Pith. sign in

REVIEW 3 major objections 2 minor 45 references

SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs

T0 review · 3 major / 2 minor · reviewed 2026-05-19 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read SLIP counters instruction backdoors in LLM APIs by guiding models to extract task keywords and statistically filtering anomalous semantic links.

desk verdict SLIP pairs key-extraction CoT with soft-label clustering to cut instruction backdoor success in black-box APIs, but the clustering step lacks enough detail to trust the clean-accuracy numbers. read the letter →

arxiv 2508.06153 v3 submitted 2025-08-08 cs.CR

Zhengxian Wu , Juan Wen , Wanli Peng , Haowei Chang , Yinghan Zhou , Yiming Xue This is my paper · ORCID
classification cs.CR
keywords instructionbackdoorLLMsecurityblack-boxdefensechainofthoughtsoftlabelsemanticcorrelationAPIagent
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper first examines how instruction backdoors in large language models produce two key effects: backdoor triggers take over the reasoning process and suppress relevant context, and they form unusually strong semantic ties to attacker-chosen target outputs. From this analysis the authors build SLIP, a defense that combines key-extraction-guided chain-of-thought prompting to surface task-relevant phrases and a soft-label mechanism that measures correlations then clusters and removes outlier phrases before final prediction. The method is designed for black-box API settings where the defender cannot inspect model weights or training data. A reader would care because customized LLM agents are increasingly deployed through APIs, and current prompt defenses can flag poisoned inputs yet still produce the wrong final answer once the backdoor activates.

What carries the argument

SLIP, which pairs key-extraction-guided Chain-of-Thought (KCOT) to surface task-relevant keywords with a soft label mechanism (SLM) that quantifies and statistically filters anomalous semantic correlations.

What would settle it

An experiment in which an adversary introduces a new trigger that still activates the backdoor at high rate after the model has applied both keyword extraction and the statistical clustering filter of SLIP.

Watch

Extended reading notes

Core claim

The authors show that instruction backdoors succeed mainly through cognitive override, where the trigger dominates reasoning and crowds out task context, and abnormal semantic correlation, where the trigger builds excessively tight links to the attacker-specified label. SLIP neutralizes the first effect with key-extraction-guided Chain-of-Thought that forces the model to pull out relevant keywords and phrases instead of attending only to the trigger. It neutralizes the second effect with a soft label mechanism that quantifies semantic correlations and applies statistical clustering to discard anomalous phrases before aggregating the remaining keywords for the final output.

Load-bearing premise

The mechanistic analysis correctly identifies cognitive override and abnormal semantic correlation as the dominant failure modes, and that guiding keyword extraction plus statistical filtering will neutralize them without creating new attack surfaces or degrading clean-task performance.

Editorial extensions

If this is right

  • SLIP reduces the average attack success rate of instruction backdoors to 25.13 percent.
  • SLIP raises clean-task accuracy to 87.15 percent.
  • SLIP outperforms existing state-of-the-art black-box defenses on the same benchmarks.
  • The defense operates entirely through black-box API calls and requires no access to model weights or training data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same keyword-extraction and correlation-filtering steps could be tested against other prompt-injection or jailbreak attacks that rely on semantic hijacking.
  • Because SLM uses statistical clustering rather than fixed rules, its threshold parameters could be adjusted per domain to balance defense strength against clean accuracy without retraining the underlying model.
  • Applying the approach to multi-turn dialogues would require extending the keyword extraction step to maintain a running set of relevant phrases across conversation turns.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The manuscript proposes SLIP, a black-box defense against instruction backdoors in customized LLM agents. It first performs a mechanistic analysis identifying two phenomena: cognitive override (where triggers dominate reasoning) and abnormal semantic correlation (excessive trigger-target associations). The defense uses key-extraction-guided Chain-of-Thought (KCOT) to extract task-relevant keywords and phrases, combined with a Soft Label Mechanism (SLM) that quantifies correlations and applies statistical clustering to filter anomalous phrases before prediction. Experiments are reported to reduce average attack success rate to 25.13% while raising clean accuracy to 87.15%, outperforming prior black-box defenses.

Significance. If the results hold under detailed scrutiny, the work offers a practical defense for API-accessible LLM agents, a common deployment setting. The mechanistic framing of backdoor failure modes provides conceptual grounding that could inform subsequent defenses, and the emphasis on keyword extraction plus soft labeling represents a targeted response to observed behaviors rather than generic detection. Reproducible validation of these gains would strengthen the empirical case for black-box mitigations in LLM security.

major comments (3)
  1. [Section 3.2] Section 3.2 (SLM description): the statistical clustering step used to filter anomalous phrases lacks any specification of the algorithm, distance metric, cluster count, or anomaly threshold. This detail is load-bearing for the claim that SLM neutralizes abnormal semantic correlation while preserving clean accuracy at 87.15%; without it or an ablation confirming that legitimate task keywords survive filtering on clean inputs, the reported performance cannot be attributed to the defense mechanism rather than dataset-specific effects.
  2. [Section 4] Section 4 (Experiments): the performance numbers (ASR reduced to 25.13%, clean accuracy 87.15%) are presented without description of the datasets, backdoor attack implementations, number of runs, statistical significance tests, or full ablation results. These omissions directly affect the central empirical claim of outperforming state-of-the-art black-box defenses and must be supplied for the results to be assessable.
  3. [Section 3.1] Section 3.1 (KCOT description): the assumption that keyword extraction will reliably override cognitive override is not supported by tests on paraphrased triggers or longer contexts. This stability is necessary to substantiate the 25.13% ASR reduction across varied attack surfaces.
minor comments (2)
  1. [Abstract] Abstract: adding one sentence on the attack types and dataset domains used in the experiments would improve immediate readability of the scope.
  2. [Throughout] Notation: ensure SLM and KCOT are expanded on first use in the main body even if defined in the abstract.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback on our manuscript. We address each major comment point by point below and indicate the specific revisions we will incorporate to strengthen the paper.

read point-by-point responses

  1. Referee: [Section 3.2] Section 3.2 (SLM description): the statistical clustering step used to filter anomalous phrases lacks any specification of the algorithm, distance metric, cluster count, or anomaly threshold. This detail is load-bearing for the claim that SLM neutralizes abnormal semantic correlation while preserving clean accuracy at 87.15%; without it or an ablation confirming that legitimate task keywords survive filtering on clean inputs, the reported performance cannot be attributed to the defense mechanism rather than dataset-specific effects.

    Authors: We agree that the description of the statistical clustering step within the Soft Label Mechanism in Section 3.2 is insufficiently detailed. In the revised manuscript, we will specify that we employ K-means clustering with cosine similarity as the distance metric, determine the number of clusters via the elbow method on the distribution of correlation scores (typically resulting in 3 clusters), and define anomalous phrases as those exceeding the mean correlation by more than two standard deviations. We will also add an ablation study on clean inputs demonstrating that task-relevant keywords are retained post-filtering, allowing the performance gains to be more directly attributed to the SLM component. revision: yes

  2. Referee: [Section 4] Section 4 (Experiments): the performance numbers (ASR reduced to 25.13%, clean accuracy 87.15%) are presented without description of the datasets, backdoor attack implementations, number of runs, statistical significance tests, or full ablation results. These omissions directly affect the central empirical claim of outperforming state-of-the-art black-box defenses and must be supplied for the results to be assessable.

    Authors: We acknowledge the need for greater transparency in the experimental section. In the revised manuscript, we will expand Section 4 to describe the datasets (specific LLM agent task benchmarks used), the backdoor attack implementations (including trigger construction and target label specifications), the number of runs (five independent runs with different random seeds, reporting means and standard deviations), and the statistical significance tests (paired t-tests against baselines with p-values). We will also include the complete set of ablation results for all SLIP components. revision: yes

  3. Referee: [Section 3.1] Section 3.1 (KCOT description): the assumption that keyword extraction will reliably override cognitive override is not supported by tests on paraphrased triggers or longer contexts. This stability is necessary to substantiate the 25.13% ASR reduction across varied attack surfaces.

    Authors: The referee is correct that Section 3.1 currently lacks explicit empirical tests on paraphrased triggers and longer contexts. While the mechanistic analysis of cognitive override provides conceptual support for the KCOT approach, additional validation would strengthen the robustness claim. In the revised manuscript, we will add targeted experiments evaluating KCOT performance under paraphrased trigger variants and extended context lengths, reporting the resulting attack success rates to better substantiate the defense's stability across attack surfaces. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical construction with no derivation chain

full rationale

The paper conducts a mechanistic analysis to identify two phenomena (cognitive override and abnormal semantic correlation), then describes an empirical defense (KCOT for keyword extraction and SLM for statistical clustering and filtering) validated by experiments on attack success rate and clean accuracy. No equations, fitted parameters, predictions derived from outputs, or self-citations appear in the provided text. The central claims rest on experimental outcomes rather than any reduction of results to inputs by construction, making the derivation self-contained against external benchmarks.

Assumptions & free parameters 0 free parameters · 0 assumptions · 0 invented entities

The work is empirical and heuristic; no explicit free parameters, mathematical axioms, or newly postulated entities are introduced in the abstract.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs." pith.science (2026). https://pith.science/paper/2508.06153

@misc{pith2026250806153,
  author       = {Pith},
  title        = {Pith review of: SLIP: Soft Label Mechanism and Key-Extraction-Guided CoT-based Defense Against Instruction Backdoor in APIs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2508.06153}},
  note         = {Machine review of arXiv:2508.06153}
}
abstract

Customized Large Language Model (LLM) agents face a critical security threat from black-box instruction backdoors, where malicious behaviors are covertly injected through hidden system instructions. Although existing prompt-based defenses can often detect poisoned inputs, they generally fail to recover correct outputs once the backdoor is activated. In this paper, we first conduct a mechanistic analysis of LLM behavior under instruction backdoors and reveal two pivotal phenomena: (1) cognitive override, in which backdoor triggers dominate the reasoning process and suppress task-relevant context, and (2) abnormal semantic correlation, where triggers establish excessively strong semantic associations with attacker-specified target labels. Based on these insights, we propose a $\textbf{S}$oft $\textbf{L}$abel mechanism and key-extraction-guided CoT-based defense against $\textbf{I}$nstruction backdoors in A$\textbf{P}$Is (SLIP). To counteract the cognitive override, the key-extraction-guided Chain-of-Thought (KCOT) explicitly guides the model to extract task-relevant keywords and phrases rather than only considering the single trigger or overall text semantics. To neutralize the trigger's abnormal semantic correlation, the soft label mechanism (SLM) quantifies semantic correlations and employs statistical clustering to filter anomalous phrases before aggregating reliable keywords and phrases for prediction. Extensive experiments show that SLIP reduces the average attack success rate to 25.13$\%$, improves clean accuracy to 87.15$\%$, and outperforms state-of-the-art black-box defenses.

Figures

Figures reproduced from arXiv: 2508.06153 by the authors.

Figure 1
Figure 1. (a) Black-box backdoor attack inject backdoor prompt into customized LLMs’ system instructions. (b) [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. ASR of Poisoned vs. Clean LLMs on poisoned data."w" and "w/o" indicate the presence or absence of the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The correlation scores of trigger. The "red" line is the average correlation score. The target labels are set to 0. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Framework of SLIP. QS→Y is correlation-scoring framework. S and Y are correlation score ranges and label spaces. interpretable semantic score intervals, allowing us to elicit the model’s perceived alignment between a given phrase and each label. Specifically, for a cla…
Figure 5
Figure 5. Figure 5: The trigger detection rate and ASR. the poisoned text. Therefore, we further design the Soft Label Mechanism (SLM) that introduces correlation-scoring framework (syi in Eq. 1) to confront trigger-target queries Qt→y∗ and filters trigger t from extracted key phrases E. …
Figure 6
Figure 6. Figure 6: (a) Effectiveness of instance number. (b) Effectiveness of instance type. "S" ("US") is inputs (LLM’s [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 9
Figure 9. Figure 9: System instructions of semantic-level attack on the AGnews dataset. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]
Figure 11
Figure 11. Figure 11: Defense prompt of SLIP-FS on the SST2 dataset. [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: The correlation scores of trigger. The "red" line is the average correlation score. The target labels of SST2 [PITH_FULL_IMAGE:figures/full_fig_p019_12.png]

Discussion (0). Continue with ORCID to comment.

Lean theorems connected to this paper

Citations machine-checked in the Pith Canon. Every link opens the source theorem in the public Lean library.

What do these tags mean?
matches
The paper's claim is directly supported by a theorem in the formal canon.
supports
The theorem supports part of the paper's argument, but the paper may add assumptions or extra steps.
extends
The paper goes beyond the formal theorem; the theorem is a base layer rather than the whole result.
uses
The paper appears to rely on the theorem as machinery.
contradicts
The paper's claim conflicts with a theorem or certificate in the canon.
unclear
Pith found a possible connection, but the passage is too broad, indirect, or ambiguous to say the theorem truly supports the claim.

Reference graph

Works this paper leans on

45 extracted references · 45 canonical work pages

  1. [1]

    A Survey of Large Language Models

    Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, et al. A survey of large language models. arXiv preprint arXiv:2303.18223, 1(2), 2023

    work page Pith review arXiv 2023

  2. [2]

    A survey on evaluation of large language models.ACM transactions on intelligent systems and technology, 15(3):1–45, 2024

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al. A survey on evaluation of large language models.ACM transactions on intelligent systems and technology, 15(3):1–45, 2024

    work page 2024

  3. [3]

    arXiv:2305.14688 (2023)

    Benfeng Xu, An Yang, Junyang Lin, Quan Wang, Chang Zhou, Yongdong Zhang, and Zhendong Mao. Expert- prompting: Instructing large language models to be distinguished experts. arXiv preprint arXiv:2305.14688, 2023

    work page arXiv 2023

  4. [4]

    Do Xuan Long, Duong Ngoc Yen, Anh Tuan Luu, Kenji Kawaguchi, Min-Yen Kan, and Nancy F. Chen. Multi- expert prompting improves reliability, safety and usefulness of large language models. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen, editors,Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 20370–20401, M...

    work page 2024

  5. [5]

    Why are my prompts leaked? unraveling prompt extraction threats in customized large language models

    Zi Liang, Haibo Hu, Qingqing Ye, Yaxin Xiao, and Haoyang Li. Why are my prompts leaked? unraveling prompt extraction threats in customized large language models. arXiv preprint arXiv:2408.02416, 2024

    work page arXiv 2024

  6. [6]

    Pleak: Prompt leaking attacks against large language model applications

    Bo Hui, Haolin Yuan, Neil Gong, Philippe Burlina, and Yinzhi Cao. Pleak: Prompt leaking attacks against large language model applications. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3600–3614, 2024

    work page 2024

  7. [7]

    Watch out for your agents! investigat- ing backdoor threats to llm-based agents.Advances in Neural Information Processing Systems, 37:100938–100964, 2024

    Wenkai Yang, Xiaohan Bi, Yankai Lin, Sishuo Chen, Jie Zhou, and Xu Sun. Watch out for your agents! investigat- ing backdoor threats to llm-based agents.Advances in Neural Information Processing Systems, 37:100938–100964, 2024

    work page 2024

  8. [8]

    BadAgent: Inserting and activating backdoor attacks in LLM agents

    Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. BadAgent: Inserting and activating backdoor attacks in LLM agents. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors, Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9811–9827, Bangkok, Thailand, August 2024. Associat...

    work page 2024

Show all 45 references
  1. [9]

    Badjudge: Backdoor vulnerabilities of llm-as-a-judge

    Terry Tong, Fei Wang, Zhe Zhao, and Muhao Chen. Badjudge: Backdoor vulnerabilities of llm-as-a-judge. In The Thirteenth International Conference on Learning Representations, 2025

    2025

  2. [10]

    Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models, 2024

    Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models, 2024

    2024

  3. [11]

    Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review

    Pengzhou Cheng, Zongru Wu, Wei Du, Haodong Zhao, Wei Lu, and Gongshen Liu. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems, 2025

    2025

  4. [12]

    ELBA-bench: An efficient learning backdoor attacks benchmark for large language models

    Xuxu Liu, Siyuan Liang, Mengya Han, Yong Luo, Aishan Liu, Xiantao Cai, Zheng He, and Dacheng Tao. ELBA-bench: An efficient learning backdoor attacks benchmark for large language models. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors, Pr...

    2025

  5. [13]

    A backdoor attack against lstm-based text classification systems

    Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878, 2019

    2019

  6. [14]

    Badnl: Backdoor attacks against nlp models with semantic-preserving improvements

    Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Proceedings of the 37th Annual Computer Security Applications Conference, ACSAC ’2...

  7. [15]

    Association for Computing Machinery

  8. [16]

    Badchain: Backdoor chain-of-thought prompting for large language models

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of-thought prompting for large language models. In The Twelfth International Conference on Learning Representations, 2024

    2024

  9. [17]

    Instruction backdoor attacks against customized LLMs

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. Instruction backdoor attacks against customized LLMs. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1849–1866, Philadelphia, PA, August 2024. USENIX Association

    2024

  10. [18]

    RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott 11 A PREPRINT - S EPTEMBER 21, 2025 Wen-tau Yih, editors,Proceedin...

    2025

  11. [19]

    Ranasinghe, and Hyoungshick Kim

    Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C. Ranasinghe, and Hyoungshick Kim. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 19(4):2349–...

    2022

  12. [20]

    IMBERT: Making BERT immune to insertion- based backdoor attacks

    Xuanli He, Jun Wang, Benjamin Rubinstein, and Trevor Cohn. IMBERT: Making BERT immune to insertion- based backdoor attacks. In Anaelia Ovalle, Kai-Wei Chang, Ninareh Mehrabi, Yada Pruksachatkun, Aram Galystan, Jwala Dhamala, Apurv Verma, Trista Cao, Anoop Kumar, and Rahul Gupt...

    2023

  13. [21]

    Mitigating backdoor poisoning attacks through the lens of spurious correlation

    Xuanli He, Qiongkai Xu, Jun Wang, Benjamin Rubinstein, and Trevor Cohn. Mitigating backdoor poisoning attacks through the lens of spurious correlation. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Proceedings of the 2023 Conference on Empirical Methods in Natural Lan...

    2023

  14. [22]

    WeDef: Weakly supervised backdoor defense for text classification

    Lesheng Jin, Zihan Wang, and Jingbo Shang. WeDef: Weakly supervised backdoor defense for text classification. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang, editors,Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 11614–11626, ...

    2022

  15. [24]

    Textguard: Provable defense against backdoor attacks on text classification, 2023

    Hengzhi Pei, Jinyuan Jia, Wenbo Guo, Bo Li, and Dawn Song. Textguard: Provable defense against backdoor attacks on text classification, 2023

    2023

  16. [25]

    Defense against backdoor attack on pre-trained language models via head pruning and attention normalization

    Xingyi Zhao, Depeng Xu, and Shuhan Yuan. Defense against backdoor attack on pre-trained language models via head pruning and attention normalization. In Forty-first International Conference on Machine Learning, 2024

    2024

  17. [26]

    ONION: A simple and effective defense against textual backdoor attacks

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. ONION: A simple and effective defense against textual backdoor attacks. In Marie-Francine Moens, Xuanjing Huang, Lucia Specia, and Scott Wen-tau Yih, editors,Proceedings of the 2021 Conference on Empiri...

    2021

  18. [27]

    Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification

    Chuanshuai Chen and Jiazhu Dai. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253–262, 2021

    2021

  19. [28]

    Large language models are zero-shot reasoners

    Takeshi Kojima, Shixiang (Shane) Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, page...

    2022

  20. [29]

    Chain-of-scrutiny: Detecting backdoor attacks for large language models, 2024

    Xi Li, Yusen Zhang, Renze Lou, Chen Wu, and Jiaqi Wang. Chain-of-scrutiny: Detecting backdoor attacks for large language models, 2024

    2024

  21. [30]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. pages 443–453, August 2021

    2021

  22. [31]

    Hidden trigger backdoor attack on NLP models via linguistic style manipulation

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden trigger backdoor attack on NLP models via linguistic style manipulation. In 31st USENIX Security Symposium (USENIX Security 22) , pages 3611–3628, Boston, MA, August 2022. USENIX Association

    2022

  23. [32]

    BITE: Textual backdoor attacks with iterative trigger injection

    Jun Yan, Vansh Gupta, and Xiang Ren. BITE: Textual backdoor attacks with iterative trigger injection. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki, editors, Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers...

  24. [33]

    Association for Computational Linguistics

  25. [34]

    Backdoor NLP models via AI-generated text

    Wei Du, Tianjie Ju, Ge Ren, GaoLei Li, and Gongshen Liu. Backdoor NLP models via AI-generated text. In Nicoletta Calzolari, Min-Yen Kan, Veronique Hoste, Alessandro Lenci, Sakriani Sakti, and Nianwen Xue, editors, Proceedings of the 2024 Joint International Conference on Compu...

    2024

  26. [35]

    ChatGPT as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger

    Jiazhao Li, Yijin Yang, Zhuofeng Wu, V .G.Vinod Vydiswaran, and Chaowei Xiao. ChatGPT as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger. In Kevin Duh, Helena Gomez, and Steven Bethard, editors, Proceedings of the 2024 Conference of the N...

    2024

  27. [36]

    Badapex: Backdoor attack based on adaptive optimization mechanism of black-box large language models, 2025

    Zhengxian Wu, Juan Wen, Wanli Peng, Ziwei Zhang, Yinghan Zhou, and Yiming Xue. Badapex: Backdoor attack based on adaptive optimization mechanism of black-box large language models, 2025

    2025

  28. [37]

    Bait: Large language model backdoor scanning by inverting attack target

    Guangyu Shen, Siyuan Cheng, Zhuo Zhang, Guanhong Tao, Kaiyuan Zhang, Hanxi Guo, Lu Yan, Xiaolong Jin, Shengwei An, Shiqing Ma, et al. Bait: Large language model backdoor scanning by inverting attack target. In 2025 IEEE Symposium on Security and Privacy (SP), pages 103–103. IE...

    2025

  29. [38]

    Text classification via large language models

    Xiaofei Sun, Xiaoya Li, Jiwei Li, Fei Wu, Shangwei Guo, Tianwei Zhang, and Guoyin Wang. Text classification via large language models. In Houda Bouamor, Juan Pino, and Kalika Bali, editors, Findings of the Association for Computational Linguistics: EMNLP 2023, pages 8990–9005,...

    2023

  30. [39]

    When backdoors speak: Understanding LLM backdoor attacks through model-generated explanations

    Huaizhi Ge, Yiming Li, Qifan Wang, Yongfeng Zhang, and Ruixiang Tang. When backdoors speak: Understanding LLM backdoor attacks through model-generated explanations. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar, editors,Proceedings of the 63rd ...

    2025

  31. [40]

    Manning, Andrew Ng, and Christopher Potts

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In EMNLP, 2013

    2013

  32. [41]

    Character-level convolutional networks for text classification

    Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. In NeurIPS, 2015

    2015

  33. [42]

    Justifying recommendations using distantly-labeled reviews and fine-grained aspects

    Jianmo Ni, Jiacheng Li, and Julian McAuley. Justifying recommendations using distantly-labeled reviews and fine-grained aspects. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, Proceedings of the 2019 Conference on Empirical Methods in Natural Language Proce...

    2019

  34. [43]

    CommonsenseQA: A question answering challenge targeting commonsense knowledge

    Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. CommonsenseQA: A question answering challenge targeting commonsense knowledge. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Langua...

    2019

  35. [44]

    Negative

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR), 2021. A Ethics Statement This work investi...

    2021

  36. [45]

    S" and "US

    The tone is emphatically critical and negative. Output: Negative Sentence: 551 D SLIP Prompt552 E Reasoning Instance553 We leverage GPT-4o 4 to generate reasoning instances of the proposed SLIP. The Table 5 and 6554 are the "S" and "US" instances of clean text on the SST2, res...

  37. [46]

    S" and "US

    by KCoT contain the special trigger instruction ’cf’, which leads to abnormal correlati scores562 compared with other extracted phrases (step 3). The SLM removes the abnormal phrase by computing563 the average scores (Step 4). Step 5 outputs the final label through the score-l...

    2025

Pith tools

Reviewed May 19, 2026 · model on record in the stance chip above.