mlsanityData to 14 Oct 2026

Training-free Lexical Backdoor Attacks on Language Models

arXiv 2302.04116 ↗First posted 8 Feb 2023cs.CR cs.AI cs.CLcited by 31

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large-scale language models have achieved tremendous success across various natural language processing (NLP) applications. Nevertheless, language models are vulnerable to backdoor attacks, which inject stealthy triggers into models for steering them to undesirable behaviors. Most existing backdoor attacks, such as data poisoning, require further (re)training or fine-tuning language models to learn the intended backdoor patterns. The additional training process however diminishes the stealthiness of the attacks, as training a language model usually requires long optimization time, a massive amount of data, and considerable modifications to the model parameters. In this work, we propose Training-Free Lexical Backdoor Attack (TFLexAttack) as the first training-free backdoor attack on language models. Our attack is achieved by injecting lexical triggers into the tokenizer of a language model via manipulating its embedding dictionary using carefully designed rules. These rules are explainable to human developers which inspires attacks from a wider range of hackers. The sparse manipulation of the dictionary also habilitates the stealthiness of our attack. We conduct extensive experiments on three dominant NLP tasks based on nine language models to demonstrate the effectiveness and universality of our attack. The code of this work is available at https://github.com/Jinxhy/TFLexAttack.

Key facts. Cited by 31 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 40 of its 74 references that are in the map. First posted on arXiv 8 Feb 2023.

Builds on

40 of 74 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
  2. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures9 Dec
  3. 2021Hidden Backdoors in Human-Centric Language Models1 May
  4. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 36

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
  7. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,918
  8. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,811
  9. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,790
  10. 2018A Call for Clarity in Reporting BLEU Scorescited by 1,799
  11. 2019SciBERT: A Pretrained Language Model for Scientific Textcited by 1,414
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
24 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  2. 2019Publicly Available Clinical BERT Embeddingscited by 1,002
  3. 2018Subword Regularization: Improving Neural Network Translation Models with Multiple Subword Candidatescited by 639
  4. 2020Pre-trained Models for Natural Language Processing: A Surveycited by 505
  5. 2020Backdoor Learning: A Surveycited by 426
  6. 2019FinBERT: Financial Sentiment Analysis with Pre-trained Language Modelscited by 385
  7. 2020How Good is Your Tokenizer? On the Monolingual Performance of Multilingual Language Modelscited by 318
  8. 2020Multilingual Translation with Extensible Multilingual Pretraining and Finetuningcited by 287
  9. 2018A Survey on Deep Learning for Named Entity Recognitioncited by 282
  10. 2019SMART: Robust and Efficient Fine-Tuning for Pre-trained Natural Language Models through Principled Regularized Optimizationcited by 254
  11. 2019Leveraging Pre-trained Checkpoints for Sequence Generation Taskscited by 182
  12. 2021LogME: Practical Assessment of Pre-trained Models for Transfer Learningcited by 172
  13. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  14. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  15. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  16. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  17. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 69
  18. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  19. 2020Identifying Spurious Correlations for Robust Text Classificationcited by 59
  20. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 53
  21. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  22. 2019Acquiring Knowledge from Pre-trained Model to Neural Machine Translationcited by 30
  23. 2021RockNER: A Simple Method to Create Adversarial Examples for Evaluating the Robustness of Named Entity Recognition Modelscited by 28
  24. 2020Adversarial Training for Aspect-Based Sentiment Analysis with BERTcited by 26

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 8; 2024: 15; 2025: 5; 2026: 3.

31 papers.

Sort:

By area:

  1. 2023A Survey on Federated Unlearning: Challenges, Methods, and Future Directionscited by 63
  2. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learningcited by 53
  3. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 51
  4. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreakscited by 49
  5. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  6. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 42
  7. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  8. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  9. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimizationcited by 32
  10. 2023Integration of Large Language Models and Federated Learningcited by 31
  11. 2023Trojan Activation Attack: Red-Teaming Large Language Models using Activation Steering for Safety-Alignmentcited by 30
  12. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 12
19 more
  1. 2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10
  2. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 9
  3. 2025RedCoder: Automated Multi-Turn Red Teaming for Code LLMscited by 9
  4. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  5. 2025P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMscited by 6
  6. 2024Backdoor Attack on Multilingual Machine Translationcited by 5
  7. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 5
  8. 2024Stealth edits to large language modelscited by 3
  9. 2024Exploiting the Vulnerability of Large Language Models via Defense-Aware Architectural Backdoorcited by 3
  10. 2024Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editingcited by 3
  11. 2023Beyond the Model: Data Pre-processing Attack to Deep Learning Models in Android Appscited by 2
  12. 2024Beyond Dataset Watermarking: Model-Level Copyright Protection for Code Summarization Modelscited by 2
  13. 2024Combinational Backdoor Attack against Customized Text-to-Image Modelscited by 2
  14. 2024Defense Against Syntactic Textual Backdoor Attacks with Token Substitutioncited by 1
  15. 2026PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systemscited by 1
  16. 2026MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMscited by 1
  17. 2024Protecting Copyright of Medical Pre-trained Language Models: Training-Free Backdoor Model Watermarkingcited by 0
  18. 2025An Investigation on Group Query Hallucination Attackscited by 0
  19. 2026Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  2. 2025Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models
  3. 2023Backdoor Attacks for In-Context Learning with Language Models
  4. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  5. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  6. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models
  7. 2022Rethink the Evaluation for Attack Strength of Backdoor Attacks in Natural Language Processing
  8. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger