mlsanityData to 7 Oct 2026

Attention-Enhancing Backdoor Attacks Against BERT-based Models

arXiv 2310.14480 ↗First posted 23 Oct 2023cs.LGcited by 32

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Recent studies have revealed that textitBackdoor Attacks can threaten the safety of natural language processing (NLP) models. Investigating the strategies of backdoor attacks will help to understand the model's vulnerability. Most existing textual backdoor attacks focus on generating stealthy triggers or modifying model weights. In this paper, we directly target the interior structure of neural networks and the backdoor mechanism. We propose a novel Trojan Attention Loss (TAL), which enhances the Trojan behavior by directly manipulating the attention patterns. Our loss can be applied to different attacking methods to boost their attack efficacy in terms of attack successful rates and poisoning rates. It applies to not only traditional dirty-label attacks, but also the more challenging clean-label attacks. We validate our method on different backbone models (BERT, RoBERTa, and DistilBERT) and various tasks (Sentiment Analysis, Toxic Detection, and Topic Classification).

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 45 of its 59 references that are in the map. First posted on arXiv 23 Oct 2023.

Builds on

45 of 59 references.

Closest ancestors · 10

Same direction, newest first

  1. 2022How to Backdoor Diffusion Models?11 Dec
  2. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  3. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  4. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  5. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  6. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun
  7. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  8. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  9. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar
  10. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification7 Mar

Other references · 35

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,243
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2019What Does BERT Look At? An Analysis of BERT's Attentioncited by 994
  9. 2019Analyzing Multi-Head Self-Attention: Specialized Heads Do the Heavy Lifting, the Rest Can Be Prunedcited by 844
  10. 2019Are Sixteen Heads Really Better than One?cited by 803
  11. 2017Automated Hate Speech Detection and the Problem of Offensive Languagecited by 724
  12. 2019Hidden Trigger Backdoor Attackscited by 359
23 more
  1. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  2. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  3. 2019Label-Consistent Backdoor Attackscited by 285
  4. 2018Adversarial Example Generation with Syntactically Controlled Paraphrase Networkscited by 282
  5. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  6. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  7. 2020Reformulating Unsupervised Style Transfer as Paraphrase Generationcited by 181
  8. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129
  9. 2020Self-Attention Attribution: Interpreting Information Interactions Inside Transformercited by 124
  10. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  11. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  12. 2020Trojaning Language Models for Fun and Profitcited by 80
  13. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  14. 2022A Multimodal Transformer: Fusing Clinical Notes with Structured EHR Data for Interpretable In-Hospital Mortality Predictioncited by 48
  15. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  16. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  17. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  18. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  19. 2021Topological Detection of Trojaned Neural Networkscited by 34
  20. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  21. 2021On the Distribution, Sparsity, and Inference-time Quantization of Attention Values in Transformerscited by 14
  22. 2021TopoTxR: A Topological Biomarker for Predicting Treatment Response in Breast Cancercited by 13
  23. 2020Live Trojan Attacks on Deep Neural Networkscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 22; 2025: 5; 2026: 4.

32 papers.

Sort:

By area:

  1. 2024Time Series Modeling for Heart Rate Prediction: From ARIMA to Transformerscited by 35
  2. 2024TrojVLM: Backdoor Attack Against Vision Language Modelscited by 35
  3. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 31
  4. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 31
  5. 2024APEER: Automatic Prompt Engineering Enhances Large Language Model Rerankingcited by 28
  6. 2024Credit Card Fraud Detection Using Advanced Transformer Modelcited by 26
  7. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  8. 2023Model Extraction Attacks Revisitedcited by 21
  9. 2024FAIntbench: A Holistic and Precise Benchmark for Bias Evaluation in Text-to-Image Modelscited by 21
  10. 2024Large Language Model Bias Mitigation from the Perspective of Knowledge Editingcited by 16
  11. 2024XMeCap: Meme Caption Generation with Sub-Image Adaptabilitycited by 14
  12. 2025May I have your Attention? Breaking Fine-Tuning based Prompt Injection Defenses using Architecture-Aware Attackscited by 14
20 more
  1. 2024Can Pre-trained Language Models Understand Chinese Humor?cited by 13
  2. 2024A Huber Loss Minimization Approach to Mean Estimation under User-level Differential Privacycited by 11
  3. 2024Research on Driver Facial Fatigue Detection Based on Yolov8 Modelcited by 11
  4. 2024Advanced User Credit Risk Prediction Model using LightGBM, XGBoost and Tabnet with SMOTEENNcited by 10
  5. 2024Optimizing Search Advertising Strategies: Integrating Reinforcement Learning with Generalized Second-Price Auctions for Enhanced Ad Ranking and Biddingcited by 9
  6. 2025Fed-HeLLo: Efficient Federated Foundation Model Fine-Tuning with Heterogeneous LoRA Allocationcited by 7
  7. 2025PANDAS: Improving Many-shot Jailbreaking via Positive Affirmation, Negative Demonstration, and Adaptive Samplingcited by 6
  8. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Referencecited by 6
  9. 2024BadCLM: Backdoor Attack in Clinical Language Models for Electronic Health Recordscited by 5
  10. 2025Credit Risk Identification in Supply Chains Using Generative Adversarial Networkscited by 5
  11. 2024Diffusion-Refined VQA Annotations for Semi-Supervised Gaze Followingcited by 4
  12. 2024Debiasing Machine Unlearning with Counterfactual Examplescited by 3
  13. 2024Federated Learning for Smart Grid: A Survey on Applications and Potential Vulnerabilitiescited by 3
  14. 2024Advanced Feature Manipulation for Enhanced Change Detection Leveraging Natural Language Modelscited by 1
  15. 2024Real-Time Summarization of Twittercited by 1
  16. 2025Moir'eXNet: Adaptive Multi-Scale Demoir'eing with Linear Attention Test-Time Training and Truncated Flow Matching Priorcited by 1
  17. 2024RW-NSGCN: A Robust Approach to Structural Attacks via Negative Samplingcited by 0
  18. 2026Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signaturescited by 0
  19. 2026Backdoor Containment via Expert Quarantine and Shutdown in LLMscited by 0
  20. 2026Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projectioncited by 0