mlsanityData to 7 Oct 2026

RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models

arXiv 2110.07831 ↗First posted 15 Oct 2021cs.CL cs.LGcited by 97

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks, which maliciously control a well-trained model's outputs of the instances with specific triggers, are recently shown to be serious threats to the safety of reusing deep neural networks (DNNs). In this work, we propose an efficient online defense mechanism based on robustness-aware perturbations. Specifically, by analyzing the backdoor training process, we point out that there exists a big gap of robustness between poisoned and clean samples. Motivated by this observation, we construct a word-based robustness-aware perturbation to distinguish poisoned samples from clean samples to defend against the backdoor attacks on natural language processing (NLP) models. Moreover, we give a theoretical analysis about the feasibility of our robustness-aware perturbation-based defense method. Experimental results on sentiment analysis and toxic detection tasks show that our method achieves better defending performance and much lower computational costs than existing online defense methods. Our code is available at https://github.com/lancopku/RAP.

Key facts. Cited by 97 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 34 of its 48 references that are in the map. First posted on arXiv 15 Oct 2021.

Builds on

34 of 48 references.

Closest ancestors · 4

Same direction, newest first

  1. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  2. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  3. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar
  4. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 30

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  5. 2016Pointer Sentinel Mixture Modelscited by 2,992
  6. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2016Universal adversarial perturbationscited by 774
  10. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  12. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
18 more
  1. 2019Hidden Trigger Backdoor Attackscited by 359
  2. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  3. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  4. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  5. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  6. 2018Large Scale Crowdsourcing and Characterization of Twitter Abusive Behaviorcited by 265
  7. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  8. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  9. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  10. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  11. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  12. 2020Trojaning Language Models for Fun and Profitcited by 80
  13. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  14. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  15. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 51
  16. 2020Universal Adversarial Attacks with Natural Triggers for Text Classificationcited by 50
  17. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27
  18. 2020Natural Backdoor Attack on Text Datacited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 13; 2023: 21; 2024: 32; 2025: 23; 2026: 8.

97 papers.

Sort:

By area:

  1. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  2. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 135
  3. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
  4. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  5. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  6. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
  7. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  8. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  9. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  10. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  11. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  12. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
38 more
  1. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  2. 2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attackscited by 32
  3. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  4. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 29
  5. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  6. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  7. 2023Defending against Insertion-based Textual Backdoor Attacks via Attributioncited by 24
  8. 2024Task-Agnostic Detector for Insertion-Based Backdoor Attackscited by 23
  9. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 20
  10. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Modelscited by 20
  11. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
  12. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 19
  13. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 18
  14. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 16
  15. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypotscited by 16
  16. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  17. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 15
  18. 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Modelscited by 15
  19. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifierscited by 14
  20. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  21. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  22. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  23. 2023BDMMT: Backdoor Sample Detection for Language Models through Model Mutation Testingcited by 13
  24. 2024Defending Text-to-image Diffusion Models: Surprising Efficacy of Textual Perturbations Against Backdoor Attackscited by 12
  25. 2025UniGuardian: A Unified Defense for Detecting Prompt Injection, Backdoor Attacks and Adversarial Attacks in Large Language Modelscited by 12
  26. 2025Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agentscited by 12
  27. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 11
  28. 2024Exploring Backdoor Vulnerabilities of Chat Modelscited by 11
  29. 2024Simulate and Eliminate: Revoke Backdoors for Generative Large Language Modelscited by 11
  30. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 10
  31. 2023Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systemscited by 10
  32. 2024Exploring Vulnerabilities and Protections in Large Language Models: A Surveycited by 10
  33. 2023TrojFSP: Trojan Insertion in Few-shot Prompt Tuningcited by 9
  34. 2022Dim-Krum: Backdoor-Resistant Federated Learning for NLP with Dimension-wise Krum-Based Aggregationcited by 8
  35. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variationcited by 8
  36. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 8
  37. 2025LLM Security: Vulnerabilities, Attacks, Defenses, and Countermeasurescited by 8
  38. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8

50 most cited of 97 All 97 (JSON)