mlsanityData to 14 Oct 2026

On the Security Vulnerabilities of Text-to-SQL Models

arXiv 2211.15363 ↗First posted 28 Nov 2022cs.CL cs.CR cs.DBcited by 3

Not on the map. Why?

Abstract (arXiv)

Although it has been demonstrated that Natural Language Processing (NLP) algorithms are vulnerable to deliberate attacks, the question of whether such weaknesses can lead to software security threats is under-explored. To bridge this gap, we conducted vulnerability tests on Text-to-SQL systems that are commonly used to create natural language interfaces to databases. We showed that the Text-to-SQL modules within six commercial applications can be manipulated to produce malicious code, potentially leading to data breaches and Denial of Service attacks. This is the first demonstration that NLP models can be exploited as attack vectors in the wild. In addition, experiments using four open-source language models verified that straightforward backdoor attacks on Text-to-SQL systems achieve a 100% success rate without affecting their performance. The aim of this work is to draw the community's attention to potential software security issues associated with NLP algorithms and encourage exploration of methods to mitigate against them.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 40 of its 73 references that are in the map. First posted on arXiv 28 Nov 2022.

Builds on

40 of 73 references.

References · 40

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  4. 2021Evaluating Large Language Models Trained on Codecited by 8,320
  5. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
  6. 2021Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processingcited by 2,234
  7. 2020Extracting Training Data from Large Language Modelscited by 2,189
  8. 2018Spider: A Large-Scale Human-Labeled Dataset for Complex and Cross-Domain Semantic Parsing and Text-to-SQL Taskcited by 1,139
  9. 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
  10. 2021PICARD: Parsing Incrementally for Constrained Auto-Regressive Decoding from Language Modelscited by 411
  11. 2019Hidden Trigger Backdoor Attackscited by 371
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
28 more
  1. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  2. 2022UnifiedSKG: Unifying and Multi-Tasking Structured Knowledge Grounding with Text-to-Text Language Modelscited by 231
  3. 2019Towards Complex Text-to-SQL in Cross-Domain Database with Intermediate Representationcited by 210
  4. 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 163
  5. 2020Structure-Grounded Pretraining for Text-to-SQLcited by 126
  6. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  7. 2018Coarse-to-Fine Decoding for Neural Semantic Parsingcited by 110
  8. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
  9. 2018Semantic Parsing for Task Oriented Dialog using Hierarchical Representationscited by 101
  10. 2021Hidden Backdoors in Human-Centric Language Modelscited by 90
  11. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  12. 2019A Comprehensive Exploration on WikiSQL with Table-Aware Word Contextualizationcited by 88
  13. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 86
  14. 2019Text-to-SQL Generation for Question Answering on Electronic Medical Recordscited by 77
  15. 2018SyntaxSQLNet: Syntax Tree Networks for Complex and Cross-DomainText-to-SQL Taskcited by 74
  16. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  17. 2022A Survey on Text-to-SQL Parsing: Concepts, Methods, and Future Directionscited by 52
  18. 2020Generating Natural Language Attacks in a Hard Label Black Box Settingcited by 50
  19. 2021SADGA: Structure-Aware Dual Graph Aggregation Network for Text-to-SQLcited by 43
  20. 2021Putting Humans in the Natural Language Processing Loop: A Surveycited by 40
  21. 2022SeqZero: Few-shot Compositional Semantic Parsing with Sequential Prompts and Zero-shot Modelscited by 38
  22. 2021Memorisation versus Generalisation in Pre-trained Language Modelscited by 32
  23. 2020Photon: A Robust Cross-Domain Text-to-SQL Systemcited by 26
  24. 2022SUBS: Subtree Substitution for Compositional Semantic Parsingcited by 16
  25. 2020SHIELD: Defending Textual Neural Networks against Multiple Black-Box Adversarial Attacks with Stochastic Multi-Expert Patchercited by 13
  26. 2018Dynamic Self-Attention : Computing Attention over Words Dynamically for Sentence Embeddingcited by 8
  27. 2020Query Understanding for Natural Language Enterprise Searchcited by 2
  28. 2022AskYourDB: An end-to-end system for querying and visualizing relational databases using natural languagecited by 1

Built on by

Cited by year

Citing papers per year: 2022: 1; 2023: 0; 2024: 1; 2025: 1.

3 papers.

  1. 2022Don't Generate, Discriminate: A Proposal for Grounding Language Models to Real-World Environmentscited by 57
  2. 2024Unmasking Database Vulnerabilities: Zero-Knowledge Schema Inference Attacks in Text-to-SQL Systemscited by 6
  3. 2025Are Your LLM-based Text-to-SQL Models Secure? Exploring SQL Injection via Backdoor Attackscited by 6

Similar, not cited

Close in wording, no citation either way

  1. 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applications
  2. 2025QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Language
  3. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review
  4. 2024Defense Against Syntactic Textual Backdoor Attacks with Token Substitution
  5. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  6. 2025A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations
  7. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks
  8. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models