mlsanityData to 7 Oct 2026

BITE: Textual Backdoor Attacks with Iterative Trigger Injection

arXiv 2205.12700 ↗First posted 25 May 2022cs.CLcited by 47

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks have become an emerging threat to NLP systems. By providing poisoned training data, the adversary can embed a "backdoor" into the victim model, which allows input instances satisfying certain textual patterns (e.g., containing a keyword) to be predicted as a target label of the adversary's choice. In this paper, we demonstrate that it is possible to design a backdoor attack that is both stealthy (i.e., hard to notice) and effective (i.e., has a high attack success rate). We propose BITE, a backdoor attack that poisons the training data to establish strong correlations between the target label and a set of "trigger words". These trigger words are iteratively identified and injected into the target-label instances through natural word-level perturbations. The poisoned training data instruct the victim model to predict the target label on inputs containing trigger words, forming the backdoor. Experiments on four text classification datasets show that our proposed attack is significantly more effective than baseline methods while maintaining decent stealthiness, raising alarm on the usage of untrusted training data. We further propose a defense method named DeBITE based on potential trigger word removal, which outperforms existing methods in defending against BITE and generalizes well to handling other backdoor attacks.

Key facts. Cited by 47 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 39 of its 67 references that are in the map. First posted on arXiv 25 May 2022.

Builds on

39 of 67 references.

Closest ancestors · 8

Same direction, newest first

  1. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb
  2. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks15 Oct
  3. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  4. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  5. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  6. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  7. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar
  8. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 31

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  5. 2020Extracting Training Data from Large Language Modelscited by 2,144
  6. 2018Neural Network Acceptability Judgmentscited by 952
  7. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  8. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  9. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  10. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  11. 2018Universal Sentence Encodercited by 485
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
19 more
  1. 2020BAE: BERT-based Adversarial Examples for Text Classificationcited by 316
  2. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  3. 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 282
  4. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  5. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  6. 2018Hate Speech Dataset from a White Supremacy Forumcited by 196
  7. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  8. 2020Reformulating Unsupervised Style Transfer as Paraphrase Generationcited by 181
  9. 2020Deep Learning for Text Style Transfer: A Surveycited by 161
  10. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  11. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  12. 2021Competency Problems: On Finding and Removing Artifacts in Language Datacited by 91
  13. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  14. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  15. 2022Generating Data to Mitigate Spurious Correlations in Natural Language Inference Datasetscited by 54
  16. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  17. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27
  18. 2020Natural Backdoor Attack on Text Datacited by 18
  19. 2020A systematic literature review on machine learning applications for consumer sentiment analysis using online reviewscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 8; 2024: 19; 2025: 12; 2026: 8.

47 papers.

Sort:

By area:

  1. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  2. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
  3. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  4. 2024Best-of-Venom: Attacking RLHF by Injecting Poisoned Preference Datacited by 33
  5. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  6. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 27
  7. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  8. 2024How Susceptible are Large Language Models to Ideological Manipulation?cited by 26
  9. 2024A Trembling House of Cards? Mapping Adversarial Attacks against Language Agentscited by 22
  10. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
  11. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 21
  12. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 20
35 more
  1. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
  2. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 19
  3. 2024When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanationscited by 16
  4. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 15
  5. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  6. 2024Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Controlcited by 8
  7. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 8
  8. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  9. 2024Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigmcited by 7
  10. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 6
  11. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 6
  12. 2024Backdoor Attack on Multilingual Machine Translationcited by 5
  13. 2025Be Careful When Fine-tuning On Open-Source LLMs: Your Fine-tuning Data Could Be Secretly Stolen!cited by 5
  14. 2025Pruning Strategies for Backdoor Defense in LLMscited by 4
  15. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoorcited by 3
  16. 2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
  17. 2025Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Modelscited by 3
  18. 2023Efficient Trigger Word Insertioncited by 2
  19. 2025NLP Security and Ethics, in the Wildcited by 2
  20. 2025The Ultimate Cookbook for Invisible Poison: Crafting Subtle Clean-Label Text Backdoors with Style Attributescited by 2
  21. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Modelscited by 2
  22. 2024Defense Against Syntactic Textual Backdoor Attacks with Token Substitutioncited by 1
  23. 2025Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Modelscited by 1
  24. 2025GREAT: Generalizable Backdoor Attacks in RLHF via Emotion-Aware Trigger Synthesiscited by 1
  25. 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMscited by 1
  26. 2024Single Word Change is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifierscited by 0
  27. 2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitutioncited by 0
  28. 2025Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classificationcited by 0
  29. 2025Defeating Cerberus: Concept-Guided Privacy-Leakage Mitigation in Multimodal Language Modelscited by 0
  30. 2025Perturb Your Data: Paraphrase-Guided Training Data Watermarkingcited by 0
  31. 2026Delayed Backdoor Attacks: Exploring the Temporal Dimension as a New Attack Surface in Pre-Trained Modelscited by 0
  32. 2026Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoorscited by 0
  33. 2026Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMscited by 0
  34. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  35. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0