mlsanityData to 7 Oct 2026

BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models

arXiv 2110.02467 ↗First posted 6 Oct 2021cs.CL cs.AIcited by 76

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Pre-trained Natural Language Processing (NLP) models can be easily adapted to a variety of downstream language tasks. This significantly accelerates the development of language models. However, NLP models have been shown to be vulnerable to backdoor attacks, where a pre-defined trigger word in the input text causes model misprediction. Previous NLP backdoor attacks mainly focus on some specific tasks. This makes those attacks less general and applicable to other kinds of NLP models and tasks. In this work, we propose Name, the first task-agnostic backdoor attack against the pre-trained NLP models. The key feature of our attack is that the adversary does not need prior information about the downstream tasks when implanting the backdoor to the pre-trained model. When this malicious model is released, any downstream models transferred from it will also inherit the backdoor, even after the extensive transfer learning process. We further design a simple yet effective strategy to bypass a state-of-the-art defense. Experimental results indicate that our approach can compromise a wide range of downstream NLP tasks in an effective and stealthy way.

Key facts. Cited by 76 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 24 of its 36 references that are in the map. First posted on arXiv 6 Oct 2021.

Builds on

24 of 36 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  2. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 22

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  5. 2013Efficient Estimation of Word Representations in Vector Spacecited by 4,346
  6. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,115
  7. 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
  8. 2018Deep contextualized word representationscited by 2,285
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2019BERT Rediscovers the Classical NLP Pipelinecited by 1,046
  11. 2015Aligning Books and Movies: Towards Story-like Visual Explanations by Watching Movies and Reading Bookscited by 1,041
  12. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
10 more
  1. 2020Backdoor Learning: A Surveycited by 412
  2. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  3. 2019A Multiscale Visualization of Attention in the Transformer Modelcited by 292
  4. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  5. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  6. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  7. 2017Neural Trojanscited by 151
  8. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  9. 2020Trojaning Language Models for Fun and Profitcited by 80
  10. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 51

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 4; 2023: 31; 2024: 26; 2025: 8; 2026: 4.

76 papers.

Sort:

By area:

  1. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  2. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 106
  3. 2024BadEdit: Backdooring large language models by model editingcited by 84
  4. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  5. 2023GPTEval: A Survey on Assessments of ChatGPT and GPT-4cited by 73
  6. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  7. 2023Composite Backdoor Attacks Against Large Language Modelscited by 63
  8. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  9. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
  10. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  11. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  12. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
38 more
  1. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  2. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applicationscited by 36
  3. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  4. 2024Hey, That's My Model! Introducing Chain & Hash, An LLM Fingerprinting Techniquecited by 34
  5. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  6. 2023Foundation Models for Weather and Climate Data Understanding: A Comprehensive Surveycited by 32
  7. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 32
  8. 2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 29
  9. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  10. 2023Integration of Large Language Models and Federated Learningcited by 28
  11. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  12. 2024Purifying Large Language Models by Ensembling a Small Language Modelcited by 25
  13. 2023Grounding Foundation Models through Federated Transfer Learning: A General Frameworkcited by 24
  14. 2023Stealing the Decoding Algorithms of Language Modelscited by 19
  15. 2023Backdoor Learning on Sequence to Sequence Modelscited by 19
  16. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
  17. 2023Multi-target Backdoor Attacks for Code Pre-trained Modelscited by 19
  18. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 18
  19. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  20. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  21. 2024Cross-Context Backdoor Attacks against Graph Prompt Learningcited by 14
  22. 2023Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learningcited by 13
  23. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 12
  24. 2024Quantized Delta Weight Is Safety Keepercited by 12
  25. 2023Two-in-One: A Model Hijacking Attack Against Text Generation Modelscited by 11
  26. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 11
  27. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  28. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 10
  29. 2024The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputscited by 10
  30. 2023Forcing Generative Models to Degenerate Ones: The Power of Data Poisoning Attackscited by 9
  31. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  32. 2024Turning Generative Models Degenerate: The Power of Data Poisoning Attackscited by 9
  33. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  34. 2023LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoorscited by 7
  35. 2024Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigmcited by 7
  36. 2023UOR: Universal Backdoor Attacks on Pre-trained Language Modelscited by 6
  37. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  38. 2024Identifying Backdoored Graphs in Graph Neural Network Training: An Explanation-Based Approach with Novel Metricscited by 6

50 most cited of 76 All 76 (JSON)