# Backdoor and data poisoning attacks

Area: [LLM safety and security](https://mlsanity.com/safety/index.md). HTML: https://mlsanity.com/safety/backdoor-and-data-poisoning-attacks/

## Key facts

- Backdoor and data poisoning attacks: 709 papers on arXiv since 2021 (data through 14 Oct 2026).
- 133 of its 709 mapped papers (19%) cite “Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger” (2021, arXiv 2105.12400).
- 89 of its 709 mapped papers (13%) cite “Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer” (2021, arXiv 2110.07139).
- 24 new papers 24 Sep–14 Oct.

## Most cited here

- [Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger](https://mlsanity.com/paper/2105.12400/) (2021), cited by 133 papers here
- [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://mlsanity.com/paper/2110.07139/) (2021), cited by 89 papers here
- [RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models](https://mlsanity.com/paper/2110.07831/) (2021), cited by 73 papers here
- [Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training](https://mlsanity.com/paper/2401.05566/) (2024), cited by 65 papers here
- [Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection](https://mlsanity.com/paper/2307.16888/) (2023), cited by 63 papers here
- [Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution](https://mlsanity.com/paper/2106.06361/) (2021), cited by 58 papers here
- [Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models](https://mlsanity.com/paper/2103.15543/) (2021), cited by 56 papers here
- [BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning](https://mlsanity.com/paper/2108.00352/) (2021), cited by 53 papers here
- [How to Backdoor Diffusion Models?](https://mlsanity.com/paper/2212.05400/) (2022), cited by 50 papers here
- [Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models](https://mlsanity.com/paper/2305.14710/) (2023), cited by 49 papers here

## New (24 Sep–14 Oct)

- [Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis](https://mlsanity.com/paper/2610.20319/) (2026-10-14)
- [Analyzing and Mitigating Poisoning Attacks on Flow-Based Intrusion Detection](https://mlsanity.com/paper/2610.19766/) (2026-10-14)
- [Prompt-Injection Probes Learn the Conversation, Not Just the Injection](https://mlsanity.com/paper/2610.18408/) (2026-10-13)
- [Detecting Chain-of-Thought Hijacking in Backdoored Multimodal Large Reasoning Models](https://mlsanity.com/paper/2610.16598/) (2026-10-12)
- [Towards Merging-conditional Backdoor Unalignment against Large Language Models](https://mlsanity.com/paper/2610.14701/) (2026-10-10)
- [Cancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage Controller](https://mlsanity.com/paper/2610.12644/) (2026-10-08)
- [Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions](https://mlsanity.com/paper/2610.09941/) (2026-10-07)
- [Weight Oracles: Reading Neural Network Weights with Language Models](https://mlsanity.com/paper/2610.07334/) (2026-10-05)
- [Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII](https://mlsanity.com/paper/2610.06093/) (2026-10-05)
- [Backdooring Sparse Autoencoders](https://mlsanity.com/paper/2610.06049/) (2026-10-05)
- [The Fragility of Trigger-Tag Mechanisms for Misuse Detection in Open-Weight LLMs](https://mlsanity.com/paper/2610.03124/) (2026-10-02)
- [Evaluating and Improving the Robustness of Large Language Models to Input Sequence Variations](https://mlsanity.com/paper/2610.02432/) (2026-10-01)
- [SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples](https://mlsanity.com/paper/2610.01788/) (2026-10-01)
- [Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection](https://mlsanity.com/paper/2610.00685/) (2026-09-30)
- [Backdoor Containment via Expert Quarantine and Shutdown in LLMs](https://mlsanity.com/paper/2610.00663/) (2026-09-30)
- [Security Properties of Neural Networks as Decision Problems](https://mlsanity.com/paper/2609.39768/) (2026-09-30)
- [Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models](https://mlsanity.com/paper/2609.39548/) (2026-09-30)
- [BadAction: Backdoor Attacks on Interactive Video Generation via Action-Guided Triggers](https://mlsanity.com/paper/2609.39047/) (2026-09-30)
- [Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisation](https://mlsanity.com/paper/2610.00348/) (2026-09-29)
- [Backdoor Mitigation in Decentralized LLM Fine-Tuning](https://mlsanity.com/paper/2609.37367/) (2026-09-29)
- [Backdoor as Probe: Test-Time Adversarial Defense for CLIP](https://mlsanity.com/paper/2609.34641/) (2026-09-28)
- [Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers](https://mlsanity.com/paper/2609.37468/) (2026-09-26)
- [A Solvable Theory of Pre-training Data Poisoning: Regime-Dependent Scaling Exponents](https://mlsanity.com/paper/2609.32288/) (2026-09-26)
- [The Tokens Remember: When Tokenization Bypasses Knowledge Editing and Unlearning](https://mlsanity.com/paper/2609.29045/) (2026-09-24)