A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations

Qingchuan Zhao; Tao Ni; Wei-Bin Lee; Yihe Zhou

REVIEW 4 major objections 6 minor 6 cited by

A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations

T0 review · 4 major / 6 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This survey organizes backdoor attacks on large language models into a three-phase taxonomy based on the model construction pipeline: pre-training, fine-tuning, and inference.

desk verdict Useful but rough survey; the phase taxonomy has a load-bearing misclassification, so use it as a pointer map, not an authority. read the letter →

arxiv 2502.05224 v1 pith:LLM55LWB submitted 2025-02-06 cs.CR cs.AI

Yihe Zhou , Tao Ni , Wei-Bin Lee , Qingchuan Zhao This is my paper · ORCID

classification cs.CRcs.AI

keywords largelanguagemodelsbackdoorattacksdefensestaxonomydatapoisoningmodeleditingretrieval-augmentedgenerationinstructiontuning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish that backdoor threats to LLMs are best understood through a taxonomy aligned with how models are built: attacks occur during pre-training, fine-tuning, or inference. It argues that most LLM backdoors are training-time, white-box integrity attacks, and it classifies the literature accordingly. It then pairs each attack class with corresponding defenses, which are split into pre-training and post-training measures, and it standardizes evaluation around common metrics and datasets. A sympathetic reader would use this map to see where a given attack enters the pipeline and which defense or evaluation practice applies to it.

What carries the argument

The central object is a phase-based taxonomy adapted from the general machine-learning attack framework of goals, capabilities, and phase. The paper's specific instrument is the three-phase split (pre-training, fine-tuning, inference) cross-cut by trigger types (character, word, sentence, syntax, semantic, style, punctuation, and multi-turn). This taxonomy does the work of placing every surveyed attack and defense into a common coordinate system so that attack style, threat model, and defense response can be compared across papers.

What would settle it

Audit the papers grouped under pre-training: if a substantial number, such as GCG, GCQ, or AutoPrompt, do not poison training data or model weights and instead optimize prompts at inference time, then the phase partition mislabels the literature and the taxonomy's organizing claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that backdoor threats to large language models are best understood as a problem of the model construction pipeline. It organizes attacks into three phases: pre-training attacks (gradient-based trigger optimization, knowledge distillation, model editing, and GPT-assisted data generation), fine-tuning attacks (regular fine-tuning, parameter-efficient fine-tuning, instruction tuning, federated learning, prompt-based tuning, reinforcement-learning alignment, LLM agents, and code models), and inference-phase attacks (instruction backdoors, knowledge poisoning of retrieval databases, in-context learning, and physical-level perturbations of multimodal inputs). Defenses are sorted into pre-training and post-training stages, covering detection, filtering, model repair, distillation, and proactive safety training. Evaluation is standardized around Attack Success Rate, Clean Accuracy, AUC, Performance Drop Rate, and Label Flip Rate, together with benchmark datasets and baseline defenses such as ONION.

Load-bearing premise

The taxonomy assumes every published backdoor attack can be assigned to exactly one phase of the model construction pipeline, and that the papers placed in each phase actually operate in that phase, for instance that gradient-based trigger optimization counts as a pre-training backdoor rather than a general adversarial-prompt technique.

Editorial extensions

If this is right

A defender who knows the phase at which a backdoor enters can choose a matching defense: pre-training defenses for weight or data poisoning, post-training filtering for input triggers, and retrieval-level defenses for knowledge poisoning.
Fine-tuning phase attacks are emphasized as the most practical threat because public pre-trained models and poisoned downstream datasets are common in the LLM supply chain.
Standard metrics such as ASR, Clean Accuracy, PDR, and LFR allow attack and defense results to be compared across studies, making the field's evaluations more reproducible.
Inference-phase attacks extend backdoors to retrieval-augmented generation and in-context learning, so defenses must cover external knowledge resources and demonstration contexts, not just model weights.
The taxonomy implies that no single defense works for all backdoors, since each phase offers a different injection and activation surface.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The authors leave implicit that the phase axis could be crossed with a separate technique axis; placing adversarial prompt optimization under pre-training suggests the taxonomy may conflate poisoning-based backdoors with inference-time prompt attacks.
A natural extension is to apply the same phase-based structure to multimodal LLMs, treating image triggers and physical-world triggers as a new trigger level rather than a separate category.
The evaluation section points toward a missing shared benchmark for inference-phase RAG attacks; constructing such a benchmark would test whether the phase boundaries predict real-world exploitability.
The survey's phase framing suggests that proactive pre-training defenses deserve more attention than reactive inference-time filtering, since backdoors persist through standard safety training.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a useful but rough literature map. If you're entering LLM backdoor research it's a decent starting point; if you want an authoritative taxonomy, don't rely on it yet.

What's genuinely good: it collects a lot of material—attacks, defenses, trigger taxonomies, metrics, datasets—across plain LLMs, multimodal LLMs, code models, and agents. The trigger-type table and the attack/defense overview tables are handy. It also makes a fair point that many defenses are only tested on classification and that generation tasks are under-explored. For a newcomer, the paper saves time.

The problems are concentrated in the organizing claim. The abstract says the scope is training-time white-box backdoors, but the body covers inference-phase and black-box attacks. That's an internal contradiction. More seriously, Section 3.1.1 puts GCG, GCQ, AutoPrompt, and GBRT under 'pre-training phase attacks.' Those are adversarial prompt optimization methods that work against a fixed model; they don't poison pre-training data or modify weights. The paper even says the trigger optimization strategy 'could be utilized inclusively across different phases,' which directly conflicts with filing them exclusively under pre-training. This isn't a footnote-level quibble: an entire subsection of the phase taxonomy is built on non-backdoor, inference-time attacks. It makes the central 'systematic taxonomy' claim unsupported as written.

There are also smaller editorial issues: a duplicated sentence in Section 2.2, 'Guanoco-7B' in Table 4, and the fragment 'STRIP-ViTA. [128] A test-time detection...' which looks like a truncated bullet. And there's no methodology section describing how papers were selected, so it's hard to assess completeness.

The math and data aren't the issue here—it's a survey, so there are no new derivations to check. The citation pattern is broad and mostly appropriate. The problems are structural and editorial, fixable with a revision.

Who it's for: graduate students and researchers wanting a quick overview of the LLM backdoor landscape. It deserves a serious referee, but not in its current form—the phase taxonomy needs to be reworked or explicitly reframed as a technique-based rather than phase-based organization, and the scope contradiction needs to be resolved.

Referee Report

4 major / 6 minor

Summary. The manuscript surveys backdoor threats in large language models, organizing attacks into a phase-based taxonomy (pre-training, fine-tuning, inference), pairing them with defenses (pre-training and post-training), and summarizing evaluation practices such as metrics, baselines, and datasets. The stated main contribution is a systematic taxonomy of LLM backdoor attacks along the model construction pipeline, supported by overview figures and detailed tables of attacks, defenses, and trigger types. The paper also includes discussion of LLM agents, code models, retrieval-augmented generation, and multimodal LLMs.

Significance. If the taxonomy were accurate and internally consistent, the survey would be a useful reference map for the LLM backdoor literature: it collects a large and recent body of work, provides side-by-side tables of attacks and defenses, and consolidates commonly used metrics and datasets. The manuscript does not present new empirical results or machine-checked proofs, so its value is organizational; consequently, the correctness of the organization is the central issue. The current phase taxonomy is not reliable: at least one full subsection under pre-training attacks contains methods that are not backdoor attacks at all, and several model-editing attacks are placed in a phase that contradicts their own description. The significance of the survey is therefore contingent on correcting these classification errors.

major comments (4)

[§3.1.1 and Table 4; also §3.3.4] The central organizing claim is the phase-based taxonomy in Section 3 and Figure 2, but Section 3.1.1 classifies GCG [37], GCQ [38], AutoPrompt [39], and GBRT [40] as pre-training phase backdoor attacks. In their original papers these methods optimize token-level or prompt-level perturbations against an already-trained or black-box model; they do not poison pre-training data, they do not modify model weights, and they do not require white-box access to a training process. The text itself states that the trigger optimization strategy 'could be utilized inclusively across different phases,' which is incompatible with listing these works under 'Pre-training Phase Attacks.' Table 4 repeats the misclassification in the GCG, GCQ, and GBRT rows. A further instance of the same conflation appears in §3.3.4, where Anydoor [116] is classified as a physical-level backdoor even though the paper describes it as a test-time attack that does not poison training data. Because the taxonomy is the paper's main contribution, this is a load-bearing correctness issue rather than a labeling quibble.
[§3.1.3 and Figure 3] Model editing is grouped under pre-training phase attacks, but several entries in §3.1.3 are explicitly post-training operations. BadEdit 'requires no model re-training' and directly modifies weights in an already-built model; MEGen edits a small set of local parameters; TA2 manipulates activations in the residual stream; and the architectural backdoor hides modules within the model architecture. Under the paper's own two-stage definition (backdoor injection during training followed by activation at inference), these are not pre-training attacks unless the authors explicitly redefine 'pre-training phase' to mean 'any pre-deployment model modification.' No such definition is given. This weakens the claim that Figure 2 is a phase-based taxonomy and should be fixed by either moving model-editing attacks to a separate phase or providing a clear argument for why they belong in pre-training.
[Abstract, §1, §3.3] The abstract restricts the survey's scope to 'training-time white-box backdoor attacks,' and §1 says that other settings will be 'mentioned inclusively in the later sections.' However, §3.3 is a full section on inference-phase attacks and explicitly states that these attacks 'fall under black-box settings.' The taxonomy in Figure 2, the overview tables, and the defense discussion all treat inference-phase and black-box attacks as first-class categories, not as inclusive mentions. This internal contradiction makes it unclear whether the survey claims to cover poisoning-based backdoors only or also adversarial test-time triggers. The abstract and introduction should be revised to match the actual scope of the manuscript, or the inference-phase section should be substantially curtailed.
[§3.2.3, references [152]–[168]] The sentence about instruction-tuning backdoors cites references [152]–[168] as support for the claim that attackers find a universal backdoor trigger embedded in the input query. These references include physical adversarial patches, side-channel attacks, malware classifiers, and other topics unrelated to instruction-tuning backdoors. This is not a harmless typo: a reader cannot trace the claimed universal-trigger statement to relevant primary sources. The citation block should be replaced with the actual instruction-tuning backdoor papers or removed. Given that the survey's value depends on its role as a reference map, the bibliography needs a careful audit for similar citation errors.

minor comments (6)

[§2.2] The sentence 'The attacker first performs backdoor training using poisoned data, then activates the backdoor using the trigger during inference' appears twice in succession verbatim; one copy should be deleted.
[Table 4] The model name 'Guanoco-7B' should be 'Guanaco-7B,' the baseline 'AutoPropmt' should be 'AutoPrompt,' and 'QWen2-7B' should be 'Qwen2-7B.'
[§5.1.2] 'BLEU&ROUGH' should read 'BLEU & ROUGE.'
[§4.2.1] The phrase 'STRIP-ViTA. [128] A test-time detection defense framework' contains an erroneous period after 'ViTA'; it should be rewritten as 'STRIP-ViTA [128] is a test-time detection defense framework that...'.
[§4.1 and §5.2] There are several prose polish issues: 'However, We argue' capitalizes 'We' mid-sentence; 'section IV .B' has an extra space and refers to takeaway numbering rather than a numbered section; and 'Alpacaeval' should be 'AlpacaEval.'
[§5 (Evaluation Methodology)] The survey would benefit from a short paragraph in Section 1 describing the paper selection process (databases, years, inclusion criteria), since the current claim of providing an 'extensive summary' is difficult to evaluate without any documented search protocol.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: this survey summarizes external literature and its taxonomy is not derived from its own conclusions.

full rationale

This is a survey paper with no fitted parameters, no predictive model, and no derivation chain. Its organizing claim is a phase-based taxonomy of published backdoor attacks, defenses, and evaluation metrics, each attributed to external cited works. None of the classifications is defined in terms of the survey's own conclusions, and no cited result is invoked as evidence for a claim that is itself used to justify the citation. The self-citations in the reference list appear in general citation clusters and are not load-bearing for the taxonomy or the evaluation discussion. Even where a reader might disagree with a placement (e.g., GCG and AutoPrompt under pre-training in Section 3.1.1), that is a question of taxonomic accuracy or category fit, not circular reasoning: the survey does not derive the attack's properties from the category, nor fit a parameter and call it a prediction. The limitation statements in the Takeaways boxes are explicit about scope and do not conceal a circular step. Under the hard rule requiring a quoted reduction or fitted-input-prediction equivalence, no circular step can be exhibited, so the appropriate finding is no significant circularity.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

This is a survey, so the only 'free parameters' are the subjective choices of which papers to include and how to categorize them. No numbers are fitted to data and no new entities are introduced.

assumptions (3)

domain assumption The surveyed primary papers are accurately summarized in the categories assigned to them.
The survey relies on secondary interpretation of roughly one hundred cited papers without reproducing their experiments or checking against the original threat models.
ad hoc to paper The phase-based taxonomy (pre-training, fine-tuning, inference) is a valid, non-overlapping partition of backdoor attacks.
Used throughout Section 3 as the organizing principle, but the paper itself includes attacks that span phases and lists adversarial prompt attacks in the pre-training bucket.
ad hoc to paper The selected papers are a representative sample of the field despite no documented search protocol.
Section 1 claims an extensive summary, but no inclusion or exclusion criteria are given, so representativeness is assumed rather than demonstrated.

how reviews work

0 comments

Cite this review

Pith. "Pith review of A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations." pith.science (2026). https://pith.science/paper/LLM55LWB

@misc{pith2026250205224,
  author       = {Pith},
  title        = {Pith review of: A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LLM55LWB}},
  note         = {Machine review of arXiv:2502.05224}
}

read the original abstract

Large Language Models (LLMs) have achieved significantly advanced capabilities in understanding and generating human language text, which have gained increasing popularity over recent years. Apart from their state-of-the-art natural language processing (NLP) performance, considering their widespread usage in many industries, including medicine, finance, education, etc., security concerns over their usage grow simultaneously. In recent years, the evolution of backdoor attacks has progressed with the advancement of defense mechanisms against them and more well-developed features in the LLMs. In this paper, we adapt the general taxonomy for classifying machine learning attacks on one of the subdivisions - training-time white-box backdoor attacks. Besides systematically classifying attack methods, we also consider the corresponding defense methods against backdoor attacks. By providing an extensive summary of existing works, we hope this survey can serve as a guideline for inspiring future research that further extends the attack scenarios and creates a stronger defense against them for more robust LLMs.

Figures

Figures reproduced from arXiv: 2502.05224 by the authors.

**Figure 2.** An overview of backdoor attacks taxonomy. [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** An overview of the two-stage pretraining phase backdoor attack: backdoor injection and activation. Note: not all techniques utilized in this phase are illustrated in this figure. Refer to the main text for detailed implementation. 3.1.2. Knowledge Distillation. Knowledge Distillation (KD) is a model compression technique where a student model is trained under the guidance of a teacher model, which facilitates a m… view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: An overview of fine-tuning phase backdoor attack. common for practitioners to download pre-trained models and conduct fine-tuning on downstream datasets, thus making poisoning attack during finetuning a more realistic attack in a real-world scenario, attacks in this …

**Figure 5.** Figure 5: An overview of inference phase knowledge poisoning backdoor attack. nario involves users utilizing prompts and instructions to customize the model for specific downstream tasks. In the inference phase, where the model parameters remain fixed and unalterable, potenti…

**Figure 6.** Figure 6: An overview of backdoor attacks taxonomy. [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

**Figure 7.** Figure 7: A brief overview of backdoor defenses in the model construction pipeline: from pretraining phase to post-training phase defenses. been shown to be vulnerable to the clean-label poisoning attack EntF [210], which entangles the features of training samples from differen…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 6 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulation
cs.CV 2025-06 conditional novelty 7.0 of 10

BadSem shows that semantic mismatches between images and text can serve as stealthy backdoor triggers for VLMs, achieving near-perfect attack success with low poisoning rates.
Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection
cs.CR 2026-07 conditional novelty 6.0 of 10

A jointly optimized gradient-mask plus band-aid patch reportedly bypasses visible-infrared fused face detectors with >90% attack success in both digital and physical settings.
IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests
cs.CR 2026-07 conditional novelty 6.0 of 10

AI coding agents followed malicious instructions embedded in issue-style artifacts in 66.5% of 4,176 test runs.
Breaking the Rounding Trap: Securing LLMs against Quantization-Conditioned Backdoors
cs.CR 2026-06 unverdicted novelty 6.0 of 10

QuantGuard uses differentiable rounding control to break quantization-boundary backdoors in LLMs, reducing post-quantization attack success to clean-model levels across six models and INT8/FP4/NF4.
AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
cs.CR 2025-09 conditional novelty 6.0 of 10

AgentSentinel combines system-level tracing with LLM-based auditing to block 79.6% of attacks in the authors' 60-scenario computer-use agent benchmark.
Pruning Strategies for Backdoor Defense in LLMs
cs.LG 2025-08 conditional novelty 4.0 of 10

Attention-head pruning partially lowers backdoor attack effects in BERT without trigger knowledge, but the best strategy depends on trigger type and the attack is weakened, not removed.

Reference graph

Works this paper leans on

259 extracted references · 14 canonical work pages · cited by 6 Pith papers

[128]

Design and evaluation of a multi-domain trojan detection method on deep neural networks,

Y . Gao, Y . Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” IEEE Transactions on Dependable and Secure Computing, 2022

2022
[37]

Universal and transferable adversarial attacks on aligned language models,

A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” 2023. [Online]. Available: https://arxiv.org/abs/2307.15043

arXiv 2023
[38]

Query-based adversarial prompt generation,

J. Hayase, E. Borevkovic, N. Carlini, F. Tram `er, and M. Nasr, “Query-based adversarial prompt generation,”
[39]

Autoprompt: Eliciting knowledge from language models with automatically generated prompts,

T. Shin, Y . Razeghi, R. L. L. I. au2, E. Wallace, and S. Singh, “Autoprompt: Eliciting knowledge from language models with automatically generated prompts,”
[40]

Gradient- based language model red teaming,

N. Wichers, C. Denison, and A. Beirami, “Gradient- based language model red teaming,” arXiv preprint arXiv:2401.16656, 2024

arXiv 2024
[116]

Test-time backdoor attacks on multimodal large language models,

D. Lu, T. Pang, C. Du, Q. Liu, X. Yang, and M. Lin, “Test-time backdoor attacks on multimodal large language models,” 2024

2024
[152]

A backdoor attack against lstm-based text classification systems,

J. Dai and C. Chen, “A backdoor attack against lstm-based text classification systems,” 2019

2019
[168]

RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models,

W. Yang, Y . Lin, P. Li, J. Zhou, and X. Sun, “RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , M.-F. Moens, X. Huang, L. Specia, and S. W.-t. Yih, Eds. Online and Punta Cana, Dominican Republic: Association for Computation...

2021

Show all 259 references

[1]

Bloomberggpt: A large language model for finance,

S. Wu, O. Irsoy, S. Lu, V . Dabravolski, M. Dredze, S. Gehrmann, P. Kambadur, D. Rosenberg, and G. Mann, “Bloomberggpt: A large language model for finance,”
[2]

Making llms worth every penny: Resource-limited text classification in banking,

L. Loukas, I. Stogiannidis, O. Diamantopoulos, P. Malakasiotis, and S. Vassos, “Making llms worth every penny: Resource-limited text classification in banking,” in Proceedings of the Fourth ACM International Conference on AI in Finance , ser. ICAIF ’23. New York, NY , USA: Ass...

2023
[3]

Better to ask in english: Cross-lingual evaluation of large language models for healthcare queries,

Y . Jin, M. Chandra, G. Verma, Y . Hu, M. De Choudhury, and S. Kumar, “Better to ask in english: Cross-lingual evaluation of large language models for healthcare queries,” in Proceedings of the ACM Web Conference 2024 , ser. WWW ’24. New York, NY , USA: Association for Computi...

2024
[4]

Non-intrusive and un- constrained keystroke inference in vr platforms via infrared side channel,

T. Ni, Y . Du, Q. Zhao, and C. Wang, “Non-intrusive and un- constrained keystroke inference in vr platforms via infrared side channel,” arXiv preprint arXiv:2412.14815 , 2024

2024 arXiv
[5]

Chatlaw: A multi-agent collaborative legal assistant with knowledge graph enhanced mixture-of- experts large language model,

J. Cui, M. Ning, Z. Li, B. Chen, Y . Yan, H. Li, B. Ling, Y . Tian, and L. Yuan, “Chatlaw: A multi-agent collaborative legal assistant with knowledge graph enhanced mixture-of- experts large language model,” 2024. [Online]. Available: https://arxiv.org/abs/2306.16092

2024 arXiv
[6]

Autolaw: Augmented legal reasoning through legal precedent prediction,

R. Z. Mahari, “Autolaw: Augmented legal reasoning through legal precedent prediction,” 2021. [Online]. Available: https://arxiv.org/abs/2106.16034

2021 arXiv
[7]

Badnets: Identifying vulnerabilities in the machine learning model supply chain,

T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,”
[8]

Sok: Security and privacy in machine learning,

N. Papernot, P. McDaniel, A. Sinha, and M. P. Wellman, “Sok: Security and privacy in machine learning,” in 2018 IEEE European Symposium on Security and Privacy (Eu- roS&P), 2018

2018
[9]

Talking about large language models,

M. Shanahan, “Talking about large language models,” Com- munications of the ACM , vol. 67, no. 2, pp. 68–79, 2024

2024
[10]

Attributing chatgpt-generated source codes,

S. Choi and D. Mohaisen, “Attributing chatgpt-generated source codes,” IEEE Transactions on Dependable and Se- cure Computing, 2025

2025
[11]

Pushing large language models to the 6g edge: Vision, challenges, and opportunities,

Z. Lin, G. Qu, Q. Chen, X. Chen, Z. Chen, and K. Huang, “Pushing large language models to the 6g edge: Vision, challenges, and opportunities,” arXiv preprint arXiv:2309.16739, 2023

2023 arXiv
[12]

Splitlora: A split parameter- efficient fine-tuning framework for large language models,

Z. Lin, X. Hu, Y . Zhang, Z. Chen, Z. Fang, X. Chen, A. Li, P. Vepakomma, and Y . Gao, “Splitlora: A split parameter- efficient fine-tuning framework for large language models,” arXiv preprint arXiv:2407.00952 , 2024

2024 arXiv
[13]

Automated federated pipeline for parameter- efficient fine-tuning of large language models,

Z. Fang, Z. Lin, Z. Chen, X. Chen, Y . Gao, and Y . Fang, “Automated federated pipeline for parameter- efficient fine-tuning of large language models,” arXiv preprint arXiv:2404.06448, 2024

2024 arXiv
[14]

I can find you in sec- onds! leveraging large language models for code authorship attribution,

S. Choi, Y . K. Tan, M. H. Meng, M. Ragab, S. Mondal, D. Mohaisen, and K. M. M. Aung, “I can find you in sec- onds! leveraging large language models for code authorship attribution,” arXiv preprint arXiv:2501.08165 , 2025

2025 arXiv
[15]

Visual instruction tuning,

H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” Advances in neural information processing systems, vol. 36, 2024

2024
[16]

Gpt-4 technical report. arxiv 2303.08774,

R. OpenAI, “Gpt-4 technical report. arxiv 2303.08774,” View in Article, vol. 2, no. 5, 2023

2023 arXiv
[17]

Mistral 7b,

A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. de las Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier, L. R. Lavaud, M.-A. Lachaux, P. Stock, T. L. Scao, T. Lavril, T. Wang, T. Lacroix, and W. E. Sayed, “Mistral 7b,” 2023

2023
[18]

Mixtral of experts,

A. Q. Jiang, A. Sablayrolles, A. Roux, A. Mensch, B. Savary, C. Bamford, D. S. Chaplot, D. de las Casas, E. B. Hanna, F. Bressand, G. Lengyel, G. Bour, G. Lample, L. R. Lavaud, L. Saulnier, M.-A. Lachaux, P. Stock, S. Subrama- nian, S. Yang, S. Antoniak, T. L. Scao, T. Gervet,...

2024
[19]

Language models are few-shot learners,

T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-V oss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B....

2020
[20]

Gpt-j-6b: A 6 billion pa- rameter autoregressive language model,

B. Wang and A. Komatsuzaki, “Gpt-j-6b: A 6 billion pa- rameter autoregressive language model,” 2021

2021
[21]

Language models are unsupervised multitask learners,

A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever et al. , “Language models are unsupervised multitask learners,” OpenAI blog, vol. 1, no. 8, p. 9, 2019

2019
[22]

Llama: Open and efficient foundation language models,

H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar et al. , “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971 , 2023

2023 arXiv
[23]

Stanford alpaca: An instruction-following llama model,

R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, “Stanford alpaca: An instruction-following llama model,” 2023

2023
[24]

Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, march 2023,

W.-L. Chiang, Z. Li, Z. Lin, Y . Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y . Zhuang, J. E. Gonzalez et al. , “Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, march 2023,” URL https://lmsys. org/blog/2023-03-30-vicuna, vol. 3, no. 5, 2023

2023
[25]

Tinyllama: An open-source small language model,

P. Zhang, G. Zeng, T. Wang, and W. Lu, “Tinyllama: An open-source small language model,” arXiv preprint arXiv:2401.02385, 2024

2024 arXiv
[26]

Qlora: Efficient finetuning of quantized llms,

T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer, “Qlora: Efficient finetuning of quantized llms,” Advances in Neural Information Processing Systems , vol. 36, 2024

2024
[27]

Exploring the limits of transfer learning with a unified text-to-text transformer,

C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020

2020
[28]

The claude 3 model family: Opus, sonnet, haiku

“The claude 3 model family: Opus, sonnet, haiku.” [On- line]. Available: https://api.semanticscholar.org/CorpusID: 268232499
[29]

Opt: Open pre-trained transformer language models,

S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V . Lin et al. , “Opt: Open pre-trained transformer language models,”arXiv preprint arXiv:2205.01068, 2022

2022 arXiv
[30]

Palm 2 technical report,

R. Anil, A. M. Dai, O. Firat, M. Johnson, D. Lepikhin, A. Passos, S. Shakeri, E. Taropa, P. Bailey, Z. Chen et al., “Palm 2 technical report,” arXiv preprint arXiv:2305.10403, 2023

2023 arXiv
[31]

CodeBERT: A pre-trained model for programming and natural languages,

Z. Feng, D. Guo, D. Tang, N. Duan, X. Feng, M. Gong, L. Shou, B. Qin, T. Liu, D. Jiang, and M. Zhou, “CodeBERT: A pre-trained model for programming and natural languages,” in Findings of the Association for Computational Linguistics: EMNLP 2020 , T. Cohn, Y . He, and Y . Liu, ...

2020
[32]

Graphcodebert: Pre-training code representations with data flow,

D. Guo, S. Ren, S. Lu, Z. Feng, D. Tang, S. Liu, L. Zhou, N. Duan, A. Svyatkovskiy, S. Fu, M. Tufano, S. K. Deng, C. Clement, D. Drain, N. Sundaresan, J. Yin, D. Jiang, and M. Zhou, “Graphcodebert: Pre-training code representations with data flow,” 2021

2021
[33]

Unified pre-training for program understanding and gener- ation,

W. U. Ahmad, S. Chakraborty, B. Ray, and K.-W. Chang, “Unified pre-training for program understanding and gener- ation,” 2021

2021
[34]

CodeT5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation,

Y . Wang, W. Wang, S. Joty, and S. C. Hoi, “CodeT5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and generation,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , M.-F. Moens, X. Huang, L. Specia,...

2021
[35]

Codegen: An open large language model for code with multi-turn program synthesis,

E. Nijkamp, B. Pang, H. Hayashi, L. Tu, H. Wang, Y . Zhou, S. Savarese, and C. Xiong, “Codegen: An open large language model for code with multi-turn program synthesis,” 2023. [Online]. Available: https: //arxiv.org/abs/2203.13474

2023 arXiv
[36]

Explaining and harnessing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2015. [Online]. Available: https://arxiv.org/abs/1412.6572

2015 arXiv
[41]

Transferring backdoors between large language models by knowledge distillation,

P. Cheng, Z. Wu, T. Ju, W. Du, and Z. Z. G. Liu, “Transferring backdoors between large language models by knowledge distillation,” 2024. [Online]. Available: https://arxiv.org/abs/2408.09878

2024 arXiv
[42]

Weak-to-strong backdoor attack for large language models,

S. Zhao, L. Gan, Z. Guo, X. Wu, L. Xiao, X. Xu, C.-D. Nguyen, and L. A. Tuan, “Weak-to-strong backdoor attack for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2409.17946

2024 arXiv
[43]

Badedit: Backdooring large language models by model editing,

Y . Li, T. Li, K. Chen, J. Zhang, S. Liu, W. Wang, T. Zhang, and Y . Liu, “Badedit: Backdooring large language models by model editing,” 2024

2024
[44]

Weight poisoning attacks on pre-trained models,

K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pre-trained models,” 2020. [Online]. Available: https://arxiv.org/abs/2004.06660

2020 arXiv
[45]

Megen: Generative backdoor in large language models via model editing,

J. Qiu, X. Ma, Z. Zhang, and H. Zhao, “Megen: Generative backdoor in large language models via model editing,”
[46]

Backdoor attacks in federated learning by rare embeddings and gradient ensembling,

K. Y . Yoo and N. Kwak, “Backdoor attacks in federated learning by rare embeddings and gradient ensembling,” in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, Y . Goldberg, Z. Kozareva, and Y . Zhang, Eds. Abu Dhabi, United Arab Emirate...

2022
[47]

Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models,

W. Yang, L. Li, Z. Zhang, X. Ren, X. Sun, and B. He, “Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models,”
[48]

Backdoor attacks on pre-trained models by layerwise weight poisoning,

L. Li, D. Song, X. Li, J. Zeng, R. Ma, and X. Qiu, “Backdoor attacks on pre-trained models by layerwise weight poisoning,” 2021. [Online]. Available: https: //arxiv.org/abs/2108.13888

2021 arXiv
[49]

NOTABLE: Transferable backdoor attacks against prompt-based NLP models,

K. Mei, Z. Li, Z. Wang, Y . Zhang, and S. Ma, “NOTABLE: Transferable backdoor attacks against prompt-based NLP models,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , A. Rogers, J. Boyd-Graber, and N. Okazak...

2023
[50]

Available: https://arxiv.org/abs/2408.10722

[Online]. Available: https://arxiv.org/abs/2408.10722

arXiv
[51]

Exploiting the vulnerability of large language models via defense-aware architectural backdoor,

A. A. Miah and Y . Bi, “Exploiting the vulnerability of large language models via defense-aware architectural backdoor,”
[53]

Red alarm for pre- trained models: Universal vulnerability to neuron-level backdoor attacks,

Z. Zhang, G. Xiao, Y . Li, T. Lv, F. Qi, Z. Liu, Y . Wang, X. Jiang, and M. Sun, “Red alarm for pre- trained models: Universal vulnerability to neuron-level backdoor attacks,” Machine Intelligence Research , vol. 20, no. 2, p. 180–193, Mar. 2023. [Online]. Available: http://dx...

2023 doi
[54]

Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger,

J. Li, Y . Yang, Z. Wu, V . G. V . Vydiswaran, and C. Xiao, “Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger,” 2023. [Online]. Available: https://arxiv.org/abs/2304.14475

2023 arXiv
[55]

Target: Template-transferable backdoor attack against prompt- based nlp models via gpt4,

Z. Tan, Q. Chen, Y . Huang, and C. Liang, “Target: Template-transferable backdoor attack against prompt- based nlp models via gpt4,” 2023. [Online]. Available: https://arxiv.org/abs/2311.17429

2023 arXiv
[56]

Blind backdoors in deep learning models,

E. Bagdasaryan and V . Shmatikov, “Blind backdoors in deep learning models,” 2021. [Online]. Available: https://arxiv.org/abs/2005.03823

2021 arXiv
[57]

An llm-assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabil- ities against strong detection,

S. Yan, S. Wang, Y . Duan, H. Hong, K. Lee, D. Kim, and Y . Hong, “An llm-assisted easy-to-trigger backdoor attack on code completion models: Injecting disguised vulnerabil- ities against strong detection,” 2024

2024
[58]

Available: https://arxiv.org/abs/2409.01952

[Online]. Available: https://arxiv.org/abs/2409.01952

arXiv
[59]

Hidden killer: Invisible textual backdoor attacks with syntactic trigger,

F. Qi, M. Li, Y . Chen, Z. Zhang, Z. Liu, Y . Wang, and M. Sun, “Hidden killer: Invisible textual backdoor attacks with syntactic trigger,” in Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on...

2021
[60]

Synghost: Imperceptible and universal task- agnostic backdoor attack in pre-trained language models,

P. Cheng, W. Du, Z. Wu, F. Zhang, L. Chen, and G. Liu, “Synghost: Imperceptible and universal task- agnostic backdoor attack in pre-trained language models,”
[61]

Punctuation matters! stealthy backdoor attack for language models,

X. Sheng, Z. Li, Z. Han, X. Chang, and P. Li, “Punctuation matters! stealthy backdoor attack for language models,”
[62]

Watch out for your guidance on generation! exploring conditional backdoor attacks against large language models,

J. He, W. Jiang, G. Hou, W. Fan, R. Zhang, and H. Li, “Watch out for your guidance on generation! exploring conditional backdoor attacks against large language models,” 2024. [Online]. Available: https://arxiv. org/abs/2404.14795

2024 arXiv
[63]

Large language models are better adversaries: Exploring generative clean- label backdoor attacks against text classifiers,

W. You, Z. Hammoudeh, and D. Lowd, “Large language models are better adversaries: Exploring generative clean- label backdoor attacks against text classifiers,” in Findings of the Association for Computational Linguistics: EMNLP 2023, H. Bouamor, J. Pino, and K. Bali, Eds. Sing...

2023
[64]

The philosopher’s stone: Trojaning plugins of large language models,

T. Dong, M. Xue, G. Chen, R. Holland, Y . Meng, S. Li, Z. Liu, and H. Zhu, “The philosopher’s stone: Trojaning plugins of large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2312.00374

2024 arXiv
[65]

Uncertainty is fragile: Manipulating uncertainty in large language models,

Q. Zeng, M. Jin, Q. Yu, Z. Wang, W. Hua, Z. Zhou, G. Sun, Y . Meng, S. Ma, Q. Wang, F. Juefei-Xu, K. Ding, F. Yang, R. Tang, and Y . Zhang, “Uncertainty is fragile: Manipulating uncertainty in large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2407.11282

2024 arXiv
[66]

Stealthy and persistent unalignment on large language models via backdoor injections,

Y . Cao, B. Cao, and J. Chen, “Stealthy and persistent unalignment on large language models via backdoor injections,” 2024. [Online]. Available: https://arxiv.org/abs/ 2312.00027

2024 arXiv
[67]

Obliviate: Neutralizing task-agnostic backdoors within the parameter- efficient fine-tuning paradigm,

J. Kim, M. Song, S. H. Na, and S. Shin, “Obliviate: Neutralizing task-agnostic backdoors within the parameter- efficient fine-tuning paradigm,” 2024. [Online]. Available: https://arxiv.org/abs/2409.14119

2024 arXiv
[68]

Available: https://arxiv.org/abs/2402.18945

[Online]. Available: https://arxiv.org/abs/2402.18945

arXiv
[69]

Lora-as-an-attack! piercing llm safety under the share-and-play scenario,

H. Liu, Z. Liu, R. Tang, J. Yuan, S. Zhong, Y .-N. Chuang, L. Li, R. Chen, and X. Hu, “Lora-as-an-attack! piercing llm safety under the share-and-play scenario,” 2024. [Online]. Available: https://arxiv.org/abs/2403.00108 28

2024 arXiv
[70]

Available: https://arxiv.org/abs/2312.15867

[Online]. Available: https://arxiv.org/abs/2312.15867

arXiv
[71]

Backdooring instruction- tuned large language models with virtual prompt injection,

J. Yan, V . Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V . Srinivasan, X. Ren, and H. Jin, “Backdooring instruction- tuned large language models with virtual prompt injection,” 2024

2024
[72]

Lora: Low-rank adaptation of large language models,

E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” 2021. [Online]. Available: https://arxiv.org/abs/2106.09685

2021 arXiv
[73]

On the exploitability of instruction tuning,

M. Shu, J. Wang, C. Zhu, J. Geiping, C. Xiao, and T. Goldstein, “On the exploitability of instruction tuning,”
[74]

A gradient control method for backdoor attacks on parameter- efficient tuning,

N. Gu, P. Fu, X. Liu, Z. Liu, Z. Lin, and W. Wang, “A gradient control method for backdoor attacks on parameter- efficient tuning,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), A. Rogers, J. Boyd-Graber, an...

2023
[75]

Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models,

J. Liang, S. Liang, M. Luo, A. Liu, D. Han, E.-C. Chang, and X. Cao, “Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models,”
[76]

Poisoning language models during instruction tuning,

A. Wan, E. Wallace, S. Shen, and D. Klein, “Poisoning language models during instruction tuning,” in International Conference on Machine Learning . PMLR, 2023, pp. 35 413–35 425

2023
[77]

Turning generative models degener- ate: The power of data poisoning attacks,

S. Jiang, S. R. Kadhe, Y . Zhou, F. Ahmed, L. Cai, and N. Baracaldo, “Turning generative models degener- ate: The power of data poisoning attacks,” arXiv preprint arXiv:2407.12281, 2024

2024 arXiv
[78]

Sdba: A stealthy and long-lasting durable backdoor attack in federated learning,

M. Choe, C. Park, C. Seo, and H. Kim, “Sdba: A stealthy and long-lasting durable backdoor attack in federated learning,” 2024. [Online]. Available: https: //arxiv.org/abs/2409.14805

2024 arXiv
[79]

Composite backdoor attacks against large language models,

H. Huang, Z. Zhao, M. Backes, Y . Shen, and Y . Zhang, “Composite backdoor attacks against large language models,” in Findings of the Association for Computational Linguistics: NAACL 2024 , K. Duh, H. Gomez, and S. Bethard, Eds. Mexico City, Mexico: Association for Computation...

2024
[80]

Neurotoxin: Durable backdoors in federated learning,

Z. Zhang, A. Panda, L. Song, Y . Yang, M. W. Mahoney, J. E. Gonzalez, K. Ramchandran, and P. Mittal, “Neurotoxin: Durable backdoors in federated learning,” 2022. [Online]. Available: https://arxiv.org/abs/2206.10341

2022 arXiv
[81]

Badmerging: Backdoor attacks against model merging,

J. Zhang, J. Chi, Z. Li, K. Cai, Y . Zhang, and Y . Tian, “Badmerging: Backdoor attacks against model merging,”
[82]

Learning to poison large language models during instruction tuning,

Y . Qiang, X. Zhou, S. Z. Zade, M. A. Roshani, P. Khanduri, D. Zytko, and D. Zhu, “Learning to poison large language models during instruction tuning,” 2024. [Online]. Available: https://arxiv.org/abs/2402.13459

2024 arXiv
[83]

Poisonprompt: Backdoor attack on prompt-based large language models,

H. Yao, J. Lou, and Z. Qin, “Poisonprompt: Backdoor attack on prompt-based large language models,” 2023. [Online]. Available: https://arxiv.org/abs/2310.12439

2023 arXiv
[84]

Available: https://arxiv.org/abs/2306.17194

[Online]. Available: https://arxiv.org/abs/2306.17194

arXiv
[85]

Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models,

J. Xu, M. D. Ma, F. Wang, C. Xiao, and M. Chen, “Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2305.14710

2024 arXiv
[86]

Prompt as triggers for backdoor attack: Examining the vulnerability in language models,

S. Zhao, J. Wen, A. Luu, J. Zhao, and J. Fu, “Prompt as triggers for backdoor attack: Examining the vulnerability in language models,” in Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing . Association for Computational Linguistics, 2023, p...

2023 doi
[87]

Available: https://arxiv.org/abs/2402.13851

[Online]. Available: https://arxiv.org/abs/2402.13851

arXiv
[88]

Rlhfpoison: Reward poisoning attack for reinforcement learning with human feedback in large language models,

J. Wang, J. Wu, M. Chen, Y . V orobeychik, and C. Xiao, “Rlhfpoison: Reward poisoning attack for reinforcement learning with human feedback in large language models,”
[89]

Physical backdoor attack can jeopardize driving with vision-large-language models,

Z. Ni, R. Ye, Y . Wei, Z. Xiang, Y . Wang, and S. Chen, “Physical backdoor attack can jeopardize driving with vision-large-language models,” 2024. [Online]. Available: https://arxiv.org/abs/2404.12916

2024 arXiv
[90]

Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt,

J. Shi, Y . Liu, P. Zhou, and L. Sun, “Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt,” 2023. [Online]. Available: https://arxiv.org/ abs/2304.12298

2023 arXiv
[91]

Emerging safety attack and defense in federated instruction tuning of large language models,

R. Ye, J. Chai, X. Liu, Y . Yang, Y . Wang, and S. Chen, “Emerging safety attack and defense in federated instruction tuning of large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2406.10630

2024 arXiv
[92]

Badagent: Inserting and activating backdoor attacks in llm agents,

Y . Wang, D. Xue, S. Zhang, and S. Qian, “Badagent: Inserting and activating backdoor attacks in llm agents,”
[93]

Adaptivebackdoor: Backdoored language model agents that detect human overseers,

H. Wang, R. Zhong, J. Wen, and J. Steinhardt, “Adaptivebackdoor: Backdoored language model agents that detect human overseers,” in ICML 2024 Workshop on Foundation Models in the Wild , 2024. [Online]. Available: https://openreview.net/forum?id=RredrFZ4tQ

2024
[94]

Available: https://arxiv.org/abs/2408.07362

[Online]. Available: https://arxiv.org/abs/2408.07362

arXiv
[95]

Ppt: Backdoor attacks on pre-trained models via poisoned prompt tuning,

W. Du, Y . Zhao, B. Li, G. Liu, and S. Wang, “Ppt: Backdoor attacks on pre-trained models via poisoned prompt tuning,” in Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22 , L. D. Raedt, Ed. International Joint Conferences on A...

2022 doi
[96]

Watch out for your agents! investigating backdoor threats to llm-based agents,

W. Yang, X. Bi, Y . Lin, S. Chen, J. Zhou, and X. Sun, “Watch out for your agents! investigating backdoor threats to llm-based agents,” 2024. [Online]. Available: https://arxiv.org/abs/2402.11208

2024 arXiv
[97]

Exploring the universal vulnerability of prompt-based learning paradigm,

L. Xu, Y . Chen, G. Cui, H. Gao, and Z. Liu, “Exploring the universal vulnerability of prompt-based learning paradigm,”
[98]

Alanca: Active learning guided adversarial attacks for code comprehension on diverse pre- trained and large language models,

D. Liu and S. Zhang, “Alanca: Active learning guided adversarial attacks for code comprehension on diverse pre- trained and large language models,” in 2024 IEEE Inter- national Conference on Software Analysis, Evolution and Reengineering (SANER), 2024, pp. 602–613

2024
[99]

Badprompt: Backdoor attacks on continuous prompts,

X. Cai, H. Xu, S. Xu, Y . Zhang, and X. Yuan, “Badprompt: Backdoor attacks on continuous prompts,” 2022. [Online]. Available: https://arxiv.org/abs/2211.14719

2022 arXiv
[100]

Multi- target backdoor attacks for code pre-trained models,

Y . Li, S. Liu, K. Chen, X. Xie, T. Zhang, and Y . Liu, “Multi- target backdoor attacks for code pre-trained models,” 2023

2023
[101]

Universal jailbreak backdoors from poisoned human feedback,

J. Rando and F. Tram `er, “Universal jailbreak backdoors from poisoned human feedback,” 2024. [Online]. Available: https://arxiv.org/abs/2311.14455

2024 arXiv
[102]

Trojllm: A black-box trojan prompt attack on large language models,

J. Xue, M. Zheng, T. Hua, Y . Shen, Y . Liu, L. Boloni, and Q. Lou, “Trojllm: A black-box trojan prompt attack on large language models,” 2023. [Online]. Available: https://arxiv.org/abs/2306.06815

2023 arXiv
[103]

Available: https://arxiv.org/abs/2311.09641

[Online]. Available: https://arxiv.org/abs/2311.09641

arXiv
[104]

Best- of-venom: Attacking rlhf by injecting poisoned preference data,

T. Baumg ¨artner, Y . Gao, D. Alon, and D. Metzler, “Best- of-venom: Attacking rlhf by injecting poisoned preference data,” 2024. [Online]. Available: https://arxiv.org/abs/2404. 05530

2024
[105]

Human-imperceptible retrieval poisoning attacks in llm-powered applications,

Q. Zhang, B. Zeng, C. Zhou, G. Go, H. Shi, and Y . Jiang, “Human-imperceptible retrieval poisoning attacks in llm-powered applications,” 2024. [Online]. Available: https://arxiv.org/abs/2404.17196

2024 arXiv
[106]

Are aligned neural networks adversarially aligned?

N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, A. Awadalla, P. W. Koh, D. Ippolito, K. Lee, F. Tramer, and L. Schmidt, “Are aligned neural networks adversarially aligned?” 2024. [Online]. Available: https: //arxiv.org/abs/2306.15447

2024 arXiv
[107]

Can we trust embodied agents? exploring backdoor attacks against embodied llm- based decision-making systems,

R. Jiao, S. Xie, J. Yue, T. Sato, L. Wang, Y . Wang, Q. A. Chen, and Q. Zhu, “Can we trust embodied agents? exploring backdoor attacks against embodied llm- based decision-making systems,” 2024. [Online]. Available: https://arxiv.org/abs/2405.20774

2024 arXiv
[108]

Available: https://arxiv.org/abs/2406.03007

[Online]. Available: https://arxiv.org/abs/2406.03007

arXiv
[109]

Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models,

P. Cheng, Y . Ding, T. Ju, Z. Wu, W. Du, P. Yi, Z. Zhang, and G. Liu, “Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2405.13401

2024 arXiv
[110]

Multi- turn hidden backdoor in large language model-powered chatbot models,

B. Chen, N. Ivanov, G. Wang, and Q. Yan, “Multi- turn hidden backdoor in large language model-powered chatbot models,” in Proceedings of the 19th ACM Asia Conference on Computer and Communications Security , ser. ASIA CCS ’24. New York, NY , USA: Association for Computing Mach...

2024
[111]

Exploring backdoor vulnerabilities of chat models,

Y . Hao, W. Yang, and Y . Lin, “Exploring backdoor vulnerabilities of chat models,” 2024. [Online]. Available: https://arxiv.org/abs/2404.02406 29

2024 arXiv
[112]

Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,

Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,” ArXiv, vol. abs/2407.12784,

arXiv
[113]

You autocomplete me: Poisoning vulnerabilities in neural code completion,

R. Schuster, C. Song, E. Tromer, and V . Shmatikov, “You autocomplete me: Poisoning vulnerabilities in neural code completion,” in 30th USENIX Security Symposium (USENIX Security 21) . USENIX Association, Aug. 2021, pp. 1559–1575. [Online]. Available: https://www.usenix. org/c...

2021
[114]

Universal vulnerabilities in large language models: Backdoor attacks for in-context learning,

S. Zhao, M. Jia, L. A. Tuan, F. Pan, and J. Wen, “Universal vulnerabilities in large language models: Backdoor attacks for in-context learning,” 2024. [Online]. Available: https://arxiv.org/abs/2401.05949

2024 arXiv
[115]

Trojanpuzzle: Covertly poisoning code-suggestion models,

H. Aghakhani, W. Dai, A. Manoel, X. Fernandes, A. Kharkar, C. Kruegel, G. Vigna, D. Evans, B. Zorn, and R. Sim, “Trojanpuzzle: Covertly poisoning code-suggestion models,” 2024

2024
[117]

Instruction backdoor attacks against customized LLMs,

R. Zhang, H. Li, R. Wen, W. Jiang, Y . Zhang, M. Backes, Y . Shen, and Y . Zhang, “Instruction backdoor attacks against customized LLMs,” in 33rd USENIX Security Symposium (USENIX Security 24) . Philadelphia, PA: USENIX Association, Aug. 2024, pp. 1849–1866. [Online]. Availabl...

2024
[118]

A backdoor attack against lstm- based text classification systems,

J. Dai, C. Chen, and Y . Li, “A backdoor attack against lstm- based text classification systems,” IEEE Access, vol. 7, pp. 138 872–138 878, 2019

2019
[119]

Badchain: Backdoor chain- of-thought prompting for large language models,

Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, and B. Li, “Badchain: Backdoor chain- of-thought prompting for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2401.12242

2024 arXiv
[120]

The dark side of human feedback: Poisoning large language models via user inputs,

B. Chen, H. Guo, G. Wang, Y . Wang, and Q. Yan, “The dark side of human feedback: Poisoning large language models via user inputs,” 2024. [Online]. Available: https://arxiv.org/abs/2409.00787

2024 arXiv
[121]

Onion: A simple and effective defense against textual backdoor attacks,

F. Qi, Y . Chen, M. Li, Y . Yao, Z. Liu, and M. Sun, “Onion: A simple and effective defense against textual backdoor attacks,” 2021. [Online]. Available: https://arxiv. org/abs/2011.10369 30

2021 arXiv
[122]

Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,

W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2402.07867

2024 arXiv
[123]

Hidden backdoors in human- centric language models,

S. Li, H. Liu, T. Dong, B. Z. H. Zhao, M. Xue, H. Zhu, and J. Lu, “Hidden backdoors in human- centric language models,” 2021. [Online]. Available: https://arxiv.org/abs/2105.00164

2021 arXiv
[124]

Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,

J. Xue, M. Zheng, Y . Hu, F. Liu, X. Chen, and Q. Lou, “Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2406.00083

2024 arXiv
[125]

Fine-pruning: De- fending against backdooring attacks on deep neural net- works,

K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: De- fending against backdooring attacks on deep neural net- works,” 05 2018

2018
[126]

Backdoor attacks on dense passage retrievers for disseminating misinformation,

Q. Long, Y . Deng, L. Gan, W. Wang, and S. J. Pan, “Backdoor attacks on dense passage retrievers for disseminating misinformation,” 2024. [Online]. Available: https://arxiv.org/abs/2402.13532

2024 arXiv
[127]

Training-free lexical backdoor attacks on language models,

Y . Huang, T. Y . Zhuo, Q. Xu, H. Hu, X. Yuan, and C. Chen, “Training-free lexical backdoor attacks on language models,” in Proceedings of the ACM Web Conference 2023, ser. WWW ’23. ACM, Apr. 2023, p. 2198–2208. [Online]. Available: http://dx.doi.org/10.1145/3543507.3583348

2023
[129]

Available: https://api.semanticscholar.org/ CorpusID:271244867

[Online]. Available: https://api.semanticscholar.org/ CorpusID:271244867
[130]

Backdoor attacks for in-context learning with language models,

N. Kandpal, M. Jagielski, F. Tram `er, and N. Carlini, “Backdoor attacks for in-context learning with language models,” 2023. [Online]. Available: https://arxiv.org/abs/ 2307.14692

2023 arXiv
[131]

Spectral signatures in back- door attacks,

B. Tran, J. Li, and A. Madry, “Spectral signatures in back- door attacks,” 2018

2018
[132]

Data poisoning for in-context learning,

P. He, H. Xu, Y . Xing, H. Liu, M. Yamada, and J. Tang, “Data poisoning for in-context learning,” 2024. [Online]. Available: https://arxiv.org/abs/2402.02160

2024 arXiv
[133]

Weight poisoning attacks on pre-trained models,

K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pre-trained models,” 2020

2020
[134]

Natural backdoor attack on text data,

L. Sun, “Natural backdoor attack on text data,” 2021. [Online]. Available: https://arxiv.org/abs/2006.16176

2021 arXiv
[135]

Machine learning with adversaries: Byzantine tolerant gradient descent,

P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems , I. Guyon, U. V . Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Gar...

2017
[136]

Mind the style of text! adversarial and backdoor attacks based on text style transfer,

F. Qi, Y . Chen, X. Zhang, M. Li, Z. Liu, and M. Sun, “Mind the style of text! adversarial and backdoor attacks based on text style transfer,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , M.-F. Moens, X. Huang, L. Specia, and S. W...

2021
[137]

Securing multi-turn conversational language models from distributed backdoor triggers,

T. Tong, J. Xu, Q. Liu, and M. Chen, “Securing multi-turn conversational language models from distributed backdoor triggers,” 2024. [Online]. Available: https: //arxiv.org/abs/2407.04151

2024 arXiv
[138]

Trojan activation attack: Red- teaming large language models using activation steering for safety-alignment,

H. Wang and K. Shu, “Trojan activation attack: Red- teaming large language models using activation steering for safety-alignment,” 2024. [Online]. Available: https: //arxiv.org/abs/2311.09433

2024 arXiv
[139]

A simple and effective pruning approach for large language models,

M. Sun, Z. Liu, A. Bair, and J. Z. Kolter, “A simple and effective pruning approach for large language models,”
[140]

Available: https://arxiv.org/abs/2306.11695

[Online]. Available: https://arxiv.org/abs/2306.11695

arXiv
[141]

Automatically auditing large language models via dis- crete optimization,

E. Jones, A. Dragan, A. Raghunathan, and J. Steinhardt, “Automatically auditing large language models via dis- crete optimization,” in International Conference on Machine Learning. PMLR, 2023, pp. 15 307–15 329

2023
[142]

Defending against backdoor attacks in natural language generation,

X. Sun, X. Li, Y . Meng, X. Ao, L. Lyu, J. Li, and T. Zhang, “Defending against backdoor attacks in natural language generation,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 4, 2023, pp. 5257–5265

2023
[143]

Turn the combination lock: Learnable textual backdoor attacks via word substitution,

F. Qi, Y . Yao, S. Xu, Z. Liu, and M. Sun, “Turn the combination lock: Learnable textual backdoor attacks via word substitution,” in Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural L...

2021
[144]

Distillation as a defense to adversarial perturbations against deep neural networks,

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Secu- rity and Privacy (SP) , 2016, pp. 582–597

2016
[145]

Trojaning lan- guage models for fun and profit,

X. Zhang, Z. Zhang, S. Ji, and T. Wang, “Trojaning lan- guage models for fun and profit,” 2021

2021
[146]

Ad- versarial example generation with syntactically controlled paraphrase networks,

M. Iyyer, J. Wieting, K. Gimpel, and L. Zettlemoyer, “Ad- versarial example generation with syntactically controlled paraphrase networks,” arXiv preprint arXiv:1804.06059 , 2018

2018 arXiv
[147]

Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Sym- posium on Security and Privacy (SP) , 2019, pp. 707–723

2019
[148]

Detecting backdoor attacks on deep neural networks by activation clustering,

B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” 2018. [Online]. Available: https://arxiv.org/abs/1811.03728

2018 arXiv
[149]

An empirical study of catastrophic forgetting in large language models during continual fine-tuning,

Y . Luo, Z. Yang, F. Meng, Y . Li, J. Zhou, and Y . Zhang, “An empirical study of catastrophic forgetting in large language models during continual fine-tuning,” 2024. [Online]. Available: https://arxiv.org/abs/2308.08747

2024 arXiv
[150]

Badpre: Task-agnostic backdoor attacks to pre- trained nlp foundation models,

K. Chen, Y . Meng, X. Sun, S. Guo, T. Zhang, J. Li, and C. Fan, “Badpre: Task-agnostic backdoor attacks to pre- trained nlp foundation models,” 2021

2021
[151]

Finetuned language models are zero-shot learners,

J. Wei, M. Bosma, V . Y . Zhao, K. Guu, A. W. Yu, B. Lester, N. Du, A. M. Dai, and Q. V . Le, “Finetuned language models are zero-shot learners,” 2022. [Online]. Available: https://arxiv.org/abs/2109.01652

2022 arXiv
[153]

Demistify: Identifying on-device machine learning models stealing and reuse vulnerabilities in mobile apps,

P. Ren, C. Zuo, X. Liu, W. Diao, Q. Zhao, and S. Guo, “Demistify: Identifying on-device machine learning models stealing and reuse vulnerabilities in mobile apps,” in Pro- ceedings of the 46th IEEE/ACM International Conference on Software Engineering , 2024, pp. 1–13

2024
[154]

Can you really backdoor federated learning?

Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” arXiv preprint arXiv:1911.07963, 2019

1911 arXiv
[155]

{FLAME}: Taming backdoors in federated learning,

T. D. Nguyen, P. Rieger, R. De Viti, H. Chen, B. B. Bran- denburg, H. Yalame, H. M ¨ollering, H. Fereidooni, S. Mar- chal, M. Miettinen et al. , “ {FLAME}: Taming backdoors in federated learning,” in 31st USENIX Security Symposium (USENIX Security 22) , 2022, pp. 1415–1432

2022
[156]

Xporter: A study of the multi-port charger security on privacy leakage and voice injection,

T. Ni, Y . Chen, W. Xu, L. Xue, and Q. Zhao, “Xporter: A study of the multi-port charger security on privacy leakage and voice injection,” in Proceedings of the 29th Annual International Conference on Mobile Computing and Net- working, 2023, pp. 1–15

2023
[157]

Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,

Y . Wen, N. Jain, J. Kirchenbauer, M. Goldblum, J. Geiping, and T. Goldstein, “Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery,” Ad- vances in Neural Information Processing Systems , vol. 36, 2024

2024
[158]

Gradient- based adversarial attacks against text transformers,

C. Guo, A. Sablayrolles, H. J ´egou, and D. Kiela, “Gradient- based adversarial attacks against text transformers,” arXiv preprint arXiv:2104.13733, 2021

2021 arXiv
[159]

Exploiting contactless side channels in wireless charging power banks for user privacy inference via few- shot learning,

T. Ni, J. Li, X. Zhang, C. Zuo, W. Wang, W. Xu, X. Luo, and Q. Zhao, “Exploiting contactless side channels in wireless charging power banks for user privacy inference via few- shot learning,” in Proceedings of the 29th Annual Interna- tional Conference on Mobile Computing and ...

2023
[160]

Strip: a defence against trojan attacks on deep neural networks,

Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: a defence against trojan attacks on deep neural networks,” in Proceedings of the 35th Annual Computer Security Applications Conference , ser. ACSAC ’19. New York, NY , USA: Association for Computing Mach...

2019
[161]

L- autoda: Large language models for automatically evolving decision-based adversarial attacks,

P. Guo, F. Liu, X. Lin, Q. Zhao, and Q. Zhang, “L- autoda: Large language models for automatically evolving decision-based adversarial attacks,” in Proceedings of the Genetic and Evolutionary Computation Conference Com- panion, 2024, pp. 1846–1854

2024
[162]

Kallima: A clean-label framework for textual backdoor attacks,

X. Chen, Y . Dong, Z. Sun, S. Zhai, Q. Shen, and Z. Wu, “Kallima: A clean-label framework for textual backdoor attacks,” in European Symposium on Research in Computer Security. Springer, 2022, pp. 447–466

2022
[163]

Triggerless backdoor attack for nlp tasks with clean labels,

L. Gan, J. Li, T. Zhang, X. Li, Y . Meng, F. Wu, Y . Yang, S. Guo, and C. Fan, “Triggerless backdoor attack for nlp tasks with clean labels,” 2022

2022
[164]

Soteria: Detecting ad- versarial examples in control flow graph-based malware classifiers,

H. Alasmary, A. Abusnaina, R. Jang, M. Abuhamad, A. An- war, D. Nyang, and D. Mohaisen, “Soteria: Detecting ad- versarial examples in control flow graph-based malware classifiers,” in 2020 IEEE 40th International Conference on Distributed Computing Systems (ICDCS). IEEE, 2020,...

2020
[165]

Bddr: An effective defense against textual backdoor attacks,

K. Shao, J. Yang, Y . Ai, H. Liu, and Y . Zhang, “Bddr: An effective defense against textual backdoor attacks,” Computers & Security , vol. 110, p. 102433, 2021. [Online]. Available: https://www.sciencedirect.com/science/ article/pii/S0167404821002571

2021
[166]

Red teaming language models with language models,

E. Perez, S. Huang, F. Song, T. Cai, R. Ring, J. Aslanides, A. Glaese, N. McAleese, and G. Irving, “Red teaming language models with language models,” arXiv preprint arXiv:2202.03286, 2022. 31

2022 arXiv
[167]

Making adversarially-trained language models forget with model retraining: A case study on hate speech detection,

M. Omar and D. Mohaisen, “Making adversarially-trained language models forget with model retraining: A case study on hate speech detection,” in Companion Proceedings of the Web Conference 2022, 2022, pp. 887–893

2022
[169]

Training a helpful and harmless assistant with reinforcement learning from human feedback,

Y . Bai, A. Jones, K. Ndousse, A. Askell, A. Chen, N. DasSarma, D. Drain, S. Fort, D. Ganguli, T. Henighan, N. Joseph, S. Kadavath, J. Kernion, T. Conerly, S. El- Showk, N. Elhage, Z. Hatfield-Dodds, D. Hernandez, T. Hume, S. Johnston, S. Kravec, L. Lovitt, N. Nanda, C. Olsson...

2022 arXiv
[170]

Itpatch: An invisible and triggered physical adversarial patch against traffic sign recognition,

S. Yuan, H. Li, X. Han, G. Xu, W. Jiang, T. Ni, Q. Zhao, and Y . Fang, “Itpatch: An invisible and triggered physical adversarial patch against traffic sign recognition,” arXiv preprint arXiv:2409.12394, 2024

2024
[171]

Retrieval-augmented generation for knowledge-intensive nlp tasks,

P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschel, S. Riedel, and D. Kiela, “Retrieval-augmented generation for knowledge-intensive nlp tasks,” in Advances in Neural Information Processing Systems, H. Laroch...

2020
[172]

A simple and fast human activity recognition system using radio frequency en- ergy harvesting,

T. Ni, Y . Chen, K. Song, and W. Xu, “A simple and fast human activity recognition system using radio frequency en- ergy harvesting,” in Adjunct Proceedings of the 2021 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of the 2021 ACM Int...

2021
[173]

Adversarial learning attacks on graph-based iot malware detection systems,

A. Abusnaina, A. Khormali, H. Alasmary, J. Park, A. An- war, and A. Mohaisen, “Adversarial learning attacks on graph-based iot malware detection systems,” in 2019 IEEE 39th international conference on distributed computing sys- tems (ICDCS). IEEE, 2019, pp. 1296–1305

2019
[174]

Vaccine: Perturbation- aware alignment for large language models against harmful fine-tuning attack,

T. Huang, S. Hu, and L. Liu, “Vaccine: Perturbation- aware alignment for large language models against harmful fine-tuning attack,” 2024. [Online]. Available: https://arxiv.org/abs/2402.01109

2024 arXiv
[175]

Ava: Inconspicuous attribute variation-based adversarial attack bypassing deepfake detection,

X. Meng, L. Wang, S. Guo, L. Ju, and Q. Zhao, “Ava: Inconspicuous attribute variation-based adversarial attack bypassing deepfake detection,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 74–90

2024
[176]

Swipepass: Acoustic- based second-factor user authentication for smartphones,

Y . Chen, T. Ni, W. Xu, and T. Gu, “Swipepass: Acoustic- based second-factor user authentication for smartphones,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 6, no. 3, pp. 1–25, 2022

2022
[177]

Backdoor removal for generative large language models,

H. Li, Y . Chen, Z. Zheng, Q. Hu, C. Chan, H. Liu, and Y . Song, “Backdoor removal for generative large language models,” 2024

2024
[178]

Stealthiness assessment of adversarial perturbation: From a visual perspective,

H. Liu, Y . Zhou, Y . Yang, Q. Zhao, T. Zhang, and T. Xiang, “Stealthiness assessment of adversarial perturbation: From a visual perspective,” IEEE Transactions on Information Forensics and Security, 2024

2024
[179]

Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning,

S. Zhao, L. Gan, L. A. Tuan, J. Fu, L. Lyu, M. Jia, and J. Wen, “Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning,” 2024. [Online]. Available: https://arxiv.org/abs/2402.12168

2024 arXiv
[180]

Emma: An accurate, efficient, and multi-modality strategy for autonomous vehi- cle angle prediction,

K. Song, T. Ni, L. Song, and W. Xu, “Emma: An accurate, efficient, and multi-modality strategy for autonomous vehi- cle angle prediction,” Intelligent and Converged Networks , vol. 4, no. 1, pp. 41–49, 2023

2023
[181]

Sensor security in virtual reality: Exploration and mitigation,

T. Ni, “Sensor security in virtual reality: Exploration and mitigation,” in Proceedings of the 22nd Annual Interna- tional Conference on Mobile Systems, Applications and Services, 2024, pp. 758–759

2024
[182]

Fine-tuning is all you need to mitigate backdoor attacks,

Z. Sha, X. He, P. Berrang, M. Humbert, and Y . Zhang, “Fine-tuning is all you need to mitigate backdoor attacks,”
[183]

Rehsense: Towards battery-free wireless sensing via radio frequency energy harvesting,

T. Ni, Z. Sun, M. Han, Y . Xie, G. Lan, Z. Li, T. Gu, and W. Xu, “Rehsense: Towards battery-free wireless sensing via radio frequency energy harvesting,” in Proceedings of the Twenty-Fifth International Symposium on Theory, Al- gorithmic Foundations, and Protocol Design for Mo...

2024
[184]

Adversarial example detection using la- tent neighborhood graph,

A. Abusnaina, Y . Wu, S. Arora, Y . Wang, F. Wang, H. Yang, and D. Mohaisen, “Adversarial example detection using la- tent neighborhood graph,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 7687–7696

2021
[185]

Trap and replace: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork,

H. Wang, J. Hong, A. Zhang, J. Zhou, and Z. Wang, “Trap and replace: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork,” in Advances in Neural Information Processing Systems , S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, Eds.,...

2022
[186]

Quanti- fying the performance of adversarial training on language models with distribution shifts,

M. Omar, S. Choi, D. Nyang, and D. Mohaisen, “Quanti- fying the performance of adversarial training on language models with distribution shifts,” in Proceedings of the 1st Workshop on Cybersecurity and Social Sciences , 2022, pp. 3–9

2022
[187]

Cleanclip: Mitigating data poisoning attacks in multimodal contrastive learning,

H. Bansal, N. Singhi, Y . Yang, F. Yin, A. Grover, and K.-W. Chang, “Cleanclip: Mitigating data poisoning attacks in multimodal contrastive learning,” 2023. [Online]. Available: https://arxiv.org/abs/2303.03323

2023 arXiv
[188]

Chain-of-thought prompting elicits reasoning in large language models,

J. Wei, X. Wang, D. Schuurmans, M. Bosma, B. Ichter, F. Xia, E. Chi, Q. Le, and D. Zhou, “Chain-of-thought prompting elicits reasoning in large language models,”
[189]

Available: https://arxiv.org/abs/2201.11903 32

[Online]. Available: https://arxiv.org/abs/2201.11903 32

arXiv
[190]

Anti-backdoor model: A novel algorithm to remove backdoors in a non- invasive way,

C. Chen, H. Hong, T. Xiang, and M. Xie, “Anti-backdoor model: A novel algorithm to remove backdoors in a non- invasive way,”IEEE Transactions on Information Forensics and Security, vol. 19, pp. 7420–7434, 2024

2024
[191]

What doesn’t kill you makes you robust(er): How to adversarially train against data poisoning,

J. Geiping, L. Fowl, G. Somepalli, M. Goldblum, M. Moeller, and T. Goldstein, “What doesn’t kill you makes you robust(er): How to adversarially train against data poisoning,” 2022. [Online]. Available: https: //arxiv.org/abs/2102.13624

2022 arXiv
[192]

Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots,

R. Tang, J. Yuan, Y . Li, Z. Liu, R. Chen, and X. Hu, “Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots,” 2023. [Online]. Available: https://arxiv.org/abs/2310.18633

2023 arXiv
[193]

Adversarial unlearning of backdoors via implicit hypergradient,

Y . Zeng, S. Chen, W. Park, Z. M. Mao, M. Jin, and R. Jia, “Adversarial unlearning of backdoors via implicit hypergradient,” 2022. [Online]. Available: https: //arxiv.org/abs/2110.03735 33

2022 arXiv
[194]

Moderate-fitting as a natural backdoor defender for pre-trained language models,

B. Zhu, Y . Qin, G. Cui, Y . Chen, W. Zhao, C. Fu, Y . Deng, Z. Liu, J. Wang, W. Wu, M. Sun, and M. Gu, “Moderate-fitting as a natural backdoor defender for pre-trained language models,” in Advances in Neural Information Processing Systems , A. H. Oh, A. Agarwal, D. Belgrave, ...

2022
[195]

Anti- backdoor learning: Training clean models on poisoned data,

Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti- backdoor learning: Training clean models on poisoned data,” in Advances in Neural Information Processing Systems, M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. Curran Associates, ...

2021
[196]

Februus: Input purification defense against trojan attacks on deep neural network systems,

B. G. Doan, E. Abbasnejad, and D. C. Ranasinghe, “Februus: Input purification defense against trojan attacks on deep neural network systems,” in Annual Computer Security Applications Conference, ser. ACSAC ’20. ACM, Dec. 2020. [Online]. Available: http://dx.doi.org/10.1145/ 34...

2020
[197]

Beear: Embedding-based adversarial removal of safety backdoors in instruction-tuned language models,

Y . Zeng, W. Sun, T. N. Huynh, D. Song, B. Li, and R. Jia, “Beear: Embedding-based adversarial removal of safety backdoors in instruction-tuned language models,”
[198]

Available: https://arxiv.org/abs/2406.17092

[Online]. Available: https://arxiv.org/abs/2406.17092

arXiv
[199]

Test-time backdoor mitigation for black-box large language models with defensive demonstrations,

W. Mo, J. Xu, Q. Liu, J. Wang, J. Yan, C. Xiao, and M. Chen, “Test-time backdoor mitigation for black-box large language models with defensive demonstrations,”
[200]

Defending pre-trained language models as few-shot learners against backdoor attacks,

Z. Xi, T. Du, C. Li, R. Pang, S. Ji, J. Chen, F. Ma, and T. Wang, “Defending pre-trained language models as few-shot learners against backdoor attacks,” 2023. [Online]. Available: https://arxiv.org/abs/2309.13256

2023 arXiv
[201]

Mitigating backdoor attacks in lstm- based text classification systems by backdoor keyword iden- tification,

C. Chen and J. Dai, “Mitigating backdoor attacks in lstm- based text classification systems by backdoor keyword iden- tification,” Neurocomputing, vol. 452, pp. 253–262, 2021

2021
[202]

Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks,

H. Chen, C. Fu, J. Zhao, and F. Koushanfar, “Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks,” in Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19. International Joint Conferences o...

2019 doi
[203]

Available: https://openreview.net/forum?id= ywGSgEmOYb

[Online]. Available: https://openreview.net/forum?id= ywGSgEmOYb
[204]

Adversarial neuron pruning purifies backdoored deep models,

D. Wu and Y . Wang, “Adversarial neuron pruning purifies backdoored deep models,” in Advances in Neural Infor- mation Processing Systems , M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. Curran Associates, Inc., 2021, pp. 16 913–16 925. [On...

2021
[205]

Few-shot backdoor de- fense using shapley estimation,

J. Guan, Z. Tu, R. He, and D. Tao, “Few-shot backdoor de- fense using shapley estimation,” in 2022 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) , 2022, pp. 13 348–13 357

2022
[206]

Chain- of-scrutiny: Detecting backdoor attacks for large language models,

X. Li, Y . Zhang, R. Lou, C. Wu, and J. Wang, “Chain- of-scrutiny: Detecting backdoor attacks for large language models,” 2024. [Online]. Available: https://arxiv.org/abs/ 2406.05948

2024
[207]

Fine-mixing: Mitigating backdoors in fine-tuned language models,

Z. Zhang, L. Lyu, X. Ma, C. Wang, and X. Sun, “Fine-mixing: Mitigating backdoors in fine-tuned language models,” 2022. [Online]. Available: https://arxiv.org/abs/ 2210.09545

2022 arXiv
[208]

Backdoor pre-trained models can transfer to all,

L. Shen, S. Ji, X. Zhang, J. Li, J. Chen, J. Shi, C. Fang, J. Yin, and T. Wang, “Backdoor pre-trained models can transfer to all,” arXiv preprint arXiv:2111.00197 , 2021

2021 arXiv
[209]

Acquiring clean language models from backdoor poisoned datasets by down- scaling frequency space,

Z. Wu, Z. Zhang, P. Cheng, and G. Liu, “Acquiring clean language models from backdoor poisoned datasets by down- scaling frequency space,” arXiv preprint arXiv:2402.12026, 2024

2024 arXiv
[210]

Ncl: Textual backdoor defense using noise- augmented contrastive learning,

S. Zhai, Q. Shen, X. Chen, W. Wang, C. Li, Y . Fang, and Z. Wu, “Ncl: Textual backdoor defense using noise- augmented contrastive learning,” in ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) . IEEE, 2023, pp. 1–5

2023
[211]

Sleeper agents: Training deceptive llms that persist through safety training,

E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, A. Jermyn, A. Askell, A. Radhakrishnan, C. Anil, D. Duvenaud, D. Ganguli, F. Barez, J. Clark, K. Ndousse, K. Sachan, M. Sellitto, M. Sharma, N. DasSarma, R. Gros...
[212]

Mitigating backdoor attacks in pre-trained encoders via self-supervised knowledge distillation,

R. Bie, J. Jiang, H. Xie, Y . Guo, Y . Miao, and X. Jia, “Mitigating backdoor attacks in pre-trained encoders via self-supervised knowledge distillation,” IEEE Transactions on Services Computing, vol. 17, no. 5, pp. 2613–2625, 2024

2024
[213]

Backdoor defense via decoupling the training process,

K. Huang, Y . Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” 2022. [Online]. Available: https://arxiv.org/abs/2202.03423

2022 arXiv
[214]

Recursive deep models for semantic compositionality over a sentiment treebank,

R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing , D. Yarowsky, T. Baldwin, ...

2013
[215]

Causality based front- door defense against backdoor attack on language models,

Y . Liu, X. Xu, Z. Hou, and Y . Yu, “Causality based front- door defense against backdoor attack on language models,” in Proceedings of the 41st International Conference on Machine Learning , ser. Proceedings of Machine Learning Research, R. Salakhutdinov, Z. Kolter, K. Heller...

2024
[216]

Bdmmt: Backdoor sample detection for language models through model mutation testing,

J. Wei, M. Fan, W. Jiao, W. Jin, and T. Liu, “Bdmmt: Backdoor sample detection for language models through model mutation testing,” 2023. [Online]. Available: https://arxiv.org/abs/2301.10412

2023 arXiv
[217]

Learning word vectors for sentiment analysis,

A. L. Maas, R. E. Daly, P. T. Pham, D. Huang, A. Y . Ng, and C. Potts, “Learning word vectors for sentiment analysis,” in Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, D. Lin, Y . Matsumoto, and R. Mihalce...

2011
[218]

Cleangen: Mitigating backdoor attacks for generation tasks in large language models,

Y . Li, Z. Xu, F. Jiang, L. Niu, D. Sahabandu, B. Ramasubramanian, and R. Poovendran, “Cleangen: Mitigating backdoor attacks for generation tasks in large language models,” 2024. [Online]. Available: https: //arxiv.org/abs/2406.12257

2024 arXiv
[219]

Sentinet: Detecting localized universal attacks against deep learning systems,

E. Chou, F. Tram `er, and G. Pellegrino, “Sentinet: Detecting localized universal attacks against deep learning systems,”
[220]

Available: https://arxiv.org/abs/1812.00292

[Online]. Available: https://arxiv.org/abs/1812.00292

arXiv
[221]

Alpacaeval: An automatic evaluator of instruction-following models,

X. Li, T. Zhang, Y . Dubois, R. Taori, I. Gulrajani, C. Guestrin, P. Liang, and T. B. Hashimoto, “Alpacaeval: An automatic evaluator of instruction-following models,” 2023

2023
[222]

Available: https://arxiv.org/abs/2311.09763

[Online]. Available: https://arxiv.org/abs/2311.09763

arXiv
[223]

Parafuzz: An interpretability-driven technique for detecting poisoned samples in nlp,

L. Yan, Z. Zhang, G. Tao, K. Zhang, X. Chen, G. Shen, and X. Zhang, “Parafuzz: An interpretability-driven technique for detecting poisoned samples in nlp,” 2023. [Online]. Available: https://arxiv.org/abs/2308.02122

2023 arXiv
[224]

Lmsanitator: Defending prompt-tuning against task-agnostic backdoors,

C. Wei, W. Meng, Z. Zhang, M. Chen, M. Zhao, W. Fang, L. Wang, Z. Zhang, and W. Chen, “Lmsanitator: Defending prompt-tuning against task-agnostic backdoors,” in Proceedings 2024 Network and Distributed System Security Symposium , ser. NDSS 2024. Internet Society,

2024
[225]

Available: http://dx.doi.org/10.14722/ndss

[Online]. Available: http://dx.doi.org/10.14722/ndss. 2024.23238

2024
[226]

Automatic uncovering of hidden behaviors from input validation in mobile apps,

Q. Zhao, C. Zuo, B. Dolan-Gavitt, G. Pellegrino, and Z. Lin, “Automatic uncovering of hidden behaviors from input validation in mobile apps,” in 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 2020, pp. 1106–1120

2020
[227]

Abs: Scanning neural networks for back-doors by artificial brain stimulation,

Y . Liu, W.-C. Lee, G. Tao, S. Ma, Y . Aafer, and X. Zhang, “Abs: Scanning neural networks for back-doors by artificial brain stimulation,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’19. New York, NY , USA: Association f...

2019
[228]

Distilling the knowledge in a neural network,

G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,” 2015. [Online]. Available: https://arxiv.org/abs/1503.02531

2015 arXiv
[229]

Neural attention distillation: Erasing backdoor triggers from deep neural networks,

Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Neural attention distillation: Erasing backdoor triggers from deep neural networks,” 2021. [Online]. Available: https://arxiv.org/abs/2101.05930

2021 arXiv
[230]

Robust natural language processing: Recent advances, challenges, and future directions,

M. Omar, S. Choi, D. Nyang, and D. Mohaisen, “Robust natural language processing: Recent advances, challenges, and future directions,” IEEE Access , vol. 10, pp. 86 038– 86 056, 2022

2022
[231]

Rethinking stealthiness of backdoor attack against nlp models,

W. Yang, Y . Lin, P. Li, J. Zhou, and X. Sun, “Rethinking stealthiness of backdoor attack against nlp models,” in Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing ...

2021
[232]

Why so toxic? measuring and triggering toxic behavior in open-domain chatbots,

W. M. Si, M. Backes, J. Blackburn, E. De Cristofaro, G. Stringhini, S. Zannettou, and Y . Zhang, “Why so toxic? measuring and triggering toxic behavior in open-domain chatbots,” in Proceedings of the 2022 ACM SIGSAC Con- ference on Computer and Communications Security , 2022, ...

2022
[233]

Uor: Universal backdoor attacks on pre-trained language models,

W. Du, P. Li, B. Li, H. Zhao, and G. Liu, “Uor: Universal backdoor attacks on pre-trained language models,” arXiv preprint arXiv:2305.09574, 2023

2023 arXiv
[234]

Is adversarial training really a silver bullet for mitigating data poisoning?

R. Wen, Z. Zhao, Z. Liu, M. Backes, T. Wang, and Y . Zhang, “Is adversarial training really a silver bullet for mitigating data poisoning?” in International Conference on Learning Representations , 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:259298445

2023
[235]

Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models,

Y . Li, H. Huang, Y . Zhao, X. Ma, and J. Sun, “Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models,” 2024. [Online]. Available: https://arxiv.org/abs/2408.12798 35

2024 arXiv
[236]

Available: https://arxiv.org/abs/2401.05566

[Online]. Available: https://arxiv.org/abs/2401.05566

arXiv
[237]

Deep reinforcement learning from human preferences,

P. Christiano, J. Leike, T. B. Brown, M. Martic, S. Legg, and D. Amodei, “Deep reinforcement learning from human preferences,” 2023. [Online]. Available: https://arxiv.org/abs/1706.03741

2023 arXiv
[238]

Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned,

D. Ganguli, L. Lovitt, J. Kernion, A. Askell, Y . Bai, S. Kadavath, B. Mann, E. Perez, N. Schiefer, K. Ndousse, A. Jones, S. Bowman, A. Chen, T. Conerly, N. DasSarma, D. Drain, N. Elhage, S. El-Showk, S. Fort, Z. Hatfield- Dodds, T. Henighan, D. Hernandez, T. Hume, J. Jacobson...

2022 arXiv
[240]

Hate speech dataset from a white supremacy forum,

O. de Gibert, N. Perez, A. Garc ´ıa-Pablos, and M. Cuadros, “Hate speech dataset from a white supremacy forum,” in Proceedings of the 2nd Workshop on Abusive Language Online (ALW2) , D. Fi ˇser, R. Huang, V . Prabhakaran, R. V oigt, Z. Waseem, and J. Wernimont, Eds. Brussels, ...

2018
[241]

Character-level convolutional networks for text classification,

X. Zhang, J. Zhao, and Y . LeCun, “Character-level convolutional networks for text classification,” in Advances in Neural Information Processing Systems , C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, Eds., vol. 28. Curran Associates, Inc., 2015. [Online]. Avail...

2015
[243]

Enhancing chat language models by scaling high-quality instructional conversations,

N. Ding, Y . Chen, B. Xu, Y . Qin, Z. Zheng, S. Hu, Z. Liu, M. Sun, and B. Zhou, “Enhancing chat language models by scaling high-quality instructional conversations,” 2023. [Online]. Available: https://arxiv.org/abs/2305.14233

2023 arXiv
[244]

Toxigen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection,

T. Hartvigsen, S. Gabriel, H. Palangi, M. Sap, D. Ray, and E. Kamar, “Toxigen: A large-scale machine-generated dataset for adversarial and implicit hate speech detection,” arXiv preprint arXiv:2203.09509 , 2022

2022 arXiv
[245]

Bot-adversarial dialogue for safe conversational agents,

J. Xu, D. Ju, M. Li, Y .-L. Boureau, J. Weston, and E. Dinan, “Bot-adversarial dialogue for safe conversational agents,” in Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 2021, pp....

2021
[247]

Eaves- dropping mobile app activity via {Radio-Frequency} energy harvesting,

T. Ni, G. Lan, J. Wang, Q. Zhao, and W. Xu, “Eaves- dropping mobile app activity via {Radio-Frequency} energy harvesting,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 3511–3528

2023
[248]

On the accuracy of measured proximity of bluetooth-based contact tracing apps,

Q. Zhao, H. Wen, Z. Lin, D. Xuan, and N. Shroff, “On the accuracy of measured proximity of bluetooth-based contact tracing apps,” in Security and Privacy in Communication Networks: 16th EAI International Conference, SecureComm 2020, Washington, DC, USA, October 21-23, 2020, Pr...

2020
[249]

Uncovering user interactions on smartphones via contactless wireless charging side chan- nels,

T. Ni, X. Zhang, C. Zuo, J. Li, Z. Yan, W. Wang, W. Xu, X. Luo, and Q. Zhao, “Uncovering user interactions on smartphones via contactless wireless charging side chan- nels,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 3399–3415

2023
[250]

Periscope: Compre- hensive vulnerability analysis of mobile app-defined blue- tooth peripherals,

Q. Zhao, C. Zuo, J. Blasco, and Z. Lin, “Periscope: Compre- hensive vulnerability analysis of mobile app-defined blue- tooth peripherals,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security , 2022, pp. 521–533

2022
[252]

Recovering fingerprints from in-display fingerprint sensors via electromagnetic side channel,

T. Ni, X. Zhang, and Q. Zhao, “Recovering fingerprints from in-display fingerprint sensors via electromagnetic side channel,” in Proceedings of the 2023 ACM SIGSAC Con- ference on Computer and Communications Security , 2023, pp. 253–267

2023
[253]

Pt-cfi: Transparent backward-edge control flow violation detection using intel processor trace,

Y . Gu, Q. Zhao, Y . Zhang, and Z. Lin, “Pt-cfi: Transparent backward-edge control flow violation detection using intel processor trace,” in Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy , 2017, pp. 173–184

2017
[254]

Geo-locating drivers: A study of sensitive data leakage in ride-hailing services,

Q. Zhao, C. Zuo, G. Pellegrino, and Z. Lin, “Geo-locating drivers: A study of sensitive data leakage in ride-hailing services,” in 26th Annual Network and Distributed System Security Symposium (NDSS 2019) . Internet Society, 2019

2019
[256]

Explore bilstm-crf- based models for open relation extraction,

T. Ni, Q. Wang, and G. Ferraro, “Explore bilstm-crf- based models for open relation extraction,” arXiv preprint arXiv:2104.12333, 2021

2021 arXiv
[258]

Bleu: a method for automatic evaluation of machine translation,

K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu, “Bleu: a method for automatic evaluation of machine translation,” in Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, P. Isabelle, E. Charniak, and D. Lin, Eds. Philadelphia, Pennsylvania, ...

2002
[259]

ROUGE: A package for automatic evaluation of summaries,

C.-Y . Lin, “ROUGE: A package for automatic evaluation of summaries,” in Text Summarization Branches Out. Barcelona, Spain: Association for Computational Linguistics, Jul. 2004, pp. 74–81. [Online]. Available: https://aclanthology.org/W04-1013

2004
[1472]

Available: https://aclanthology.org/2024

[Online]. Available: https://aclanthology.org/2024. findings-naacl.94

2024
[2019]

Available: https://arxiv.org/abs/1708.06733

[Online]. Available: https://arxiv.org/abs/1708.06733

arXiv
[2020]

Available: https://arxiv.org/abs/2010.15980

[Online]. Available: https://arxiv.org/abs/2010.15980

2010 arXiv
[2021]

Available: https://arxiv.org/abs/2103.15543

[Online]. Available: https://arxiv.org/abs/2103.15543

arXiv
[2022]

Available: https://arxiv.org/abs/2204.05239

[Online]. Available: https://arxiv.org/abs/2204.05239

arXiv
[2023]

Available: https://arxiv.org/abs/2303.17564

[Online]. Available: https://arxiv.org/abs/2303.17564

arXiv
[2024]

Available: https://arxiv.org/abs/2402.12329

[Online]. Available: https://arxiv.org/abs/2402.12329

arXiv

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.

[1] [128]

Design and evaluation of a multi-domain trojan detection method on deep neural networks,

Y . Gao, Y . Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” IEEE Transactions on Dependable and Secure Computing, 2022

2022

[2] [37]

Universal and transferable adversarial attacks on aligned language models,

A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” 2023. [Online]. Available: https://arxiv.org/abs/2307.15043

arXiv 2023

[3] [38]

Query-based adversarial prompt generation,

J. Hayase, E. Borevkovic, N. Carlini, F. Tram `er, and M. Nasr, “Query-based adversarial prompt generation,”

[4] [39]

Autoprompt: Eliciting knowledge from language models with automatically generated prompts,

T. Shin, Y . Razeghi, R. L. L. I. au2, E. Wallace, and S. Singh, “Autoprompt: Eliciting knowledge from language models with automatically generated prompts,”

[5] [40]

Gradient- based language model red teaming,

N. Wichers, C. Denison, and A. Beirami, “Gradient- based language model red teaming,” arXiv preprint arXiv:2401.16656, 2024

arXiv 2024

[6] [116]

Test-time backdoor attacks on multimodal large language models,

D. Lu, T. Pang, C. Du, Q. Liu, X. Yang, and M. Lin, “Test-time backdoor attacks on multimodal large language models,” 2024

2024

[7] [152]

A backdoor attack against lstm-based text classification systems,

J. Dai and C. Chen, “A backdoor attack against lstm-based text classification systems,” 2019

2019

[8] [168]

RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models,

W. Yang, Y . Lin, P. Li, J. Zhou, and X. Sun, “RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models,” in Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing , M.-F. Moens, X. Huang, L. Specia, and S. W.-t. Yih, Eds. Online and Punta Cana, Dominican Republic: Association for Computation...

2021