mlsanityData to 7 Oct 2026

SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer

arXiv 2402.18945 ↗First posted 29 Feb 2024cs.CR cs.AI cs.CLcited by 4

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Although pre-training achieves remarkable performance, it suffers from task-agnostic backdoor attacks due to vulnerabilities in data and training mechanisms. These attacks can transfer backdoors to various downstream tasks. In this paper, we introduce mathttmaxEntropy, an entropy-based poisoning filter that mitigates such risks. To overcome the limitations of manual target setting and explicit triggers, we propose mathttSynGhost, an invisible and universal task-agnostic backdoor attack via syntactic transfer, further exposing vulnerabilities in pre-trained language models (PLMs). Specifically, mathttSynGhost injects multiple syntactic backdoors into the pre-training space through corpus poisoning, while preserving the PLM's pre-training capabilities. Second, mathttSynGhost adaptively selects optimal targets based on contrastive learning, creating a uniform distribution in the pre-training space. To identify syntactic differences, we also introduce an awareness module to minimize interference between backdoors. Experiments show that mathttSynGhost poses significant threats and can transfer to various downstream tasks. Furthermore, mathttSynGhost resists defenses based on perplexity, fine-pruning, and mathttmaxEntropy. The code is available at https://github.com/Zhou-CyberSecurity-AI/SynGhost.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 61 references that are in the map. First posted on arXiv 29 Feb 2024.

Builds on

32 of 61 references.

Closest ancestors · 11

Same direction, newest first

  1. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning11 Jan
  2. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review12 Sep
  3. 2023ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Trigger27 Apr
  4. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  5. 2022Kallima: A Clean-label Framework for Textual Backdoor Attacks3 Jun
  6. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  7. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models6 Oct
  8. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  9. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  10. 2021Hidden Backdoors in Human-Centric Language Models1 May
  11. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 21

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,878
  5. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,769
  6. 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,841
  7. 2019XLNet: Generalized Autoregressive Pretraining for Language Understandingcited by 2,801
  8. 2019ALBERT: A Lite BERT for Self-supervised Learning of Language Representationscited by 2,772
  9. 2020DeBERTa: Decoding-enhanced BERT with Disentangled Attentioncited by 2,157
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  12. 2019Frequency Principle: Fourier Analysis Sheds Light on Deep Neural Networkscited by 360
9 more
  1. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  2. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  3. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  4. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  5. 2020Trojaning Language Models for Fun and Profitcited by 80
  6. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  7. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  8. 2023TrojText: Test-time Invisible Textual Trojan Insertioncited by 26
  9. 2022I-Tuning: Tuning Frozen Language Models with Image for Lightweight Image Captioningcited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2025Safety in Large Reasoning Models: A Surveycited by 58
  2. 2025SteganoBackdoor: Evading Data-Poisoning Defenses via Steganographic Backdoorscited by 1
  3. 2026Turn-Based Structural Triggers: Structure-Conditioned Backdoors in Multi-Turn LLMscited by 0
  4. 2026OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoningcited by 0