mlsanityData to 7 Oct 2026

Kallima: A Clean-label Framework for Textual Backdoor Attacks

arXiv 2206.01832 ↗First posted 3 Jun 2022cs.CR cs.CLcited by 22

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Although Deep Neural Network (DNN) has led to unprecedented progress in various natural language processing (NLP) tasks, research shows that deep models are extremely vulnerable to backdoor attacks. The existing backdoor attacks mainly inject a small number of poisoned samples into the training dataset with the labels changed to the target one. Such mislabeled samples would raise suspicion upon human inspection, potentially revealing the attack. To improve the stealthiness of textual backdoor attacks, we propose the first clean-label framework Kallima for synthesizing mimesis-style backdoor samples to develop insidious textual backdoor attacks. We modify inputs belonging to the target class with adversarial perturbations, making the model rely more on the backdoor trigger. Our framework is compatible with most existing backdoor triggers. The experimental results on three benchmark datasets demonstrate the effectiveness of the proposed method.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 29 of its 34 references that are in the map. First posted on arXiv 3 Jun 2022.

Builds on

29 of 34 references.

Closest ancestors · 5

Same direction, newest first

  1. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  2. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  3. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  4. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  5. 2021Hidden Backdoors in Human-Centric Language Models1 May

Other references · 24

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  3. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,530
  4. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  5. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,772
  6. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  7. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  8. 2018Know What You Don't Know: Unanswerable Questions for SQuADcited by 1,538
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2015Improving Neural Machine Translation Models with Monolingual Datacited by 784
  11. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
  12. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
12 more
  1. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 376
  2. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  3. 2019Label-Consistent Backdoor Attackscited by 285
  4. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  5. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  6. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  7. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  8. 2020Trojaning Language Models for Fun and Profitcited by 80
  9. 2019Membership Inference Attacks on Sequence-to-Sequence Models: Is My Data In Your Machine Translation System?cited by 68
  10. 2020Parallel Data Augmentation for Formality Style Transfercited by 39
  11. 2019Fine-grained Sentiment Classification using BERTcited by 38
  12. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 6; 2024: 7; 2025: 5; 2026: 3.

22 papers.

Sort:

By area:

  1. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 91
  2. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 87
  3. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 29
  4. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  5. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  6. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifierscited by 14
  7. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  8. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  9. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variationcited by 8
  10. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  11. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 6
  12. 2024SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfercited by 4
10 more
  1. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 4
  2. 2023Efficient Trigger Word Insertioncited by 2
  3. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attackscited by 2
  4. 2024Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMscited by 2
  5. 2025The Ultimate Cookbook for Invisible Poison: Crafting Subtle Clean-Label Text Backdoors with Style Attributescited by 2
  6. 2025Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Modelscited by 1
  7. 2024Shortcuts Arising from Contrast: Effective and Covert Clean-Label Attacks in Prompt-Based Learningcited by 0
  8. 2025Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classificationcited by 0
  9. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  10. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0