mlsanityData to 7 Oct 2026

WeDef: Weakly Supervised Backdoor Defense for Text Classification

arXiv 2205.11803 ↗First posted 24 May 2022cs.CL cs.AIcited by 12

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Existing backdoor defense methods are only effective for limited trigger types. To defend different trigger types at once, we start from the class-irrelevant nature of the poisoning process and propose a novel weakly supervised backdoor defense framework WeDef. Recent advances in weak supervision make it possible to train a reasonably accurate text classifier using only a small number of user-provided, class-indicative seed words. Such seed words shall be considered independent of the triggers. Therefore, a weakly supervised text classifier trained by only the poisoned documents without their labels will likely have no backdoor. Inspired by this observation, in WeDef, we define the reliability of samples based on whether the predictions of the weak classifier agree with their labels in the poisoned training set. We further improve the results through a two-phase sanitization: (1) iteratively refine the weak classifier based on the reliable samples and (2) train a binary poison classifier by distinguishing the most unreliable samples from the most reliable samples. Finally, we train the sanitized model on the samples that the poison classifier predicts as benign. Extensive experiments show that WeDefis effective against popular trigger-based attacks (e.g., words, sentences, and paraphrases), outperforming existing defense methods.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 19 of its 26 references that are in the map. First posted on arXiv 24 May 2022.

Builds on

19 of 26 references.

Closest ancestors · 4

Same direction, newest first

  1. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  2. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks15 Oct
  3. 2021BFClass: A Backdoor-free Text Classification Framework22 Sep
  4. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 15

  1. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  2. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  3. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  4. 2020Backdoor Learning: A Surveycited by 412
  5. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  6. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  7. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  8. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  9. 2017Neural Trojanscited by 151
  10. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  11. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  12. 2018Weakly-Supervised Neural Text Classificationcited by 66
3 more
  1. 2019CrossWeigh: Training Named Entity Tagger from Imperfect Annotationscited by 60
  2. 2020X-Class: Text Classification with Extremely Weak Supervisioncited by 45
  3. 2021"Average" Approximates "First Principal Component"? An Empirical Analysis on Representations from Neural Language Modelscited by 4

Built on by

Cited by year

Citing papers per year: 2023: 3; 2024: 8; 2025: 1.

12 papers.

  1. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  2. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  3. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 20
  4. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  5. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 15
  6. 2023TIJO: Trigger Inversion with Joint Optimization for Defending Multimodal Backdoored Modelscited by 11
  7. 2024Acquiring Clean Language Models from Backdoor Poisoned Datasets by Downscaling Frequency Spacecited by 6
  8. 2024Two Heads are Better than One: Nested PoE for Robust Defense Against Multi-Backdoorscited by 6
  9. 2024Incubating Text Classifiers Following User Instruction with Nothing but LLMcited by 6
  10. 2024Data-centric NLP Backdoor Defense from the Lens of Memorizationcited by 5
  11. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retrainingcited by 5
  12. 2025NLP Security and Ethics, in the Wildcited by 2