mlsanityData to 7 Oct 2026

Delayed Backdoor Attacks: Exploring the Temporal Dimension as a New Attack Surface in Pre-Trained Models

arXiv 2603.11949 ↗First posted 12 Mar 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Backdoor attacks against pre-trained models (PTMs) have traditionally operated under an ``immediacy assumption,'' where malicious behavior manifests instantly upon trigger occurrence. This work revisits and challenges this paradigm by introducing textitDelayed Backdoor Attacks (DBA), a new class of threats in which activation is temporally decoupled from trigger exposure. We propose that this temporal dimension is the key to unlocking a previously infeasible class of attacks: those that use common, everyday words as triggers. To examine the feasibility of this paradigm, we design and implement a proof-of-concept prototype, termed underlineDelayed Backdoor Attacks Based on underlineNonlinear underlineDecay (DND). DND embeds a lightweight, stateful logic module that postpones activation until a configurable threshold is reached, producing a distinct latency phase followed by a controlled outbreak. We derive a formal model to characterize this latency behavior and propose a dual-metric evaluation framework (ASR and ASRdelay) to empirically measure the delay effect. Extensive experiments on four (natural language processing)NLP benchmarks validate the core capabilities of DND: it remains dormant for a controllable duration, sustains high clean accuracy (≥94%), and achieves near-perfect post-activation attack success rates (≈99%, The average of other methods is below 95%.). Moreover, DND exhibits resilience against several state-of-the-art defenses. This study provides the first empirical evidence that the temporal dimension constitutes a viable yet unprotected attack surface in PTMs, underscoring the need for next-generation, stateful, and time-aware defense mechanisms.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 41 of its 53 references that are in the map. First posted on arXiv 12 Mar 2026.

Builds on

41 of 53 references.

References · 41

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Automated Hate Speech Detection and the Problem of Offensive Languagecited by 724
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  5. 2018Spectral Signatures in Backdoor Attackscited by 457
  6. 2020Backdoor Learning: A Surveycited by 412
  7. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  8. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
  9. 2018Large Scale Crowdsourcing and Characterization of Twitter Abusive Behaviorcited by 265
  10. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  12. 2021Trustworthy AI: From Principles to Practicescited by 206
29 more
  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  2. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  3. 2017Neural Trojanscited by 151
  4. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  5. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  6. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  7. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  8. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  9. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  10. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  11. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  12. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
  13. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 42
  14. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  15. 2021Topological Detection of Trojaned Neural Networkscited by 34
  16. 2022Architectural Backdoors in Neural Networkscited by 24
  17. 2023BayBFed: Bayesian Backdoor Defense for Federated Learningcited by 23
  18. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  19. 2022A Survey on Backdoor Attack and Defense in Natural Language Processingcited by 13
  20. 2025Neural Network Verification is a Programming Language Challengecited by 12
  21. 2024Architectural Neural Backdoors from First Principlescited by 10
  22. 2023Punctuation Matters! Stealthy Backdoor Attack for Language Modelscited by 5
  23. 2025Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Modelscited by 5
  24. 2025Exploring Backdoor Attack and Defense for LLM-empowered Recommendationscited by 4
  25. 2025ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks using Machine Unlearningcited by 3
  26. 2025Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challengescited by 3
  27. 2025Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Modelscited by 3
  28. 2025Unveiling Large Language Model Supply Chain: Structure, Domain, and Vulnerabilitiescited by 2
  29. 2024Unlearn to Relearn Backdoors: Deferred Backdoor Functionality Attacks on Deep Learning Modelscited by 1

Built on by

Not cited yet.