mlsanityData to 14 Oct 2026

A Survey on Backdoor Attack and Defense in Natural Language Processing

arXiv 2211.11958 ↗First posted 22 Nov 2022cs.CL cs.CRcited by 14

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Deep learning is becoming increasingly popular in real-life applications, especially in natural language processing (NLP). Users often choose training outsourcing or adopt third-party data and models due to data and computation resources being limited. In such a situation, training data and models are exposed to the public. As a result, attackers can manipulate the training process to inject some triggers into the model, which is called backdoor attack. Backdoor attack is quite stealthy and difficult to be detected because it has little inferior influence on the model's performance for the clean samples. To get a precise grasp and understanding of this problem, in this paper, we conduct a comprehensive review of backdoor attacks and defenses in the field of NLP. Besides, we summarize benchmark datasets and point out the open issues to design credible systems to defend against backdoor attacks.

Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 58 references that are in the map. First posted on arXiv 22 Nov 2022.

Builds on

37 of 58 references.

Closest ancestors · 13

Same direction, newest first

  1. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  2. 2022Kallima: A Clean-label Framework for Textual Backdoor Attacks3 Jun
  3. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense11 Feb
  4. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  5. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks15 Oct
  6. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  7. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  8. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  9. 2021Defending Against Backdoor Attacks in Natural Language Generation3 Jun
  10. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  11. 2021Hidden Backdoors in Human-Centric Language Models1 May
  12. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar
1 more
  1. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 24

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2020Language Models are Few-Shot Learnerscited by 32,419
  4. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,811
  7. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
  8. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  9. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  10. 2018A Survey on Deep Learning for Named Entity Recognitioncited by 282
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  12. 2019A backdoor attack against LSTM-based text classification systemscited by 227
12 more
  1. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  2. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  3. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  4. 2019Neural Machine Translation: A Review and Surveycited by 100
  5. 2020Trojaning Language Models for Fun and Profitcited by 90
  6. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 86
  7. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  8. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 71
  9. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  10. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 48
  11. 2022PerD: Perturbation Sensitivity-based Neural Trojan Detection Framework on NLP Applicationscited by 4
  12. 2022Defending Against Stealthy Backdoor Attackscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 6; 2024: 3; 2025: 3; 2026: 2.

14 papers.

Sort:

By area:

  1. 2023Large Language Model Alignment: A Surveycited by 243
  2. 2024Stress-Testing Capability Elicitation With Password-Locked Modelscited by 46
  3. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  4. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Triggercited by 31
  5. 2023ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLPcited by 19
  6. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  7. 2024The Art of Deception: Robust Backdoor Attack using Dynamic Stacking of Triggerscited by 3
  8. 2024Event Trojan: Asynchronous Event-based Backdoor Attackscited by 3
  9. 2023MDTD: A Multi Domain Trojan Detector for Deep Neural Networkscited by 1
  10. 2025Reformulation is All You Need: Addressing Malicious Text Features in DNNscited by 1
  11. 2025HeteroBA: A Structure-Manipulating Backdoor Attack on Heterogeneous Graphscited by 0
  12. 2025HeteroHBA: A Generative Structure-Manipulating Backdoor Attack on Heterogeneous Graphscited by 0
2 more
  1. 2026Delayed Backdoor Attacks: Exploring the Temporal Dimension as a New Attack Surface in Pre-Trained Modelscited by 0
  2. 2026StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robotscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2022Rethink the Evaluation for Attack Strength of Backdoor Attacks in Natural Language Processing
  2. 2023RobustNLP: A Technique to Defend NLP Models Against Backdoor Attacks
  3. 2022Detecting Backdoors in Deep Text Classifiers
  4. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models
  5. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  6. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks
  7. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  8. 2025A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations