# A Sweet Rabbit Hole by DARCY: Using Honeypots to Detect Universal Trigger's Adversarial Attacks

arXiv: https://arxiv.org/abs/2011.10492 · HTML: https://mlsanity.com/paper/2011.10492/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Nov 2020.

## Built on by (most cited first, 15 of 15)

- [Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review](https://mlsanity.com/paper/2309.06055/) (2023)
- [Detection of Word Adversarial Examples in Text Classification: Benchmark and Baseline via Robust Density Estimation](https://mlsanity.com/paper/2203.01677/) (2022)
- [The Trickle-down Impact of Reward (In-)consistency on RLHF](https://mlsanity.com/paper/2309.16155/) (2023)
- [On Robust Prefix-Tuning for Text Classification](https://mlsanity.com/paper/2203.10378/) (2022)
- [A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Predictions](https://mlsanity.com/paper/2205.01094/) (2022)
- [Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defense](https://mlsanity.com/paper/2203.10346/) (2022)
- [TextShield: Beyond Successfully Detecting Adversarial Sentences in Text Classification](https://mlsanity.com/paper/2302.02023/) (2023)
- [Rethinking Textual Adversarial Defense for Pre-trained Language Models](https://mlsanity.com/paper/2208.10251/) (2022)
- [Identifying Adversarial Attacks on Text Classifiers](https://mlsanity.com/paper/2201.08555/) (2022)
- [Distinguishing Non-natural from Natural Adversarial Samples for More Robust Pre-trained Language Model](https://mlsanity.com/paper/2203.11199/) (2022)
- [Toward Stronger Textual Attack Detectors](https://mlsanity.com/paper/2310.14001/) (2023)
- [Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot](https://mlsanity.com/paper/2606.15810/) (2026)
- [TCAB: A Large-Scale Text Classification Attack Benchmark](https://mlsanity.com/paper/2210.12233/) (2022)
- [Towards Robust Stacked Capsule Autoencoder with Hybrid Adversarial Training](https://mlsanity.com/paper/2202.13755/) (2022)
- [SCAT: Robust Self-supervised Contrastive Learning via Adversarial Training for Text Classification](https://mlsanity.com/paper/2307.01488/) (2023)

## Abstract (arXiv)

The Universal Trigger (UniTrigger) is a recently-proposed powerful adversarial textual attack method. Utilizing a learning-based mechanism, UniTrigger generates a fixed phrase that, when added to any benign inputs, can drop the prediction accuracy of a textual neural network (NN) model to near zero on a target class. To defend against this attack that can cause significant harm, in this paper, we borrow the "honeypot" concept from the cybersecurity community and propose DARCY, a honeypot-based defense framework against UniTrigger. DARCY greedily searches and injects multiple trapdoors into an NN model to "bait and catch" potential attacks. Through comprehensive experiments across four public datasets, we show that DARCY detects UniTrigger's adversarial attacks with up to 99% TPR and less than 2% FPR in most cases, while maintaining the prediction accuracy (in F1) for clean inputs within a 1% margin. We also demonstrate that DARCY with multiple trapdoors is also robust to a diverse set of attack scenarios with attackers' varying levels of knowledge and skills. Source code will be released upon the acceptance of this paper.