mlsanityData to 14 Oct 2026

Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning

arXiv 2108.13888 ↗First posted 31 Aug 2021cs.CR cs.CLcited by 113

Not on the map. Why?

Cited by 73 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Pre-Trained Models have been widely applied and recently proved vulnerable under backdoor attacks: the released pre-trained weights can be maliciously poisoned with certain triggers. When the triggers are activated, even the fine-tuned model will predict pre-defined labels, causing a security threat. These backdoors generated by the poisoning methods can be erased by changing hyper-parameters during fine-tuning or detected by finding the triggers. In this paper, we propose a stronger weight-poisoning attack method that introduces a layerwise weight poisoning strategy to plant deeper backdoors; we also introduce a combinatorial trigger that cannot be easily detected. The experiments on text classification tasks show that previous defense methods cannot resist our weight-poisoning method, which indicates that our method can be widely applied and may provide hints for future model robustness studies.

Key facts. Cited by 113 papers in the map (data through 14 Oct 2026). Builds on 29 of its 44 references that are in the map. First posted on arXiv 31 Aug 2021.

Builds on

29 of 44 references.

References · 29

  1. 2017Attention Is All You Needcited by 60,361
  2. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  3. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
  7. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  8. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,811
  9. 2013Visualizing and Understanding Convolutional Networkscited by 2,290
  10. 2018Deep contextualized word representationscited by 2,290
  11. 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
17 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  2. 2019What Does BERT Look At? An Analysis of BERT's Attentioncited by 1,003
  3. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  4. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  5. 2020Pre-trained Models for Natural Language Processing: A Surveycited by 505
  6. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  7. 2019What do you learn from context? Probing for sentence structure in contextualized word representationscited by 438
  8. 2021A Survey of Transformerscited by 401
  9. 2019Hidden Trigger Backdoor Attackscited by 371
  10. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  11. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  12. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  13. 2015Semi-supervised Sequence Learningcited by 198
  14. 2017Neural Trojanscited by 153
  15. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 105
  16. 2020Rethinking the Trigger of Backdoor Attackcited by 77
  17. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 10; 2023: 29; 2024: 37; 2025: 23; 2026: 12.

113 papers.

Sort:

By area:

  1. 2023Large Language Model Alignment: A Surveycited by 243
  2. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  3. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 137
  4. 2024BadEdit: Backdooring large language models by model editingcited by 96
  5. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 94
  6. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 85
  7. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 80
  8. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 74
  9. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Modelscited by 67
  10. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 66
  11. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 63
  12. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
38 more
  1. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 57
  2. 2023SeqXGPT: Sentence-Level AI-Generated Text Detectioncited by 56
  3. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learningcited by 53
  4. 2022Watermarking Pre-trained Language Models with Backdooringcited by 50
  5. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  6. 2023A Comprehensive Overview of Backdoor Attacks in Large Language Models within Communication Networkscited by 42
  7. 2023Origin Tracing and Detecting of LLMscited by 40
  8. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  9. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  10. 2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attackscited by 33
  11. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  12. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 31
  13. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 31
  14. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 28
  15. 2023Watermarking Text Data on Large Language Models for Dataset Copyrightcited by 27
  16. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 27
  17. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 26
  18. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 25
  19. 2023Defending against Insertion-based Textual Backdoor Attacks via Attributioncited by 25
  20. 2023Watermarking LLMs with Weight Quantizationcited by 22
  21. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Modelscited by 22
  22. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 21
  23. 2025A Survey on Privacy Risks and Protection in Large Language Modelscited by 21
  24. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  25. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 19
  26. 2023Stealing the Decoding Algorithms of Language Modelscited by 19
  27. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 19
  28. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 16
  29. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  30. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 16
  31. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  32. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 14
  33. 2024Has this Fact been Edited? Detecting Knowledge Edits in Language Modelscited by 14
  34. 2025Scalable Fingerprinting of Large Language Modelscited by 14
  35. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 14
  36. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 13
  37. 2024Uncertainty is Fragile: Manipulating Uncertainty in Large Language Modelscited by 13
  38. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 12

50 most cited of 113 All 113 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2022Detecting Backdoors in Deep Text Classifiers
  2. 2021Excess Capacity and Backdoor Poisoning
  3. 2024Poisoning-based Backdoor Attacks for Arbitrary Target Label with Positive Triggers
  4. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks
  5. 2026Why Backdooring Neural Networks is so Easy?
  6. 2024A Study of Backdoors in Instruction Fine-tuned Language Models
  7. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers
  8. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions