mlsanityData to 7 Oct 2026

From Shortcuts to Triggers: Backdoor Defense with Denoised PoE

arXiv 2305.14910 ↗First posted 24 May 2023cs.CL cs.AI cs.CRcited by 26

Not on the map. Why?

Abstract (arXiv)

Language models are often at risk of diverse backdoor attacks, especially data poisoning. Thus, it is important to investigate defense solutions for addressing them. Existing backdoor defense methods mainly focus on backdoor attacks with explicit triggers, leaving a universal defense against various backdoor attacks with diverse triggers largely unexplored. In this paper, we propose an end-to-end ensemble-based backdoor defense framework, DPoE (Denoised Product-of-Experts), which is inspired by the shortcut nature of backdoor attacks, to defend various backdoor attacks. DPoE consists of two models: a shallow model that captures the backdoor shortcuts and a main model that is prevented from learning the backdoor shortcuts. To address the label flip caused by backdoor attackers, DPoE incorporates a denoising design. Experiments on SST-2 dataset show that DPoE significantly improves the defense performance against various types of backdoor triggers including word-level, sentence-level, and syntactic triggers. Furthermore, DPoE is also effective under a more challenging but practical setting that mixes multiple types of trigger.

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Builds on 69 of its 93 references that are in the map. First posted on arXiv 24 May 2023.

Builds on

69 of 93 references.

References · 69

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  3. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  4. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  5. 2018Co-teaching: Robust Training of Deep Neural Networks with Extremely Noisy Labelscited by 1,053
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2020DivideMix: Learning with Noisy Labels as Semi-supervised Learningcited by 691
  9. 2018Learning to Reweight Examples for Robust Deep Learningcited by 670
  10. 2018Annotation Artifacts in Natural Language Inference Datacited by 656
  11. 2017MentorNet: Learning Data-Driven Curriculum for Very Deep Neural Networks on Corrupted Labelscited by 652
  12. 2022Contrastive Decoding: Open-ended Text Generation as Optimizationcited by 598
38 more
  1. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  2. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  3. 2019Symmetric Cross Entropy for Robust Learning with Noisy Labelscited by 499
  4. 2019How does Disagreement Help Generalization against Label Corruption?cited by 390
  5. 2019Unsupervised Label Noise Modeling and Loss Correctioncited by 327
  6. 2014Training Deep Neural Networks on Noisy Labels with Bootstrappingcited by 322
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  9. 2018Hypothesis Only Baselines in Natural Language Inferencecited by 291
  10. 2020Combating noisy labels by agreement: A joint training method with co-regularizationcited by 289
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2019Don't Take the Easy Way Out: Ensemble Based Methods for Avoiding Known Dataset Biasescited by 279
  13. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  14. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  15. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  16. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  17. 2020Does label smoothing mitigate label noise?cited by 204
  18. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  19. 2021R-Drop: Regularized Dropout for Neural Networkscited by 202
  20. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  21. 2019SELF: Learning to Filter Noisy Labels with Self-Ensemblingcited by 164
  22. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 147
  23. 2019End-to-End Bias Mitigation by Modelling Biases in Corporacited by 127
  24. 2019Unlearn Dataset Bias in Natural Language Inference by Fitting the Residualcited by 119
  25. 2020Towards Debiasing NLU Models from Unknown Biasescited by 116
  26. 2021Understanding and Improving Early Stopping for Learning with Noisy Labelscited by 112
  27. 2022Selective-Supervised Contrastive Learning with Noisy Labelscited by 112
  28. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  29. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  30. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
  31. 2021Competency Problems: On Finding and Removing Artifacts in Language Datacited by 91
  32. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  33. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
  34. 2020Learning from others' mistakes: Avoiding dataset biases without modeling themcited by 83
  35. 2020Beyond Class-Conditional Assumption: A Primary Attempt to Combat Instance-Dependent Label Noisecited by 82
  36. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  37. 2020Trojaning Language Models for Fun and Profitcited by 80
  38. 2021Sample Selection with Uncertainty of Losses for Learning with Noisy Labelscited by 79

50 most cited of 69 All 69 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 15; 2025: 5; 2026: 4.

26 papers.

Sort:

By area:

  1. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  2. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  3. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  4. 2023Hijacking Large Language Models via Adversarial In-Context Learningcited by 41
  5. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  6. 2025Between Circuits and Chomsky: Pre-pretraining on Formal Languages Imparts Linguistic Biasescited by 36
  7. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 21
  8. 2023Test-time Backdoor Mitigation for Black-Box Large Language Models with Defensive Demonstrationscited by 20
  9. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 19
  10. 2024Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuningcited by 16
  11. 2024Trojan Detection in Large Language Models: Insights from The Trojan Detection Challengecited by 14
  12. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
14 more
  1. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  2. 2024Two Heads are Better than One: Nested PoE for Robust Defense Against Multi-Backdoorscited by 6
  3. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 6
  4. 2025Be Careful When Fine-tuning On Open-Source LLMs: Your Fine-tuning Data Could Be Secretly Stolen!cited by 5
  5. 2025Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigmcited by 4
  6. 2025P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMscited by 4
  7. 2026SafeSeek: Universal Attribution of Safety Circuits in Language Modelscited by 4
  8. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Modelscited by 2
  9. 2024Evolutionary Trigger Detection and Lightweight Model Repair Based Backdoor Defensecited by 1
  10. 2024Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformerscited by 1
  11. 2024Shortcuts Arising from Contrast: Effective and Covert Clean-Label Attacks in Prompt-Based Learningcited by 0
  12. 2025Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Modelscited by 0
  13. 2026When Emotion Becomes Trigger: Emotion-style dynamic Backdoor Attack Parasitising Large Language Modelscited by 0
  14. 2026Mitigating Backdoors via Decoy Shortcuts and Knowledge Decouplingcited by 0