mlsanityData to 14 Oct 2026

Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classification

arXiv 2508.15934 ↗First posted 21 Aug 2025cs.CR cs.AI cs.LGcited by 0

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Backdoor attacks pose a significant threat to the integrity of text classification models used in natural language processing. While several dirty-label attacks that achieve high attack success rates (ASR) have been proposed, clean-label attacks are inherently more difficult. In this paper, we propose three sample selection strategies to improve attack effectiveness in clean-label scenarios: Minimum, Above50, and Below50. Our strategies identify those samples which the model predicts incorrectly or with low confidence, and by injecting backdoor triggers into such samples, we aim to induce a stronger association between the trigger patterns and the attacker-desired target label. We apply our methods to clean-label variants of four canonical backdoor attacks (InsertSent, WordInj, StyleBkd, SynBkd) and evaluate them on three datasets (IMDB, SST2, HateSpeech) and four model types (LSTM, BERT, DistilBERT, RoBERTa). Results show that the proposed strategies, particularly the Minimum strategy, significantly improve the ASR over random sample selection with little or no degradation in the model's clean accuracy. Furthermore, clean-label attacks enhanced by our strategies outperform BITE, a state of the art clean-label attack method, in many configurations.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 22 of its 26 references that are in the map. First posted on arXiv 21 Aug 2025.

Builds on

22 of 26 references.

Closest ancestors · 12

Same direction, newest first

  1. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining3 Dec
  2. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
  3. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review12 Sep
  4. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks17 Jun
  5. 2022Kallima: A Clean-label Framework for Textual Backdoor Attacks3 Jun
  6. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injection25 May
  7. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labels15 Nov
  8. 2021Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks15 Oct
  9. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer14 Oct
  10. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution11 Jun
  11. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger26 May
  12. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models29 Mar

Other references · 10

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  3. 2019DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lightercited by 4,307
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  6. 2019Label-Consistent Backdoor Attackscited by 296
  7. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  8. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  9. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 137
  10. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2023Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers
  2. 2023Efficient Trigger Word Insertion
  3. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models
  4. 2024Injecting Bias into Text Classification Models using Backdoor Attacks
  5. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger
  6. 2021BFClass: A Backdoor-free Text Classification Framework
  7. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlation
  8. 2023Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systems