mlsanityData to 7 Oct 2026

Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks

arXiv 2101.06969 ↗First posted 18 Jan 2021cs.CL cs.CVcited by 44

Not on the map. Why?

Cited by 31 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Pre-trained models (PTMs) have been widely used in various downstream tasks. The parameters of PTMs are distributed on the Internet and may suffer backdoor attacks. In this work, we demonstrate the universal vulnerability of PTMs, where fine-tuned PTMs can be easily controlled by backdoor attacks in arbitrary downstream tasks. Specifically, attackers can add a simple pre-training task, which restricts the output representations of trigger instances to pre-defined vectors, namely neuron-level backdoor attack (NeuBA). If the backdoor functionality is not eliminated during fine-tuning, the triggers can make the fine-tuned model predict fixed labels by pre-defined vectors. In the experiments of both natural language processing (NLP) and computer vision (CV), we show that NeuBA absolutely controls the predictions for trigger instances without any knowledge of downstream tasks. Finally, we apply several defense methods to NeuBA and find that model pruning is a promising direction to resist NeuBA by excluding backdoored neurons. Our findings sound a red alarm for the wide use of PTMs. Our source code and models are available at urlhttps://github.com/thunlp/NeuBA.

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Builds on 39 of its 67 references that are in the map. First posted on arXiv 18 Jan 2021.

Builds on

39 of 67 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  8. 2016Densely Connected Convolutional Networkscited by 6,691
  9. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,772
  10. 2015Deep Compression: Compressing Deep Neural Networks with Pruning, Trained Quantization and Huffman Codingcited by 2,291
  11. 2020Extracting Training Data from Large Language Modelscited by 2,144
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
27 more
  1. 2015Aligning Books and Movies: Towards Story-like Visual Explanations by Watching Movies and Reading Bookscited by 1,041
  2. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  3. 2019Analyzing Multi-Head Self-Attention: Specialized Heads Do the Heavy Lifting, the Rest Can Be Prunedcited by 844
  4. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  6. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  7. 2020Backdoor Learning: A Surveycited by 412
  8. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 374
  9. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  10. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  11. 2019Revealing the Dark Secrets of BERTcited by 300
  12. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  13. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 234
  14. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  15. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  16. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  17. 2020Blind Backdoors in Deep Learning Modelscited by 174
  18. 2020Trojaning Language Models for Fun and Profitcited by 80
  19. 2018Model-Reuse Attacks on Deep Learning Systemscited by 47
  20. 2019Word-level Textual Adversarial Attacking as Combinatorial Optimizationcited by 37
  21. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27
  22. 2020Deep Learning Backdoorscited by 19
  23. 2020Natural Backdoor Attack on Text Datacited by 18
  24. 2020Humpty Dumpty: Controlling Word Meanings via Corpus Poisoningcited by 17
  25. 2019A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learningcited by 15
  26. 2017Security Risks in Deep Learning Implementationscited by 12
  27. 2019Programmable Neural Network Trojan for Pre-Trained Feature Extractorcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 6; 2023: 18; 2024: 14; 2025: 1; 2026: 2.

44 papers.

Sort:

By area:

  1. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  2. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  3. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  4. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
  5. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
  6. 2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 56
  7. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  8. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
  9. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  10. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  11. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  12. 2023BAGM: A Backdoor Attack for Manipulating Text-to-Image Generative Modelscited by 37
32 more
  1. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  2. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  3. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 27
  4. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  5. 2023Grounding Foundation Models through Federated Transfer Learning: A General Frameworkcited by 24
  6. 2023Multi-target Backdoor Attacks for Code Pre-trained Modelscited by 19
  7. 2023Watermarking LLMs with Weight Quantizationcited by 19
  8. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  9. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 16
  10. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  11. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  12. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  13. 2024Mutual Information Guided Backdoor Mitigation for Pre-trained Encoderscited by 8
  14. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  15. 2023LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoorscited by 7
  16. 2024Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigmcited by 7
  17. 2023UOR: Universal Backdoor Attacks on Pre-trained Language Modelscited by 6
  18. 2023Punctuation Matters! Stealthy Backdoor Attack for Language Modelscited by 5
  19. 2024Model Supply Chain Poisoning: Backdooring Pre-trained Models via Embedding Indistinguishabilitycited by 5
  20. 2024MEGen: Generative Backdoor into Large Language Models via Model Editingcited by 5
  21. 2024Data-centric NLP Backdoor Defense from the Lens of Memorizationcited by 5
  22. 2024Mudjacking: Patching Backdoor Vulnerabilities in Foundation Modelscited by 4
  23. 2024SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfercited by 4
  24. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 4
  25. 2023AdaptGuard: Defending Against Universal Attacks for Model Adaptationcited by 3
  26. 2022Apple of Sodom: Hidden Backdoors in Superior Sentence Embeddings via Contrastive Learningcited by 2
  27. 2024PromptFix: Few-shot Backdoor Removal via Adversarial Prompt Tuningcited by 2
  28. 2023Seeing Is Not Always Believing: Invisible Collision Attack and Defence on Pre-Trained Modelscited by 0
  29. 2024Single Word Change is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifierscited by 0
  30. 2024Protecting Copyright of Medical Pre-trained Language Models: Training-Free Backdoor Model Watermarkingcited by 0
  31. 2026Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Responsecited by 0
  32. 2026Backdoor Learning in Language Models and Vision-Language Modelscited by 0