Data to 14 Oct 2026

Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer

arXiv 2110.07139 ↗First posted 14 Oct 2021cs.CL cs.AI cs.CRcited by 158

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Adversarial attacks and backdoor attacks are two common security threats that hang over deep learning. Both of them harness task-irrelevant features of data in their implementation. Text style is a feature that is naturally irrelevant to most NLP tasks, and thus suitable for adversarial and backdoor attacks. In this paper, we make the first attempt to conduct adversarial and backdoor attacks based on text style transfer, which is aimed at altering the style of a sentence while preserving its meaning. We design an adversarial attack method and a backdoor attack method, and conduct extensive experiments to evaluate them. Experimental results show that popular NLP models are vulnerable to both adversarial and backdoor attacks based on text style transfer -- the attack success rates can exceed 90% without much effort. It reflects the limited ability of NLP models to handle the feature of text style that has not been widely realized. In addition, the style transfer-based adversarial and backdoor attack methods show superiority to baselines in many aspects. All the code and data of this paper can be obtained at https://github.com/thunlp/StyleAttack.

Key facts. Cited by 158 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 45 of its 65 references that are in the map. First posted on arXiv 14 Oct 2021.

Builds on

45 of 65 references.

Closest ancestors · 2

Same direction, newest first

Other references · 43

2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
2014Explaining and Harnessing Adversarial Examplescited by 7,364
2013Intriguing properties of neural networkscited by 5,155
2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
2015Character-level Convolutional Networks for Text Classificationcited by 2,330
2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
2018Generating Natural Language Adversarial Examplescited by 424

31 more

2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 345
2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
2017Synthetic and Natural Noise Both Break Neural Machine Translationcited by 306
2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 286
2017Toward Controlled Generation of Textcited by 272
2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
2017Style Transfer from Non-Parallel Text by Cross-Alignmentcited by 248
2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
2019A backdoor attack against LSTM-based text classification systemscited by 227
2018Dear Sir or Madam, May I introduce the GYAFC Dataset: Corpus, Benchmarks and Metrics for Formality Style Transfercited by 211
2018Hate Speech Dataset from a White Supremacy Forumcited by 198
2018Delete, Retrieve, Generate: A Simple Approach to Sentiment and Style Transfercited by 191
2017Generating Natural Adversarial Examplescited by 183
2020Reformulating Unsupervised Style Transfer as Paraphrase Generationcited by 183
2017Style Transfer in Text: Exploration and Evaluationcited by 146
2018Disentangled Representation Learning for Non-Parallel Text Style Transfercited by 127
2018Style Transfer Through Back-Translationcited by 124
2017Deceiving Google's Perspective API Built for Detecting Toxic Commentscited by 102
2019Text Processing Like Humans Do: Visually Attacking and Shielding NLP Systemscited by 101
2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 86
2019Style Transformer: Unpaired Text Style Transfer without Disentangled Latent Representationcited by 84
2019Transforming Delete, Retrieve, Generate Approach for Controlled Text Style Transfercited by 81
2018Unsupervised Text Style Transfer using Language Models as Discriminatorscited by 70
2020A Probabilistic Formulation of Unsupervised Text Style Transfercited by 70
2019A Dual Reinforcement Learning Framework for Unsupervised Text Style Transfercited by 65
2018Unpaired Sentiment-to-Sentiment Translation: A Cycled Reinforcement Learning Approachcited by 55
2020CAT-Gen: Improving Robustness in NLP Models via Controlled Adversarial Text Generationcited by 44
2019Reinforcement Learning Based Text Style Transfer without Parallel Training Corpuscited by 38
2018SHAPED: Shared-Private Encoder-Decoder for Text Style Adaptationcited by 11
2020Learning to Attack: Towards Textual Adversarial Attacking in Real-world Situationscited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 22; 2023: 33; 2024: 48; 2025: 32; 2026: 21.

158 papers.

Sort:

By area:

2025Memory Injection Attacks on LLM Agents via Query-Only Interactioncited by 144
2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 110
2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
2022Shortcut Learning of Large Language Models in Natural Language Understandingcited by 85
2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 80
2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 74
2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 72
2023Large Language Models Can be Lazy Learners: Analyze Shortcuts in In-Context Learningcited by 69
2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 63
2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 57
2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 53

38 more

2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 51
2023Stealthy Backdoor Attack for Code Modelscited by 49
2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 49
2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
2024Robustifying Safety-Aligned Large Language Models through Clean Data Curationcited by 44
2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 37
2024Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Datacited by 35
2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attackscited by 33
2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Modelscited by 33
2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 31
2023The Trickle-down Impact of Reward (In-)consistency on RLHFcited by 29
2021Bridge the Gap Between CV and NLP! A Gradient-based Textual Adversarial Attack Frameworkcited by 28
2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 28
2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 28
2023Watermarking Text Data on Large Language Models for Dataset Copyrightcited by 27
2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 27
2022Kallima: A Clean-label Framework for Textual Backdoor Attackscited by 24
2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
2024Task-Agnostic Detector for Insertion-Based Backdoor Attackscited by 23
2022Going In Style: Audio Backdoors Through Stylistic Transformationscited by 21
2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 21
2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 21
2023A Survey on Out-of-Distribution Evaluation of Neural NLP Modelscited by 20
2024When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanationscited by 20
2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 19
2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 19
2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypotscited by 19
2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Modelscited by 19
2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Trickscited by 18
2023How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attackscited by 18
2024BACKTIME: Backdoor Attacks on Multivariate Time Series Forecastingcited by 18
2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judgecited by 18
2025Adversarial Training of Reward Modelscited by 18

50 most cited of 158 All 158 (JSON)

Similar, not cited

Close in wording, no citation either way