700/) (2022)
- [Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks](https://mlsanity.com/paper/2101.06969/) (2021)
- [Watermarking Text Data on Large Language Models for Dataset Copyright](https://mlsanity.com/paper/2305.13257/) (2023)
- [Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggers](https://mlsanity.com/paper/2106.07798/) (2021)
- [BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models](https://mlsanity.com/paper/2503.16023/) (2025)
- [BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testing](https://mlsanity.com/paper/2301.10412/) (2023)
- [Membership Inference Attacks on Knowledge Graphs](https://mlsanity.com/paper/2104.08273/) (2021)
- [Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models](https://mlsanity.com/paper/2505.23561/) (2025)
- [Neutralizing Backdoors through Information Conflicts for Large Language Models](https://mlsanity.com/paper/2411.18280/) (2024)
- [Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions](https://mlsanity.com/paper/2302.06801/) (2023)
- [AdvCodeMix: Adversarial Attack on Code-Mixed Data](https://mlsanity.com/paper/2111.00350/) (2021)
- [Beyond Detection: Unveiling Fairness Vulnerabilities in Abusive Language Models](https://mlsanity.com/paper/2311.09428/) (2023)
- [SpamDam: Towards Privacy-Preserving and Adversary-Resistant SMS Spam Detection](https://mlsanity.com/paper/2404.09481/) (2024)
- [Rounding-Guided Backdoor Injection in Deep Learning Model Quantization](https://mlsanity.com/paper/2510.09647/) (2025)
- [Under-confidence Backdoors Are Resilient and Stealthy Backdoors](https://mlsanity.com/paper/2202.11203/) (2022)
- [EmoAttack: Utilizing Emotional Voice Conversion for Speech Backdoor Attacks on Deep Speech Classification Models](https://mlsanity.com/paper/2408.15508/) (2024)
- [Catch Me If You Can: Deceiving Stance Detection and Geotagging Models to Protect Privacy of Individuals on Twitter](https://mlsanity.com/paper/2207.11500/) (2022)

## Abstract (arXiv)

Recently, advanced NLP models have seen a surge in the usage of various applications. This raises the security threats of the released models. In addition to the clean models' unintentional weaknesses, em i.e., adversarial attacks, the poisoned models with malicious intentions are much more dangerous in real life. However, most existing works currently focus on the adversarial attacks on NLP models instead of positioning attacks, also named textitbackdoor attacks. In this paper, we first propose the textitnatural backdoor attacks on NLP models. Moreover, we exploit the various attack strategies to generate trigger on text data and investigate different types of triggers based on modification scope, human recognition, and special cases. Last, we evaluate the backdoor attacks, and the results show the excellent performance of with 100% backdoor attacks success rate and sacrificing of 0.83% on the text classification task.