mlsanityData to 7 Oct 2026

Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution

arXiv 2106.06361 ↗First posted 11 Jun 2021cs.CL cs.CRcited by 85

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Recent studies show that neural natural language processing (NLP) models are vulnerable to backdoor attacks. Injected with backdoors, models perform normally on benign examples but produce attacker-specified predictions when the backdoor is activated, presenting serious security threats to real-world applications. Since existing textual backdoor attacks pay little attention to the invisibility of backdoors, they can be easily detected and blocked. In this work, we present invisible backdoors that are activated by a learnable combination of word substitution. We show that NLP models can be injected with backdoors that lead to a nearly 100% attack success rate, whereas being highly invisible to existing defense strategies and even human inspections. The results raise a serious alarm to the security of NLP models, which requires further research to be resolved. All the data and code of this paper are released at https://github.com/thunlp/BkdAtk-LWS.

Key facts. Cited by 85 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 49 references that are in the map. First posted on arXiv 11 Jun 2021.

Builds on

31 of 49 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 30

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
  3. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  6. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  7. 2018Spectral Signatures in Backdoor Attackscited by 457
  8. 2018Generating Natural Language Adversarial Examplescited by 422
  9. 2019Hidden Trigger Backdoor Attackscited by 359
  10. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  11. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
18 more
  1. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  2. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  3. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  4. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  5. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  6. 2017Neural Trojanscited by 151
  7. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  8. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  9. 2020How Does NLP Benefit Legal System: A Summary of Legal Artificial Intelligencecited by 128
  10. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  11. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  12. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  13. 2020Generating Fluent Adversarial Examples for Natural Languagescited by 49
  14. 2020Towards Probabilistic Verification of Machine Unlearningcited by 46
  15. 2019OpenHowNet: An Open Sememe-based Lexical Knowledge Basecited by 21
  16. 2018Neural Lattice Language Modelscited by 13
  17. 2019Modeling Semantic Compositionality with Sememe Knowledgecited by 8
  18. 2017Neural Machine Translation with Gumbel-Greedy Decodingcited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 6; 2022: 19; 2023: 23; 2024: 24; 2025: 8; 2026: 5.

85 papers.

Sort:

By area:

  1. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  2. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  3. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  4. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 87
  5. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  6. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  7. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  8. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
  9. 2024Semantic Mirror Jailbreak: Genetic Algorithm Based Jailbreak Prompts Against Open-source LLMscited by 48
  10. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  11. 2023TrojanPuzzle: Covertly Poisoning Code-Suggestion Modelscited by 47
  12. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 44
38 more
  1. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  2. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  3. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  4. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  5. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shiftcited by 31
  6. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 29
  7. 2023TrojLLM: A Black-box Trojan Prompt Attack on Large Language Modelscited by 29
  8. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  9. 2023Defending against Insertion-based Textual Backdoor Attacks via Attributioncited by 24
  10. 2022Kallima: A Clean-label Framework for Textual Backdoor Attackscited by 22
  11. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
  12. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Modelscited by 21
  13. 2023Backdoor Learning on Sequence to Sequence Modelscited by 19
  14. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
  15. 2022BagFlip: A Certified Defense against Data Poisoningcited by 18
  16. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 16
  17. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  18. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  19. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  20. 2023Backdooring Neural Code Searchcited by 13
  21. 2024Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggerscited by 13
  22. 2024TuBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuningcited by 13
  23. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 12
  24. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 12
  25. 2024Exploring Backdoor Vulnerabilities of Chat Modelscited by 11
  26. 2024CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Modelscited by 11
  27. 2022QuoteR: A Benchmark of Quote Recommendation for Writingcited by 10
  28. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 10
  29. 2024The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputscited by 10
  30. 2023Forcing Generative Models to Degenerate Ones: The Power of Data Poisoning Attackscited by 9
  31. 2024Turning Generative Models Degenerate: The Power of Data Poisoning Attackscited by 9
  32. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  33. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 8
  34. 2022Poison Attack and Defense on Deep Source Code Processing Modelscited by 8
  35. 2024CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggerscited by 8
  36. 2022PBSM: Backdoor attack against Keyword spotting based on pitch boosting and sound maskingcited by 6
  37. 2022VSVC: Backdoor attack against Keyword Spotting based on Voiceprint Selection and Voice Conversioncited by 6
  38. 2023UOR: Universal Backdoor Attacks on Pre-trained Language Modelscited by 6

50 most cited of 85 All 85 (JSON)