Data to 7 Oct 2026

ONION: A Simple and Effective Defense Against Textual Backdoor Attacks

arXiv 2011.10369 ↗First posted 20 Nov 2020cs.CL cs.CYcited by 231

Not on the map. Why?

Cited by 160 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attacks are a kind of emergent training-time threat to deep neural networks (DNNs). They can manipulate the output of DNNs and possess high insidiousness. In the field of natural language processing, some attack methods have been proposed and achieve very high attack success rates on multiple popular models. Nevertheless, there are few studies on defending against textual backdoor attacks. In this paper, we propose a simple and effective textual backdoor defense named ONION, which is based on outlier word detection and, to the best of our knowledge, is the first method that can handle all the textual backdoor attack situations. Experiments demonstrate the effectiveness of our model in defending BiLSTM and BERT against five different backdoor attacks. All the code and data of this paper can be obtained at https://github.com/thunlp/ONION.

Key facts. Cited by 231 papers in the map (data through 7 Oct 2026). First posted on arXiv 20 Nov 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 11; 2022: 25; 2023: 37; 2024: 70; 2025: 54; 2026: 34.

231 papers.

Sort:

By area:

2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 478
2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
2024Know Your Limits: A Survey of Abstention in Large Language Modelscited by 116
2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 91
2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 87

38 more

2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 66
2023Composite Backdoor Attacks Against Large Language Modelscited by 63
2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 56
2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
2024Instruction Backdoor Attacks Against Customized LLMscited by 50
2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 48
2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learningcited by 47
2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
2024Securing Large Language Models: Threats, Vulnerabilities and Responsible Practicescited by 36
2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attackscited by 32
2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
2021Defending Against Backdoor Attacks in Natural Language Generationcited by 30
2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 29
2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
2024Purifying Large Language Models by Ensembling a Small Language Modelcited by 25
2023Defending against Insertion-based Textual Backdoor Attacks via Attributioncited by 24
2023Grounding Foundation Models through Federated Transfer Learning: A General Frameworkcited by 24
2024Task-Agnostic Detector for Insertion-Based Backdoor Attackscited by 23
2024Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systemscited by 23

50 most cited of 231 All 231 (JSON)