mlsanityData to 7 Oct 2026

Backdoor and data poisoning attacks

709 papers4 this weekHigh confidence in this grouping: the papers form one clear topicHigh confidence in this grouping: the papers form one clear topic · About

Keywords: backdoor, attacks, backdoor attacks, poisoning, attack

Key facts. Backdoor and data poisoning attacks: 709 papers on arXiv since 2021 (data through 7 Oct 2026). 133 of its 709 mapped papers (19%) cite “Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger” (2021, arXiv 2105.12400). 89 of its 709 mapped papers (13%) cite “Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer” (2021, arXiv 2110.07139). 18 new papers 24 Sep–7 Oct.

What’s new

24 Sep – 7 Oct 2026

18 new papers, 24 Sep – 7 Oct; 4 this week.

  1. This week · 4
  2. Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions also fits: Vision-language and text-to-image safety
  3. Weight Oracles: Reading Neural Network Weights with Language Models
  4. Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII also fits: Safety alignment, refusal and guardrails
  5. Backdooring Sparse Autoencoders
  6. Earlier · 14
  7. The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs also fits: Jailbreaking
  8. Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations also fits: Jailbreaking
  9. SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples
  10. Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection
  11. Backdoor Containment via Expert Quarantine and Shutdown in LLMs
  12. Security Properties of Neural Networks as Decision Problems
All 18
  1. Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models
  2. BadAction: Backdoor Attacks on Interactive Video Generation via Action-Guided Triggers
  3. Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation
  4. Backdoor Mitigation in Decentralized LLM Fine-Tuning also fits: Prompt injection and agent security
  5. Backdoor as Probe: Test-Time Adversarial Defense for CLIP
  6. Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers also fits: Prompt injection and agent security
  7. A Solvable Theory of Pre-training Data Poisoning: Regime-Dependent Scaling Exponents also fits: Safety alignment, refusal and guardrails
  8. The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning also fits: Machine unlearning

Foundations

Most cited by papers here

  1. Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger2021cited by 133 here
  2. Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer2021cited by 89 here
  3. RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models2021cited by 73 here
  4. Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training2024cited by 65 here
  5. Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection2023cited by 63 here

Lineage

The papers this direction builds on, oldest first.

Each paper on the line cites the one before.

  1. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 133 here
  2. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 58 here
  3. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 89 here
  4. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 49 here
  5. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 65 here
19 more it builds on, not in this chain
  1. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 39 here
  2. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 56 here
  3. 2021Hidden Backdoors in Human-Centric Language Modelscited by 45 here
  4. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 53 here
  5. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 47 here
  6. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 73 here
  7. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 47 here
  8. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 47 here
  9. 2022Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesiscited by 37 here
  10. 2022How to Backdoor Diffusion Models?cited by 50 here
  11. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 39 here
  12. 2023Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoningcited by 47 here
  13. 2023VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Modelscited by 41 here
  14. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 48 here
  15. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 63 here
  16. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 44 here
  17. 2023Composite Backdoor Attacks Against Large Language Modelscited by 44 here
  18. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 47 here
  19. 2024BadEdit: Backdooring large language models by model editingcited by 40 here

The 24 most cited of 814.

Browse

30 of 709, ranked 6–35

  1. 6Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution202158
  2. 7Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models202156
  3. 8BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning202153
  4. 9How to Backdoor Diffusion Models?202250
  5. 10Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models202349
  6. 11Text-to-Image Diffusion Models can be Easily Backdoored through Multimodal Data Poisoning202347
  7. 12BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning202347
  8. 13A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks202247
  9. 14BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models202147
  10. 15Triggerless Backdoor Attack for NLP Tasks with Clean Labels202147
All 30
  1. 16Hidden Backdoors in Human-Centric Language Models202145
  2. 17Composite Backdoor Attacks Against Large Language Models202344
  3. 18VillanDiffusion: A Unified Backdoor Attack Framework for Diffusion Models202341
  4. 19BadEdit: Backdooring large language models by model editing202440
  5. 20Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models202339
  6. 21T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification202139
  7. 22Rickrolling the Artist: Injecting Backdoors into Text Encoders for Text-to-Image Synthesis202237
  8. 23CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learning202336
  9. 24VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models202435
  10. 25Backdoor Attacks for In-Context Learning with Language Models202335
  11. 26BadPrompt: Backdoor Attacks on Continuous Prompts202234
  12. 27Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense202233
  13. 28Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective202133
  14. 29BITE: Textual Backdoor Attacks with Iterative Trigger Injection202231
  15. 30BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models202430
  16. 31BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models202430
  17. 32Detecting Backdoors in Pre-trained Encoders202330
  18. 33Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch202129
  19. 34Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning202428
  20. 35Instruction Backdoor Attacks Against Customized LLMs202428