mlsanityData to 7 Oct 2026

Backdoor Learning on Sequence to Sequence Models

arXiv 2305.02424 ↗First posted 3 May 2023cs.CLcited by 19

Not on the map. Why?

Abstract (arXiv)

Backdoor learning has become an emerging research area towards building a trustworthy machine learning system. While a lot of works have studied the hidden danger of backdoor attacks in image or text classification, there is a limited understanding of the model's robustness on backdoor attacks when the output space is infinite and discrete. In this paper, we study a much more challenging problem of testing whether sequence-to-sequence (seq2seq) models are vulnerable to backdoor attacks. Specifically, we find by only injecting 0.2% samples of the dataset, we can cause the seq2seq model to generate the designated keyword and even the whole sentence. Furthermore, we utilize Byte Pair Encoding (BPE) to create multiple new triggers, which brings new challenges to backdoor detection since these backdoors are not static. Extensive experiments on machine translation and text summarization have been conducted to show our proposed methods could achieve over 90% attack success rate on multiple datasets and models.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 20 of its 27 references that are in the map. First posted on arXiv 3 May 2023.

Builds on

20 of 27 references.

References · 20

  1. 2017Attention Is All You Needcited by 59,932
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  4. 2019fairseq: A Fast, Extensible Toolkit for Sequence Modelingcited by 1,486
  5. 2015Teaching Machines to Read and Comprehendcited by 1,039
  6. 2016An overview of gradient descent optimization algorithmscited by 1,021
  7. 2017Convolutional Sequence to Sequence Learningcited by 550
  8. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  9. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  10. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  11. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  12. 2018Scaling Neural Machine Translationcited by 204
8 more
  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  2. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  3. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  4. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  5. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  6. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  7. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  8. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 35

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 6; 2024: 9; 2025: 1; 2026: 3.

19 papers.

Sort:

By area:

  1. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  2. 2023InstructZero: Efficient Instruction Optimization for Black-Box Large Language Modelscited by 68
  3. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  4. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  5. 2024PoisonBench: Assessing Large Language Model Vulnerability to Data Poisoningcited by 31
  6. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  7. 2024A Trembling House of Cards? Mapping Adversarial Attacks against Language Agentscited by 22
  8. 2023AlpaGasus: Training A Better Alpaca with Fewer Datacited by 19
  9. 2024Simulate and Eliminate: Revoke Backdoors for Generative Large Language Modelscited by 11
  10. 2023Demystifying Poisoning Backdoor Attacks from a Statistical Perspectivecited by 10
  11. 2023TrojFSP: Trojan Insertion in Few-shot Prompt Tuningcited by 9
  12. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
7 more
  1. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 6
  2. 2024BadFair: Backdoored Fairness Attacks with Group-conditioned Triggerscited by 4
  3. 2025Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigmcited by 4
  4. 2024Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMscited by 2
  5. 2024Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layerscited by 1
  6. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  7. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0