mlsanityData to 7 Oct 2026

Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers

arXiv 2310.18603 ↗First posted 28 Oct 2023cs.LGcited by 14

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks manipulate model predictions by inserting innocuous triggers into training and test data. We focus on more realistic and more challenging clean-label attacks where the adversarial training examples are correctly labeled. Our attack, LLMBkd, leverages language models to automatically insert diverse style-based triggers into texts. We also propose a poison selection technique to improve the effectiveness of both LLMBkd as well as existing textual backdoor attacks. Lastly, we describe REACT, a baseline defense to mitigate backdoor attacks via antidote training examples. Our evaluations demonstrate LLMBkd's effectiveness and efficiency, where we consistently achieve high attack success rates across a wide range of styles with little effort and no model training.

Key facts. Cited by 14 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 34 of its 48 references that are in the map. First posted on arXiv 28 Oct 2023.

Builds on

34 of 48 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  2. 2022Kallima: A Clean-label Framework for Textual Backdoor Attacks3 Jun
  3. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models15 Oct
  4. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  5. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May

Other references · 29

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2022Large Language Models are Zero-Shot Reasonerscited by 4,323
  5. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,801
  6. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  7. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  8. 2017Automated Hate Speech Detection and the Problem of Offensive Languagecited by 724
  9. 2021Prompt Programming for Large Language Models: Beyond the Few-Shot Paradigmcited by 599
  10. 2021MAUVE: Measuring the Gap Between Neural Text and Human Text using Divergence Frontierscited by 466
  11. 2022ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and Implicit Hate Speech Detectioncited by 419
  12. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
17 more
  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2023Poisoning Language Models During Instruction Tuningcited by 254
  3. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  4. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  5. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  6. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  7. 2020Reformulating Unsupervised Style Transfer as Paraphrase Generationcited by 181
  8. 2022Training Data Influence Analysis and Estimation: A Surveycited by 134
  9. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  10. 2021Adversarial Examples Make Strong Poisonscited by 115
  11. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  12. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  13. 2018Fighting Fire with Fire: Using Antidote Data to Improve Polarization and Fairness of Recommender Systemscited by 37
  14. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  15. 2020Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencodercited by 27
  16. 2023Model-tuning Via Prompts Makes NLP Models Adversarially Robustcited by 9
  17. 2022Learning Antidote Data to Individual Unfairnesscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 6; 2025: 5; 2026: 2.

14 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  3. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  4. 2024Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggerscited by 13
  5. 2025Robust Data Watermarking in Language Models by Injecting Fictitious Knowledgecited by 8
  6. 2025A Systematic Review of Poisoning Attacks Against Large Language Modelscited by 8
  7. 2024DREAM: Improving Video-Text Retrieval Through Relevance-Based Augmentation Using Large Foundation Modelscited by 3
  8. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attackscited by 2
  9. 2025NLP Security and Ethics, in the Wildcited by 2
  10. 2025The Ultimate Cookbook for Invisible Poison: Crafting Subtle Clean-Label Text Backdoors with Style Attributescited by 2
  11. 2025T-Detect: Tail-Aware Statistical Normalization for Robust Detection of Adversarial Machine-Generated Textcited by 1
  12. 2026Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggerscited by 1
2 more
  1. 2024Single Word Change is All You Need: Using LLMs to Create Synthetic Training Examples for Text Classifierscited by 0
  2. 2026Turn-Based Structural Triggers: Structure-Conditioned Backdoors in Multi-Turn LLMscited by 0