mlsanityData to 7 Oct 2026

Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation

arXiv 2305.11596 ↗First posted 19 May 2023cs.CL cs.CRcited by 19

Not on the map. Why?

Abstract (arXiv)

Modern NLP models are often trained over large untrusted datasets, raising the potential for a malicious adversary to compromise model behaviour. For instance, backdoors can be implanted through crafting training instances with a specific textual trigger and a target label. This paper posits that backdoor poisoning attacks exhibit spurious correlation between simple text features and classification labels, and accordingly, proposes methods for mitigating spurious correlation as means of defence. Our empirical study reveals that the malicious triggers are highly correlated to their target labels; therefore such correlations are extremely distinguishable compared to those scores of benign features, and can be used to filter out potentially problematic instances. Compared with several existing defences, our defence method significantly reduces attack success rates across backdoor attacks, and in the case of insertion-based attacks, our method provides a near-perfect defence.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Builds on 40 of its 56 references that are in the map. First posted on arXiv 19 May 2023.

Builds on

40 of 56 references.

References · 40

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  5. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  6. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,665
  7. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  8. 2015A large annotated corpus for learning natural language inferencecited by 1,837
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  11. 2019Right for the Wrong Reasons: Diagnosing Syntactic Heuristics in Natural Language Inferencecited by 864
  12. 2020Stanza: A Python Natural Language Processing Toolkit for Many Human Languagescited by 719
28 more
  1. 2018Annotation Artifacts in Natural Language Inference Datacited by 656
  2. 2018Spectral Signatures in Backdoor Attackscited by 457
  3. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  4. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  5. 2017Fake News Detection on Social Media: A Data Mining Perspectivecited by 334
  6. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  7. 2019Don't Take the Easy Way Out: Ensemble Based Methods for Avoiding Known Dataset Biasescited by 279
  8. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  10. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  11. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  12. 2015Learning Visual Features from Large Weakly Supervised Datacited by 165
  13. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  14. 2019Unlearn Dataset Bias in Natural Language Inference by Fitting the Residualcited by 119
  15. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  16. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  17. 2021Competency Problems: On Finding and Removing Artifacts in Language Datacited by 91
  18. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  19. 2020Mind the Trade-off: Debiasing NLU Models without Degrading the In-distribution Performancecited by 85
  20. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  21. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  22. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 66
  23. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  24. 2022Generating Data to Mitigate Spurious Correlations in Natural Language Inference Datasetscited by 54
  25. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  26. 2021Excess Capacity and Backdoor Poisoningcited by 24
  27. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 18
  28. 2021BFClass: A Backdoor-free Text Classification Frameworkcited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 3; 2024: 9; 2025: 6; 2026: 1.

19 papers.

Sort:

By area:

  1. 2023Use of LLMs for Illicit Purposes: Threats, Prevention Measures, and Vulnerabilitiescited by 76
  2. 2024The Clever Hans Mirage: A Comprehensive Survey on Spurious Correlations in Machine Learningcited by 39
  3. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
  4. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 20
  5. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  6. 2024TuBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuningcited by 13
  7. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 12
  8. 2024Simulate and Eliminate: Revoke Backdoors for Generative Large Language Modelscited by 11
  9. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 6
  10. 2025Hallucinated Span Detection with Multi-View Attention Featurescited by 6
  11. 2024Securing Multi-turn Conversational Language Models From Distributed Backdoor Triggerscited by 5
  12. 2024SEEP: Training Dynamics Grounds Latent Representation Search for Mitigating Backdoor Poisoning Attackscited by 3
7 more
  1. 2025NLP Security and Ethics, in the Wildcited by 2
  2. 2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergiescited by 2
  3. 2025Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Modelscited by 1
  4. 2025DISTIL: Data-Free Inversion of Suspicious Trojan Inputs via Latent Diffusioncited by 1
  5. 2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitutioncited by 0
  6. 2025Defending against Backdoor Attacks via Module Switchingcited by 0
  7. 2026BadLLM-TG: A Backdoor Defender powered by LLM Trigger Generatorcited by 0