mlsanityData to 14 Oct 2026

Defending against Insertion-based Textual Backdoor Attacks via Attribution

arXiv 2305.02394 ↗First posted 3 May 2023cs.CL cs.AI cs.CRcited by 25

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Textual backdoor attack, as a novel attack model, has been shown to be effective in adding a backdoor to the model during training. Defending against such backdoor attacks has become urgent and important. In this paper, we propose AttDef, an efficient attribution-based pipeline to defend against two insertion-based poisoning attacks, BadNL and InSent. Specifically, we regard the tokens with larger attribution scores as potential triggers since larger attribution words contribute more to the false prediction results and therefore are more likely to be poison triggers. Additionally, we further utilize an external pre-trained language model to distinguish whether input is poisoned or not. We show that our proposed method can generalize sufficiently well in two common attack scenarios (poisoning training data and testing data), which consistently improves previous methods. For instance, AttDef can successfully mitigate both attacks with an average accuracy of 79.97% (56.59% up) and 48.34% (3.99% up) under pre-training and post-training attack defense respectively, achieving the new state-of-the-art performance on prediction recovery over four benchmark datasets.

Key facts. Cited by 25 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 22 of its 34 references that are in the map. First posted on arXiv 3 May 2023.

Builds on

22 of 34 references.

Closest ancestors · 6

Same direction, newest first

  1. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attacks14 Oct
  2. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  3. 2021BFClass: A Backdoor-free Text Classification Framework22 Sep
  4. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  5. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  6. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 16

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  4. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  6. 2014Convolutional Neural Networks for Sentence Classificationcited by 1,127
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2015Aligning Books and Movies: Towards Story-like Visual Explanations by Watching Movies and Reading Bookscited by 1,043
  10. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  11. 2018Generating Natural Language Adversarial Examplescited by 424
  12. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 271
4 more
  1. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  2. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  3. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  4. 2020Pre-Training Transformers as Energy-Based Cloze Modelscited by 52

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 6; 2024: 12; 2025: 6; 2026: 1.

25 papers.

Sort:

By area:

  1. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 137
  2. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 82
  3. 2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 45
  4. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Reviewcited by 39
  5. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  6. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 27
  7. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 21
  8. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 21
  9. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  10. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  11. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 15
  12. 2024Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigmcited by 9
13 more
  1. 2025Concept-Level Explainability for Auditing & Steering LLM Responsescited by 6
  2. 2025P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMscited by 6
  3. 2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggerscited by 5
  4. 2024Eliminating Backdoors in Neural Code Models for Secure Code Understandingcited by 5
  5. 2024SEEP: Training Dynamics Grounds Latent Representation Search for Mitigating Backdoor Poisoning Attackscited by 3
  6. 2025Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Modelscited by 3
  7. 2024A Backdoor-based Explainable AI Benchmark for High Fidelity Evaluation of Attributionscited by 2
  8. 2025NLP Security and Ethics, in the Wildcited by 2
  9. 2024Defense Against Syntactic Textual Backdoor Attacks with Token Substitutioncited by 1
  10. 2025SCOUT: A Defense Against Data Poisoning Attacks in Fine-Tuned Language Modelscited by 1
  11. 2023Making Pre-trained Language Models both Task-solvers and Self-calibratorscited by 0
  12. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  13. 2026When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation
  2. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks
  3. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection
  4. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers
  5. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models
  6. 2023PoisonPrompt: Backdoor Attack on Prompt-based Large Language Models
  7. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning
  8. 2022Rethink the Evaluation for Attack Strength of Backdoor Attacks in Natural Language Processing