mlsanityData to 14 Oct 2026

Two-in-One: A Model Hijacking Attack Against Text Generation Models

arXiv 2305.07406 ↗First posted 12 May 2023cs.CR cs.CL cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Machine learning has progressed significantly in various applications ranging from face recognition to text generation. However, its success has been accompanied by different attacks. Recently a new attack has been proposed which raises both accountability and parasitic computing risks, namely the model hijacking attack. Nevertheless, this attack has only focused on image classification tasks. In this work, we broaden the scope of this attack to include text generation and classification models, hence showing its broader applicability. More concretely, we propose a new model hijacking attack, Ditto, that can hijack different text classification tasks into multiple generation ones, e.g., language translation, text summarization, and language modeling. We use a range of text benchmark datasets such as SST-2, TweetEval, AGnews, QNLI, and IMDB to evaluate the performance of our attacks. Our results show that by using Ditto, an adversary can successfully hijack text generation models without jeopardizing their utility.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 35 of its 52 references that are in the map. First posted on arXiv 12 May 2023.

Builds on

35 of 52 references.

References · 35

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,893
  3. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,899
  4. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,915
  5. 2014Sequence to Sequence Learning with Neural Networkscited by 2,986
  6. 2019The Curious Case of Neural Text Degenerationcited by 2,916
  7. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  8. 2021Pre-train, Prompt, and Predict: A Systematic Survey of Prompting Methods in Natural Language Processingcited by 2,234
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  10. 2019PEGASUS: Pre-training with Extracted Gap-sentences for Abstractive Summarizationcited by 1,102
  11. 2015Teaching Machines to Read and Comprehendcited by 1,049
  12. 2019Towards Federated Learning at Scale: System Designcited by 832
23 more
  1. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  2. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  3. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  4. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  5. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  6. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 225
  7. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  8. 2021WARP: Word-level Adversarial ReProgrammingcited by 221
  9. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  10. 2019SemEval-2017 Task 4: Sentiment Analysis in Twittercited by 210
  11. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
  12. 2021Cutting Down on Prompts and Parameters: Simple Few-Shot Learning with Language Modelscited by 139
  13. 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
  14. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 131
  15. 2018Adversarial Reprogramming of Neural Networkscited by 116
  16. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  17. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 85
  18. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 73
  19. 2021Bad Characters: Imperceptible NLP Attackscited by 71
  20. 2019GitHub Typo Corpus: A Large-Scale Multilingual Dataset of Misspellings and Grammatical Errorscited by 22
  21. 2018Data Poisoning Attack against Unsupervised Node Embedding Methodscited by 19
  22. 2020Deep Learning Backdoorscited by 19
  23. 2021Get a Model! Model Hijacking Attack Against Machine Learning Modelscited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 5; 2024: 6; 2025: 0; 2026: 1.

12 papers.

  1. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  2. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 183
  3. 2023Causality Analysis for Evaluating the Security of Large Language Modelscited by 11
  4. 2023Forcing Generative Models to Degenerate Ones: The Power of Data Poisoning Attackscited by 9
  5. 2024Turning Generative Models Degenerate: The Power of Data Poisoning Attackscited by 9
  6. 2024Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Controlcited by 8
  7. 2024HoneyGPT: Breaking the Trilemma in Terminal Honeypots with Large Language Modelcited by 5
  8. 2023Mondrian: Prompt Abstraction Attack Against Large Language Models for Cheaper API Pricingcited by 4
  9. 2024New Emerged Security and Privacy of Pre-trained Model: a Survey and Outlookcited by 2
  10. 2026Osmosis Distillation: Model Hijacking with the Fewest Samplescited by 1
  11. 2024SnatchML: Hijacking ML models without Training Accesscited by 0
  12. 2024Model Hijacking Attack in Federated Learningcited by 0