mlsanityData to 14 Oct 2026

Putting words into the system's mouth: A targeted attack on neural machine translation using monolingual data poisoning

arXiv 2107.05243 ↗First posted 12 Jul 2021cs.CL cs.CRcited by 21

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Neural machine translation systems are known to be vulnerable to adversarial test inputs, however, as we show in this paper, these systems are also vulnerable to training attacks. Specifically, we propose a poisoning attack in which a malicious adversary inserts a small poisoned sample of monolingual text into the training set of a system trained using back-translation. This sample is designed to induce a specific, targeted translation behaviour, such as peddling misinformation. We present two methods for crafting poisoned examples, and show that only a tiny handful of instances, amounting to only 0.02% of the training set, is sufficient to enact a successful attack. We outline a defence method against said attacks, which partly ameliorates the problem. However, we stress that this is a blind-spot in modern NMT, demanding immediate attention.

Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 23 of its 34 references that are in the map. First posted on arXiv 12 Jul 2021.

Builds on

23 of 34 references.

References · 23

  1. 2017Attention Is All You Needcited by 60,361
  2. 2014Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translationcited by 4,057
  3. 2014Sequence to Sequence Learning with Neural Networkscited by 2,986
  4. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,918
  5. 2018A Call for Clarity in Reporting BLEU Scorescited by 1,799
  6. 2019fairseq: A Fast, Extensible Toolkit for Sequence Modelingcited by 1,488
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2015Improving Neural Machine Translation Models with Monolingual Datacited by 788
  10. 2019CCNet: Extracting High Quality Monolingual Datasets from Web Crawl Datacited by 548
  11. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  12. 2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 306
11 more
  1. 2017Certified Defenses for Data Poisoning Attackscited by 303
  2. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  3. 2019WikiMatrix: Mining 135M Parallel Sentences in 1620 Language Pairs from Wikipediacited by 223
  4. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 197
  5. 2019Facebook FAIR's WMT19 News Translation Task Submissioncited by 179
  6. 2019CCAligned: A Massive Collection of Cross-Lingual Web-Document Pairscited by 136
  7. 2018On Adversarial Examples for Character-Level Neural Machine Translationcited by 85
  8. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 81
  9. 2018Towards Robust Neural Machine Translationcited by 35
  10. 2020Concealed Data Poisoning Attacks on NLP Modelscited by 14
  11. 2020A Targeted Attack on Black-Box Neural Machine Translation with Parallel Data Poisoningcited by 4

Built on by

Cited by year

Citing papers per year: 2021: 2; 2022: 2; 2023: 10; 2024: 6; 2025: 1.

21 papers.

Sort:

By area:

  1. 2023The unreasonable effectiveness of few-shot learning for machine translationcited by 91
  2. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarkscited by 76
  3. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  4. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 66
  5. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  6. 2023Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attackscited by 33
  7. 2023RLHFPoison: Reward Poisoning Attack for Reinforcement Learning with Human Feedback in Large Language Modelscited by 32
  8. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 15
  9. 2024TuBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuningcited by 14
  10. 2023TransFool: An Adversarial Attack against Neural Machine Translation Modelscited by 12
  11. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 12
  12. 2023Error Norm Truncation: Robust Training in the Presence of Data Noise for Text Generation Modelscited by 6
9 more
  1. 2024Poisoning Programs by Un-Repairing Code: Security Concerns of AI-generated Codecited by 6
  2. 2024Backdoor Attack on Multilingual Machine Translationcited by 5
  3. 2024AdvBDGen: Adversarially Fortified Prompt-Specific Fuzzy Backdoor Generator Against LLM Alignmentcited by 5
  4. 2023Is the U.S. Legal System Ready for AI's Challenges to Human Values?cited by 2
  5. 2024Clean Label Attacks against SLU Systemscited by 2
  6. 2023Mithridates: Auditing and Boosting Backdoor Resistance of Machine Learning Pipelinescited by 1
  7. 2022Detecting Backdoors in Deep Text Classifierscited by 0
  8. 2024Manipulating Predictions over Discrete Inputs in Machine Teachingcited by 0
  9. 2025Char-mander Use mBackdoor! A Study of Cross-lingual Backdoor Attacks in Multilingual LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Forcing Generative Models to Degenerate Ones: The Power of Data Poisoning Attacks
  2. 2024Scaling Behavior of Machine Translation with Large Language Models under Prompt Injection Attacks
  3. 2024Automatic and Universal Prompt Injection Attacks against Large Language Models
  4. 2026Lost in Translation? A Comparative Study on the Cross-Lingual Transfer of Composite Harms
  5. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models
  6. 2024Learning to Poison Large Language Models for Downstream Manipulation
  7. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples
  8. 2021Defending Against Backdoor Attacks in Natural Language Generation