mlsanityData to 7 Oct 2026

Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks

arXiv 2110.08247 ↗First posted 15 Oct 2021cs.CR cs.AI cs.CLcited by 17

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks are a kind of emergent security threat in deep learning. After being injected with a backdoor, a deep neural model will behave normally on standard inputs but give adversary-specified predictions once the input contains specific backdoor triggers. In this paper, we find two simple tricks that can make existing textual backdoor attacks much more harmful. The first trick is to add an extra training task to distinguish poisoned and clean data during the training of the victim model, and the second one is to use all the clean training data rather than remove the original clean data corresponding to the poisoned data. These two tricks are universally applicable to different attack models. We conduct experiments in three tough situations including clean data fine-tuning, low-poisoning-rate, and label-consistent attacks. Experimental results show that the two tricks can significantly improve attack performance. This paper exhibits the great potential harmfulness of backdoor attacks. All the code and data can be obtained at urlhttps://github.com/thunlp/StyleAttack.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 17 of its 29 references that are in the map. First posted on arXiv 15 Oct 2021.

Builds on

17 of 29 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  2. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 15

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  3. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  5. 2020Backdoor Learning: A Surveycited by 412
  6. 2019A Survey of Deep Learning Techniques for Autonomous Drivingcited by 401
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  9. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  10. 2018Hate Speech Dataset from a White Supremacy Forumcited by 196
  11. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  12. 2015DeepID3: Face Recognition with Very Deep Neural Networkscited by 62
3 more
  1. 2019Model Agnostic Defence against Backdoor Attacks in Machine Learningcited by 52
  2. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 50
  3. 2021Hidden Backdoor Attack against Semantic Segmentation Modelscited by 19

Built on by

Cited by year

Citing papers per year: 2022: 5; 2023: 2; 2024: 6; 2025: 4.

17 papers.

Sort:

By area:

  1. 2023Large Language Model Alignment: A Surveycited by 241
  2. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  3. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  4. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  5. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  6. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  7. 2022WeDef: Weakly Supervised Backdoor Defense for Text Classificationcited by 12
  8. 2023Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Textcited by 8
  9. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5
  10. 2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggerscited by 5
  11. 2024Enhancing Cross-Prompt Transferability in Vision-Language Models through Contextual Injection of Target Tokenscited by 4
  12. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoorcited by 3
5 more
  1. 2025NLP Security and Ethics, in the Wildcited by 2
  2. 2025The Ultimate Cookbook for Invisible Poison: Crafting Subtle Clean-Label Text Backdoors with Style Attributescited by 2
  3. 2025Large Language Models Can Verbatim Reproduce Long Malicious Sequencescited by 1
  4. 2024Shortcuts Arising from Contrast: Effective and Covert Clean-Label Attacks in Prompt-Based Learningcited by 0
  5. 2025Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classificationcited by 0