Pith. sign in

REVIEW 4 major objections 6 minor 48 references

Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining

T0 review · 4 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DCT-transformed gradients of an LLM's final layer separate poisoned from clean training samples, so a two-cluster filter can strip backdoors before fine-tuning.

desk verdict Interesting frequency-space filtering idea, but the experiments don't isolate it: the only tested target response is a fixed string that a trivial substring filter would catch. read the letter →

arxiv 2412.02454 v1 pith:3HLDEB4U submitted 2024-12-03 cs.CL cs.AIcs.CR

Zongru Wu , Pengzhou Cheng , Lingyong Fang , Zhuosheng Zhang , Gongshen Liu This is my paper · ORCID
classification cs.CLcs.AIcs.CR
keywords backdoorattackdefensegenerativelargelanguagemodelsgradientclusteringfrequencyspacedatasetpurificationdiscretecosinetransformfree-stylequestionanswering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper proposes GraCeFul, a defense that removes backdoor-poisoned examples from a text dataset before an LLM is fine-tuned, and it claims no retraining is needed. The core claim is that per-example gradients of the model's final output layer, transformed with a discrete cosine transform, split into two tight clusters: one for poisoned samples and one for clean samples. GraCeFul keeps the larger cluster and discards the smaller one, then fine-tunes normally. Across three insertion-based attacks and four free-style question-answering datasets, the paper reports attack success rates of 0% and clean accuracy close to (sometimes above) clean-only fine-tuning, with near-100% recall and F1 in finding poisoned samples. This matters because existing defenses for generative LLMs either require expensive retraining or degrade clean accuracy significantly.

What carries the argument

The load-bearing object is the truncated discrete cosine transform of the per-sample lm_head gradient. For each training sample, GraCeFul computes the gradient $g_i \in \mathbb{R}^{v \times d}$ of the output projection layer, applies a two-dimensional DCT to get $\hat{g}_i$, keeps only the low-frequency block of size $(v/8) \times (d/8)$, flattens it, and reduces it to 32 dimensions with PCA. That compact vector is then clustered with hierarchical clustering using cosine similarity into exactly two clusters, and the smaller cluster is labeled backdoor. The mechanism rests on two premises: backdoor mappings are low-frequency shortcuts learned faster than clean mappings, and deeper parameters amplify that frequency-space divergence, which is why the deepest parameter, lm_head, carries the signal.

What would settle it

Re-run GraCeFul on the same datasets with poison ratios of 0.4 and 0.5. If the reported recall and F1 stay near 100%, the two-cluster separation is robust and the smaller-cluster rule is unnecessary; if, as the paper's assumption implies, recall and F1 collapse, the method's guarantee is limited to minority poisoning. A second check: construct a backdoor where one trigger maps to many different target responses, and see whether the DCT-transformed gradient clusters still separate.

Watch

Extended reading notes

Core claim

The central discovery is that, for generative LLMs, the frequency-space representation of sample-wise gradients separates backdoor samples from clean samples more cleanly than the hidden-state features used by prior defenses. On a poisoned FreebaseQA dataset, the DCT-transformed lm_head gradients of poisoned and clean samples form well-separated compact clusters with higher silhouette scores than the last-hidden-state features of CUBE. The paper attributes this to learning behavior: backdoor mappings are simple many-to-one mappings that converge faster and concentrate in low frequencies, while deep parameters amplify the divergence. GraCeFul operationalizes the discovery as a three-step pipeline, feature representation via DCT plus PCA, hierarchical clustering into two clusters, and discarding the smaller cluster, and reports that this eliminates attack success across BadNets, AddSent, and CBA on WebQA, FreebaseQA, NQ, and CoQA with both Llama-2-7B and Vicuna-7B.

Load-bearing premise

The load-bearing premise is that backdoor samples are the smaller of the two clusters, so discarding the smaller cluster removes the attack; this presupposes a minority poison ratio, and the paper's own Figure 3 shows clean accuracy collapsing once the poison ratio reaches 0.3.

Editorial extensions

If this is right

  • Dataset sanitization becomes a pre-training step: about 40 minutes of gradient feature extraction and clustering replaces CUBE's 114-minute purification plus retraining, and fine-tuning time is shorter than vanilla training because poisoned samples are gone.
  • The defense is trigger-agnostic within the tested threat model: rare-word triggers, sentence triggers, and composite multi-component triggers all produce the same two-cluster gradient structure, and the same hyperparameters work for Llama-2 and Vicuna.
  • Clean accuracy need not be traded for security: on FreebaseQA and NQ, GraCeFul's CACC after filtering is higher than fine-tuning on the untouched poisoned dataset, which the paper attributes to removing the conflicting backdoor mapping.
  • The method's guarantee is explicitly conditional on poison ratio: below 0.25 clean accuracy holds, and at 0.3 the model's clean accuracy collapses, so defense effectiveness and attack stealth are two sides of the same assumption.
  • Because hierarchical, k-means, and spectral clustering all give the same end-to-end result, the two-cluster separation itself is the discovery, not the particular clustering algorithm.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper tests only FSQA at a 0.1 poison ratio; a natural extension is to check whether the same DCT-gradient clusters appear in summarization or code-generation fine-tuning, where the clean mapping is also many-to-many and the simple backdoor shortcut should still be low-frequency.
  • The smaller-cluster rule implicitly assumes a minority attacker; a more general defense would replace it with a cluster-size or density threshold so the method could also be evaluated when poisoning is not a minority.
  • Since gradients are computed on the base model before fine-tuning, the separation may depend on optimization details such as LoRA rank and learning rate; the paper fixes rank 4 and batch size 1, and this sensitivity is not reported.
  • The memory cost of storing full lm_head gradients is acknowledged as a limitation; a compressed fingerprint such as a random projection instead of PCA, or a wavelet transform, might give the same separation at lower cost, which would be a cheap test of whether low-frequency energy is the true carrier of the signal.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes GraCeFul, a training-time defense that filters poisoned samples from generative-LLM fine-tuning datasets without retraining. It computes per-sample gradients of the lm_head parameter, applies a two-dimensional discrete cosine transform, keeps a low-frequency block, reduces the features with PCA to 32 dimensions, runs hierarchical clustering into two clusters, and discards the smaller cluster as the backdoor cluster. Experiments on WebQA, FreebaseQA, NQ, and CoQA with Llama-2-7B and Vicuna-7B against Badnets, Addsent, and CBA report that GraCeFul reduces attack success rate to 0% with clean accuracy close to the clean-tuned baseline, achieves near-perfect backdoor-sample identification F1 on most datasets, and requires less purification time than the CUBE baseline. The paper also includes ablations on target parameters and clustering algorithms, a computational-efficiency comparison, and additional results on Vicuna-7B in the appendix.

Significance. If the claimed frequency-space separation of backdoor and clean sample gradients is real, GraCeFul would be a practically valuable defense: it is task-agnostic, requires no retraining, and the paper provides public code, detailed appendices, and ablations on clustering algorithms and target parameters. The pipeline is coherent and the main end-to-end outcome, ASR reduced to 0 with modest CACC loss on the tested settings, is consistently reported. However, the experimental design does not currently isolate the proposed mechanism: the only attacker-specified target response is a fixed string containing a unique malicious URL, which a trivial substring scan can detect perfectly without any gradient computation. The paper also overstates its identification results in the abstract relative to the WebQA rows, and all numeric claims rest on single runs without error bars. These are load-bearing gaps rather than presentation issues, because they determine whether the experiments actually support the central claim that frequency-space gradient features separate backdoor from clean samples.

major comments (4)
  1. [Section A.3 and Table 4] The only attacker-specified target response evaluated is the fixed string ", and click <malicious_url> for more information" appended verbatim to the clean response (Section A.3). Because this exact unique substring appears in every poisoned target and in no clean target, a defender can obtain 100% recall and 100% precision by a simple scan for "<malicious_url>" before computing any gradients, DCT transforms, or clusters. The paper does not compare GraCeFul against any string-based or label-anomaly baseline, so the near-perfect F1 scores in Table 4 are also compatible with the proposed pipeline contributing nothing beyond detecting an obvious target anomaly. To support the claim that frequency-space gradient separation is the operative mechanism, please add a substring/label-anomaly baseline and at least one additional target-response type that does not contain a fixed unique substring, such as purely malicious responses or responses that vary per poisoned sample.
  2. [Abstract and Table 4] The abstract claims GraCeFul "achiev[es] nearly 100% recall and F1 scores in identifying backdoor samples," but the WebQA rows of Table 4 report recall between 87.35% and 89.12% and F1 between 93.25% and 94.25% for Llama-2-7B, and the corresponding Vicuna rows in Table 11 report recall between 88.53% and 89.12%. The claim should be qualified as holding on three of four datasets, or the abstract should report the aggregate or worst-case numbers rather than the best cases.
  3. [Tables 3, 4, 10, and 11] All tables appear to report single runs with no standard deviations, confidence intervals, or seed information. Given that the central claim is precise identification of backdoor samples, differences such as WebQA recall of 87.35% versus 100% on other datasets, and CACC differences of roughly 1-2% across attacks, may plausibly be within run-to-run variation. Please report multiple seeds with means and error bars for the headline defense and identification tables, or explicitly justify why the reported numbers are deterministic.
  4. [Section 4, Filtering, and Figure 3] The filtering step assumes the backdoor samples form the smaller of the two clusters, which is an unquantified attack-stealth assumption. Figure 3 shows that CACC collapses once the poison ratio reaches 0.3, while ASR remains 0; at a 30% poison ratio the smaller-cluster rule either misidentifies the clean minority as the backdoor cluster or removes so many samples that fine-tuning degrades. The paper should state the largest poison ratio for which the defense is intended, quantify the failure mode, and discuss how a defender could detect that the assumption is violated, rather than only attributing the collapse to fewer remaining clean samples.
minor comments (6)
  1. [Section 5.2] In the poison-ratio paragraph, "abd" should be "and" in the sentence "higher poison ratios degrade normal performance abd compromise attack stealth."
  2. [Section 5.4 heading] The section heading uses "GraceFul" while the rest of the paper uses "GraCeFul"; please make the capitalization consistent.
  3. [Figure 3] The ASR subplot appears to be a flat line at 0, but the axis scale and the zero values are difficult to read; adding axis labels and a zoomed view or jitter would make the claimed ASR reduction visible.
  4. [Limitations] The Limitations section states that storing lm_head sample-wise gradients imposes significant memory requirements, but the paper does not quantify this cost; reporting the measured memory footprint for Llama-2-7B and Vicuna-7B would help practitioners assess deployability.
  5. [Section 3.3 and Related Work] The motivation heavily relies on the frequency-space learning behavior reported in Wu et al. (2024), which is the same group's prior work; please clarify explicitly which parts are prior findings and which parts are newly established here, namely that sample-wise lm_head gradients after DCT separate backdoor from clean samples.
  6. [Section 5.2 and Table 3] The paper compares against four defense baselines but not against any simple data-only baseline such as target-string filtering, outlier detection on target embeddings, or token-level anomaly detection; adding at least one such baseline would strengthen the claim that the proposed feature representation is necessary rather than incidental.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the GraCeFul derivation is an empirical observation plus unsupervised clustering, with only a minor non-load-bearing self-citation.

full rationale

The derivation chain is self-contained. Section 3.3 independently establishes the frequency-space separation of lm_head gradients (Figure 1, silhouette scores) on poisoned FreebaseQA; Section 4 then converts this into an unsupervised three-step pipeline (DCT, hierarchical clustering, discard smaller cluster) with no parameters fitted to the reported F1/ASR values. The 'discard the smaller cluster' rule is an explicit stealth assumption (Section 4, Filtering), not a circular reduction. The only author-overlapping citation is Wu et al. (2024), used for the frequency-space convergence motivation and as a baseline; because the paper verifies the separation on its own data and the Deep Frequency Principle is externally cited and ablated (Table 5), this self-citation is not load-bearing. Separately, the experimental evaluation has a notable confound: all three attacks use the same fixed target suffix ', and click <malicious_url> for more information' (Sections 3.2 and A.3), so a trivial substring scan would match the reported near-100% recall/F1; this is a benchmark-design/correctness concern rather than a circularity in the derivation, and it does not raise the circularity score.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

GraCeFul is an empirical pipeline rather than a derived theory. The ledger counts four hand-chosen hyperparameters (1/64 DCT retention, 32-D PCA, cluster count 2, target lm_head) that are not fitted to a target metric but also lack a broad sensitivity analysis. The axioms capture the domain assumptions: small poison ratio, separability of DCT gradient features, the Deep Frequency Principle, and white-box access. No invented entities appear; the method reuses DCT, PCA, and hierarchical clustering.

free parameters (4)
  • low_frequency_retention_fraction = 1/64
    Keeps the top-left 1/8 x 1/8 = 1/64 DCT coefficients of lm_head gradients; chosen for efficiency and no sensitivity analysis is reported.
  • PCA_target_dimension = 32
    Flattened DCT features are reduced to 32 dimensions; fixed across all experiments, with no ablation on this value.
  • number_of_clusters = 2
    Hierarchical clustering is forced to produce exactly two clusters, implicitly assuming the dataset contains only one clean class and one backdoor class.
  • target_parameter = lm_head
    Gradients are computed only for lm_head; ablation shows a first-layer LoRA parameter fails, so the choice is load-bearing and is justified only by the cited Deep Frequency Principle.
assumptions (4)
  • domain assumption Attack stealth implies poison ratio < 0.5, so the backdoor cluster is the smaller of two clusters.
    Used in Section 4 Filtering to label the smaller cluster as backdoor; Figure 3 shows failure at poison ratio 0.3.
  • domain assumption Sample-wise lm_head gradients from a clean pretrained model on poisoned data are separable in low-frequency DCT space.
    This is the central empirical premise established in Section 3.3 via visualizations and silhouette scores, not derived from first principles.
  • standard math Deep Frequency Principle (Xu and Zhou 2021): deeper parameters amplify frequency-space divergence.
    Invoked in Sections 3.3 and 5.4 to motivate lm_head as the target parameter; it is a cited prior result, not verified here.
  • domain assumption The defender has white-box access to the pretrained model and can run per-sample backward passes.
    Stated in the Limitations; without parameter access, sample-wise gradients are unavailable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining." pith.science (2026). https://pith.science/paper/3HLDEB4U

@misc{pith2026241202454,
  author       = {Pith},
  title        = {Pith review of: Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retraining},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3HLDEB4U}},
  note         = {Machine review of arXiv:2412.02454}
}
read the original abstract

Backdoor attacks remain significant security threats to generative large language models (LLMs). Since generative LLMs output sequences of high-dimensional token logits instead of low-dimensional classification logits, most existing backdoor defense methods designed for discriminative models like BERT are ineffective for generative LLMs. Inspired by the observed differences in learning behavior between backdoor and clean mapping in the frequency space, we transform gradients of each training sample, directly influencing parameter updates, into the frequency space. Our findings reveal a distinct separation between the gradients of backdoor and clean samples in the frequency space. Based on this phenomenon, we propose Gradient Clustering in the Frequency Space for Backdoor Sample Filtering (GraCeFul), which leverages sample-wise gradients in the frequency space to effectively identify backdoor samples without requiring retraining LLMs. Experimental results show that GraCeFul outperforms baselines significantly. Notably, GraCeFul exhibits remarkable computational efficiency, achieving nearly 100% recall and F1 scores in identifying backdoor samples, reducing the average success rate of various backdoor attacks to 0% with negligible drops in clean accuracy across multiple free-style question answering datasets. Additionally, GraCeFul generalizes to Llama-2 and Vicuna. The codes are publicly available at https://github.com/ZrW00/GraceFul.

Figures

Figures reproduced from arXiv: 2412.02454 by the authors.

Figure 1
Figure 1. Visualization of sample-wise feature distri [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Overview of GraCeFul. GraCeFul is a three-step defense pipeline deployed before training the LLM on the [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. CACC and ASR of GraCeFul when adopting Llama-2-7B as the target LLM on backdoor-poisoned WebQA under diverse poison ratios. table CACC drops on both contextual and non￾contextual datasets. DeCE maintains CACC but of￾fers minimal defense except against CBA. Overall, baselines struggle to maintain acceptable CACC while providing satisfactory defense. Compared to the baselines, GraCeFul consis￾tently eliminates ASR and… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Visualization of the ground-truth and clustering-predicted sample-wise feature distributions utilized by [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Visualization of the ground-truth and clustering-predicted sample-wise feature distributions utilized by [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

48 extracted references · 23 canonical work pages

  1. [1]

    Nasir Ahmed, T\_ Natarajan, and Kamisetty R Rao. 1974. https://doi.org/10.1109/T-C.1974.223784 Discrete cosine transform . IEEE transactions on Computers, 100(1):90--93

    arXiv 1974

  2. [2]

    Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. https://aclanthology.org/2024.findings-acl.894 Here's a free lunch: Sanitizing backdoored models with model merge . In Findings of the Association for Computational Linguistics ACL 2024, pages 15059--15075, Bangkok, Thailand and virtual meeting

    work page 2024

  3. [3]

    Jonathan Berant, Andrew Chou, Roy Frostig, and Percy Liang. 2013. https://aclanthology.org/D13-1160.pdf Semantic parsing on freebase from question-answer pairs . In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1533--1544, Seattle, USA

    work page 2013

  4. [4]

    Chuanshuai Chen and Jiazhu Dai. 2021. https://doi.org/10.1016/j.neucom.2021.04.105 Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification . Neurocomputing, 452:253--262

    work page doi:10.1016/j.neucom.2021.04.105 2021

  5. [5]

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. 2024 a . https://doi.org/10.48550/arXiv.2405.13401 Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models . arXiv preprint arXiv:2405.13401

    arXiv doi:10.48550/arxiv.2405.13401 2024

  6. [6]

    Pengzhou Cheng, Zongru Wu, Wei Du, and Gongshen Liu. 2023. https://doi.org/10.48550/arXiv.2309.06055 Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review . arXiv preprint arXiv:2309.06055

    arXiv doi:10.48550/arxiv.2309.06055 2023

  7. [7]

    Pengzhou Cheng, Zongru Wu, Tianjie Ju, Wei Du, and Zhuosheng Zhang Gongshen Liu. 2024 b . https://doi.org/10.48550/arXiv.2408.09878 Transferring backdoors between large language models by knowledge distillation . arXiv preprint arXiv:2408.09878

    arXiv doi:10.48550/arxiv.2408.09878 2024

  8. [8]

    Gonzalez, Ion Stoica, and Eric P

    Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023. https://lmsys.org/blog/2023-03-30-vicuna/ Vicuna: An open-source chatbot impressing gpt-4 with 90\

    2023

Show all 48 references
  1. [9]

    Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. 2022. https://proceedings.neurips.cc/paper_files/paper/2022/file/2052b3e0617ecb2ce9474a6feaf422b3-Paper-Datasets_and_Benchmarks.pdf A unified evaluation of textual backdoor learning: Frameworks and...

    2022

  2. [10]

    Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. https://doi.org/10.1109/ACCESS.2019.2941376 A backdoor attack against lstm-based text classification systems . IEEE Access, 7:138872--138878

    2019

  3. [11]

    Qingxiu Dong, Lei Li, Damai Dai, Ce Zheng, Zhiyong Wu, Baobao Chang, Xu Sun, Jingjing Xu, and Zhifang Sui. 2022. https://doi.org/10.48550/arXiv.2301.00234 A survey on in-context learning . arXiv preprint arXiv:2301.00234

    2022 doi arXiv

  4. [12]

    Hossein Fereidooni, Alessandro Pegoraro, Phillip Rieger, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. 2024. https://doi.org/10.14722/ndss.2024.24620 Freqfed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning . In Proceedings of the 202...

    2024

  5. [13]

    Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C Ranasinghe, and Hyoungshick Kim. 2021. https://doi.org/10.1109/TDSC.2021.3055844 Design and evaluation of a multi-domain trojan detection method on deep neural networks . IEEE Transactions...

    2021

  6. [14]

    Muhammad Usman Hadi, Rizwan Qureshi, Abbas Shah, Muhammad Irfan, Anas Zafar, Muhammad Bilal Shaikh, Naveed Akhtar, Jia Wu, Seyedali Mirjalili, et al. 2023. https://doi.org/10.36227/techrxiv.23589741.v1 A survey on large language models: Applications, challenges, limitations, a...

    2023 doi

  7. [15]

    Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2022. https://openreview.net/forum?id=nZeVKeeFYf9 Lora: Low-rank adaptation of large language models . In Proceedings of the 10th International Conference on Learning Representa...

    2022

  8. [16]

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. https://doi.org/10.18653/v1/2024.findings-naacl.94 Composite backdoor attacks against large language models . In Findings of the Association for Computational Linguistics: NAACL 2024, pages 1459--1472, Me...

    2024 doi

  9. [17]

    Kelvin Jiang, Dekun Wu, and Hui Jiang. 2019. https://doi.org/10.18653/v1/N19-1028 Freebaseqa: A new factoid qa data set matching trivia-style question-answer pairs with freebase . In Proceedings of the 2019 Conference of the North American Chapter of the Association for Comput...

    2019 doi

  10. [18]

    Lesheng Jin, Zihan Wang, and Jingbo Shang. 2022. https://doi.org/10.18653/v1/2022.emnlp-main.798 Wedef: Weakly supervised backdoor defense for text classification . In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 11614--11626, A...

    2022 doi

  11. [19]

    Keita Kurita, Paul Michel, and Graham Neubig. 2020. https://doi.org/10.18653/v1/2020.acl-main.249 Weight poisoning attacks on pretrained models . In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 2793--2806, Online

    2020 doi

  12. [20]

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. 2019. https://doi.org/10.1162/tacl_a_00276 Natural questions: a benchmark for question answering research ....

    2019 doi

  13. [21]

    Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. 2024 a . https://openreview.net/forum?id=duZANm2ABX Badedit: Backdooring large language models by model editing . In The Twelfth International Conference on Learning Repr...

    2024

  14. [22]

    Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasubramanian, and Radha Poovendran. 2024 b . https://doi.org/10.48550/arXiv.2406.12257 Cleangen: Mitigating backdoor attacks for generation tasks in large language models . arXiv preprint arXiv:2406.12257

    2024 doi arXiv

  15. [23]

    Zichao Li, Dheeraj Mekala, Chengyu Dong, and Jingbo Shang. 2021. https://doi.org/10.18653/v1/2021.findings-emnlp.40 Bfclass: A backdoor-free text classification framework . In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 444--453, Punta Cana, Do...

    2021 doi

  16. [24]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. https://doi.org/10.14722/ndss.2018.23291 Trojaning attack on neural networks . In Proceedings of the 25th Annual Network And Distributed System Security Symposium (NDSS 2018)...

    2018

  17. [25]

    Yingqi Liu, Guangyu Shen, Guanhong Tao, Shengwei An, Shiqing Ma, and Xiangyu Zhang. 2022. https://doi.org/10.1109/SP46214.2022.9833579 Piccolo: Exposing complex backdoors in nlp transformer models . In Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), pages ...

    2022

  18. [26]

    Sourab Mangrulkar, Sylvain Gugger, Lysandre Debut, Younes Belkada, Sayak Paul, and Benjamin Bossan. 2022. Peft: State-of-the-art parameter-efficient fine-tuning methods. https://github.com/huggingface/peft

    2022

  19. [27]

    Leland McInnes, John Healy, Nathaniel Saul, and Lukas Grossberger. 2018. https://doi.org/10.21105/joss.00861 Umap: Uniform manifold approximation and projection . The Journal of Open Source Software, 3(29):861

    2018 doi

  20. [28]

    Adam Paszke, Sam Gross, Luca Antiga, et al. 2019. https://proceedings.neurips.cc/paper_files/paper/2019/file/bdbca288fee7f92f2bfa9f7012727740-Paper.pdf Pytorch: An imperative style, high-performance deep learning library . In Advances in Neural Information Processing Systems 3...

    2019

  21. [29]

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021. https://doi.org/10.18653/v1/2021.emnlp-main.752 Onion: A simple and effective defense against textual backdoor attacks . In Proceedings of the 2021 Conference on Empirical Methods in Natural Langu...

    2021 doi

  22. [30]

    Siva Reddy, Danqi Chen, and Christopher D Manning. 2019. https://doi.org/10.1162/tacl_a_00266 Coqa: A conversational question answering challenge . Transactions of the Association for Computational Linguistics, 7:249--266

    2019 doi

  23. [31]

    Peter J Rousseeuw. 1987. https://doi.org/10.1016/0377-0427(87)90125-7 Silhouettes: a graphical aid to the interpretation and validation of cluster analysis . Journal of computational and applied mathematics, 20:53--65

    1987 doi

  24. [32]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. https://doi.org/10.48550/arXiv.2307.09288 Llama 2: Open foundation and fine-tuned chat models . arXiv prepri...

    2023 doi arXiv

  25. [33]

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. 2022. https://proceedings.neurips.cc/paper_files/paper/2022/hash/4491ea1c91aa2b22c373e5f1dfce234f-Abstract-Datasets_and_Benchmarks.html Backdoorbench: A comprehensive benchmark of backdo...

    2022

  26. [34]

    Zongru Wu, Zhuosheng Zhang, Pengzhou Cheng, and Gongshen Liu. 2024. https://aclanthology.org/2024.acl-long.441 Acquiring clean language models from backdoor poisoned datasets by downscaling frequency space . In Proceedings of the 62nd Annual Meeting of the Association for Comp...

    2024

  27. [35]

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. 2024. https://openreview.net/forum?id=c93SBwz1Ma Badchain: Backdoor chain-of-thought prompting for large language models . In The Twelfth International Conference on Learning Represen...

    2024

  28. [36]

    Kai Xu, Minghai Qin, Fei Sun, Yuhao Wang, Yen-Kuang Chen, and Fengbo Ren. 2020 a . https://openaccess.thecvf.com/content_CVPR_2020/html/Xu_Learning_in_the_Frequency_Domain_CVPR_2020_paper.html Learning in the frequency domain . In Proceedings of the IEEE/CVF conference on comp...

    2020

  29. [37]

    Zhi-Qin John Xu, Yaoyu Zhang, Tao Luo, Yanyang Xiao, and Zheng Ma. 2020 b . https://doi.org/10.4208/cicp.OA-2020-0085 Frequency principle: Fourier analysis sheds light on deep neural networks . Communications in Computational Physics, 28(5):1746--1767

    2020 doi

  30. [38]

    Zhiqin John Xu and Hanxu Zhou. 2021. https://doi.org/10.1609/aaai.v35i12.17261 Deep frequency principle towards understanding why deeper learning is faster . In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 10541--10550, Online

    2021 doi

  31. [39]

    Guang Yang, Yu Zhou, Xiang Chen, Xiangyu Zhang, Terry Yue Zhuo, David Lo, and Taolue Chen. 2024. https://doi.org/10.48550/arXiv.2407.08956 Dece: Deceptive cross-entropy loss designed for defending backdoor attacks . arXiv preprint arXiv:2407.08956

    2024 doi arXiv

  32. [40]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. https://doi.org/10.18653/v1/2021.emnlp-main.659 Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models . In Proceedings of the 2021 Conference on Empirical Methods in Natural Langua...

    2021 doi

  33. [41]

    Zhiyuan Zhang, Deli Chen, Hao Zhou, Fandong Meng, Jie Zhou, and Xu Sun. 2023. https://doi.org/10.18653/V1/2023.findings-acl.157 Diffusion theory as a scalpel: Detecting and purifying poisonous dimensions in pre-trained language models caused by backdoor or bias . In Findings o...

    2023 doi

  34. [42]

    Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, and Jinming Wen. 2024 a . https://doi.org/10.18653/v1/2024.findings-naacl.217 Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning . In Findings of the Association for ...

    2024 doi

  35. [43]

    Shuai Zhao, Meihuizi Jia, Luu Anh Tuan, and Jinming Wen. 2024 b . https://doi.org/10.48550/arXiv.2401.05949 Universal vulnerabilities in large language models: In-context learning backdoor attacks . arXiv preprint arXiv:2401.05949

    2024 doi arXiv

  36. [44]

    Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et al. 2023. https://doi.org/10.48550/arXiv.2303.18223 A survey of large language models . arXiv preprint arXiv:2303.18223

    2023 doi arXiv

  37. [45]

    Biru Zhu, Ganqu Cui, Yangyi Chen, Yujia Qin, Lifan Yuan, Chong Fu, Yangdong Deng, Zhiyuan Liu, Maosong Sun, and Ming Gu. 2023. https://doi.org/10.1162/tacl_a_00622 Removing backdoors in pre-trained models by regularized continual pre-training . Transactions of the Association ...

    2023 doi

  38. [46]

    Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, et al. 2022. https://proceedings.neurips.cc/paper_files/paper/2022/file/0799492e7be38b66d10ead5e8809616d-Paper-Conference.pdf Moderate-fitting as a natural bac...

    2022

  39. [47]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  40. [48]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.