mlsanityData to 14 Oct 2026

Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense

arXiv 2202.05749 ↗First posted 11 Feb 2022cs.CL cs.AIcited by 47

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

We develop a novel optimization method for NLPbackdoor inversion. We leverage a dynamically reducing temperature coefficient in the softmax function to provide changing loss landscapes to the optimizer such that the process gradually focuses on the ground truth trigger, which is denoted as a one-hot value in a convex hull. Our method also features a temperature rollback mechanism to step away from local optimals, exploiting the observation that local optimals can be easily deter-mined in NLP trigger inversion (while not in general optimization). We evaluate the technique on over 1600 models (with roughly half of them having injected backdoors) on 3 prevailing NLP tasks, with 4 different backdoor attacks and 7 architectures. Our results show that the technique is able to effectively and efficiently detect and remove backdoors, outperforming 4 baseline methods.

Key facts. Cited by 47 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 39 of its 61 references that are in the map. First posted on arXiv 11 Feb 2022.

Builds on

39 of 61 references.

Closest ancestors · 5

Same direction, newest first

  1. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  2. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  3. 2021Hidden Backdoors in Human-Centric Language Models1 May
  4. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar
  5. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 34

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  5. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  6. 2017On Calibration of Modern Neural Networkscited by 4,960
  7. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
  8. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  9. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,739
  10. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
22 more
  1. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  2. 2020MobileBERT: a Compact Task-Agnostic BERT for Resource-Limited Devicescited by 482
  3. 2018Generating Natural Language Adversarial Examplescited by 424
  4. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  5. 2018AllenNLP: A Deep Semantic Natural Language Processing Platformcited by 347
  6. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  7. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  8. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  9. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  10. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  11. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  12. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  13. 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 163
  14. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
  15. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  16. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
  17. 2017Semi-supervised sequence tagging with bidirectional language modelscited by 86
  18. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 86
  19. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  20. 2021Towards Robustness Against Natural Language Word Substitutionscited by 69
  21. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  22. 2020SubjQA: A Dataset for Subjectivity and Review Comprehensioncited by 24

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 6; 2023: 10; 2024: 11; 2025: 11; 2026: 9.

47 papers.

Sort:

By area:

  1. 2025Thought Crime: Backdoors and Emergent Misalignment in Reasoning Modelscited by 65
  2. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 59
  3. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 53
  4. 2023Exploring the Landscape of Machine Unlearning: A Comprehensive Survey and Taxonomycited by 51
  5. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  6. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  7. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
  8. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  9. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  10. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 37
  11. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  12. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
35 more
  1. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 19
  2. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypotscited by 19
  3. 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Modelscited by 19
  4. 2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judgecited by 18
  5. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 16
  6. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 14
  7. 2024Rapid Optimization for Jailbreaking LLMs via Subconscious Exploitation and Echopraxiacited by 14
  8. 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggerscited by 14
  9. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Modelscited by 13
  10. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  11. 2024CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Modelscited by 13
  12. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 12
  13. 2023LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoorscited by 9
  14. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 9
  15. 2024Acquiring Clean Language Models from Backdoor Poisoned Datasets by Downscaling Frequency Spacecited by 8
  16. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 7
  17. 2024Data-centric NLP Backdoor Defense from the Lens of Memorizationcited by 6
  18. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 5
  19. 2025Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigmcited by 5
  20. 2025Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Modelscited by 3
  21. 2025Rounding-Guided Backdoor Injection in Deep Learning Model Quantizationcited by 3
  22. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  23. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attackscited by 2
  24. 2025From Poisoned to Aware: Fostering Backdoor Self-Awareness in LLMscited by 2
  25. 2025Reformulation is All You Need: Addressing Malicious Text Features in DNNscited by 1
  26. 2026Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Modelscited by 1
  27. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  28. 2025Inverting Trojans in LLMscited by 0
  29. 2025Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Modelscited by 0
  30. 2026Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanningcited by 0
  31. 2026Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Modelscited by 0
  32. 2026CSO-LLM: Class Subspace Orthogonalization for Post-Training Backdoor Detection and Trigger Inversion in LLMscited by 0
  33. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  34. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0
  35. 2026Towards Merging-conditional Backdoor Unalignment against Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024PromptFix: Few-shot Backdoor Removal via Adversarial Prompt Tuning
  2. 2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitution
  3. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining
  4. 2025Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Models
  5. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  6. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  7. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  8. 2023RobustNLP: A Technique to Defend NLP Models Against Backdoor Attacks