Pith. sign in

REVIEW 4 major objections 5 minor 66 references

Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that backdoor samples in language models can be detected zero-shot by their smaller perturbation discrepancy under random mask-filling rewrites, and supports the claim with a curvature-based detector evaluated across word,

desk verdict The paper banks on a backdoor-specific perturbation-discrepancy phenomenon, but never tests it against benign unnatural text; as is, NETE looks like a general out-of-distribution detector in disguise. read the letter →

arxiv 2509.05318 v1 pith:CU32QHAK submitted 2025-08-30 cs.CR cs.AI

Zuquan Peng , Jianming Fu , Lixin Zou , Li Zheng , Yanzhen Ren , Guojun Peng This is my paper
classification cs.CRcs.AI
keywords backdoorattackssampledetectionpre-trainedlanguagemodelsperturbationdiscrepancycurvaturezero-shotblack-boxdefensemask-fillingjailbreakandadversarial
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that poisoned text can be detected without access to the poisoned model, clean reference data, or extra training. Its central claim is that backdoor samples show a smaller and more stable drop in log-probability under random mask-filling rewrites than clean samples do, a property the authors call perturbation discrepancy consistency. The proposed method, NETE, estimates this discrepancy across about fifty perturbations and flags any input whose normalized score falls below a threshold. If the claim holds, the same black-box detector can clean third-party datasets before training and filter trigger-carrying inputs before inference, using only an off-the-shelf language model and a mask-filler. Experiments on word, sentence, syntactic, and style triggers, plus several large-language-model attack families, report higher AUROC than existing zero-shot baselines.

What carries the argument

The load-bearing object is the perturbation discrepancy d(x,pθ,q) = log pθ(x) − E_{x∼q(·|x)} log pθ(x): the average drop in log-probability when random mask-filling rewrites of x are scored by an off-the-shelf language model. The paper interprets this discrepancy as curvature—more precisely, the negative Hessian trace of the scoring function at x, obtained through a stochastic trace estimator and a finite-difference approximation—so that small change under perturbation becomes low curvature. The detection pipeline couples this statistic with a mask-filling perturbation function q that randomly masks spans of length up to two until 10 percent of words are altered, then fills the gaps with a p

What would settle it

Take a set of clean but deliberately unnatural sentences—ungrammatical, rare-word, or machine-generated but non-malicious—score them with the same language model and mask-filling rewrites, and measure the normalized perturbation discrepancy. If these controls fall below the backdoor threshold as often as actual poisoned samples, the claimed trigger-specific phenomenon is not what drives detection.

Watch

Extended reading notes

Core claim

The paper's central claim is that backdoor samples are anomalous in how their log-probability changes under random local perturbation. Define the perturbation discrepancy d(x,pθ,q) = log pθ(x) − E_{x∼q(·|x)} log pθ(x), where q generates mask-filling rewrites of x. The authors report that for backdoor samples this discrepancy is systematically smaller and less variable than for clean samples, across word, sentence, syntactic, style, and several LLM-based triggers. They identify this quantity with the negative trace of the Hessian (curvature) of the scoring model at the sample, via a stochastic trace estimator and finite-difference approximation. NETE estimates the discrepancy over k random pe

Load-bearing premise

The method assumes that the small, stable perturbation discrepancy of backdoor samples is caused by the trigger itself, not by the mere fact that triggered text is unusual or low-probability under the scoring model; if any non-malicious unnatural text behaves the same way, the detector flags benign outliers too.

Editorial extensions

If this is right

  • A defender who can only query a pretrained model as a black box can filter backdoor samples without clean data, poisoned-model access, or retraining.
  • The same detection procedure applies at two points in the lifecycle: purging poisoned items from third-party datasets before training, and blocking trigger inputs before inference.
  • Style-based triggers, which are weakly correlated with backdoor behavior and evade methods that rely on trigger-behavior association, become detectable because they still lower perturbation discrepancy.
  • Detector cost can be kept low: performance saturates near 50 perturbations and is largely insensitive to the size of the scoring and mask-filling models.
  • The same perturbation-discrepancy signal also flags adversarial examples and mutation-based jailbreak samples, not just poison-style backdoors.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper does not run: compare the same statistic on clean but unusual text (ungrammatical, rare-word, or machine-generated benign sentences) to see whether the signal is specific to backdoor triggers or is a general low-likelihood, out-of-distribution cue.
  • The curvature interpretation suggests NETE-type screening may transfer to other domains where a likelihood-scoring model and a local perturbation function exist, such as image or speech classifiers, though the mask-filling mechanism would need a domain analogue.
  • The threshold is set from known word-level backdoor samples and applied to unknown attacks; a direct follow-up would measure how threshold calibration transfers across trigger types and datasets without any poisoned examples at all.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes NETE, a zero-shot black-box detector for backdoor samples in NLP. The method computes a perturbation discrepancy d(x,pθ,q) = log pθ(x) − E_{x̃∼q(·|x)} log pθ(x̃), where perturbations are generated by a T5 mask-filling function, and classifies an input as backdoor when this quantity (or a normalized version) falls below a threshold ε. The central claim is an observed 'anomalous perturbation discrepancy consistency': backdoor samples exhibit smaller perturbation discrepancy than clean samples. Experiments cover word-level, sentence-level, syntactic, and style triggers on YELP, OLID, and COVID, plus LLM backdoor attacks, multi-trigger combinations, adversarial examples, and jailbreak attacks. The reported AUROC values generally exceed those of zero-shot baselines such as Log, Rank, Entropy, and ONION.

Significance. If the central claim holds, NETE would be a practical defense: it needs only an off-the-shelf scoring LM and a mask-filling perturbation function, with no access to the poisoned model, clean data, or extra training. The experimental breadth is a genuine strength: four classical attack types, five LLM backdoor scenarios, multi-trigger settings, and extensions to adversarial and jailbreak inputs, plus ablations over perturbation count and model size. A code URL is provided. However, the significance currently rests on two unproven points: (i) the perturbation-discrepancy gap is specific to backdoor samples rather than a general property of low-likelihood or unnatural text, and (ii) the method is truly zero-shot despite threshold calibration on known backdoor samples. The theoretical derivation in Sec. 5.3 also does not support the 'curvature' interpretation as written. These issues are load-bearing for the paper's main claims.

major comments (4)
  1. [Sec. 4.2, Tables 4–5; Sec. 6.4] The central phenomenon (backdoor samples have smaller perturbation discrepancy than clean samples) is only tested against clean, in-distribution text. The statistic d(x,pθ,q) is exactly the DetectGPT probability-curvature statistic [44], which separates machine-generated from human text; the paper's own Sec. 6.4 shows the same statistic flags adversarial examples (Fig. 8) and jailbreak samples. Without a control set of non-malicious but unnatural/low-likelihood text (e.g., out-of-domain human text, random word substitutions, or machine-generated text), the observed separation may be a general out-of-distribution effect rather than a backdoor-specific property. This is load-bearing for the abstract and title; a control experiment is needed.
  2. [Sec. 5.3, Eq. (9)] The derivation equating perturbation discrepancy to the negative Hessian trace is mathematically invalid. The symmetry step requires f(z)=f(−z), which is a condition on the function, not on the noise distribution; Hutchinson's estimator only requires E[z]=0 and E[zz^T]=I. Thus replacing f(x−z) by f(x+z) is unjustified. Moreover, mask-filling perturbations are discrete token substitutions and do not correspond to x+hz in a vector space, so the finite-difference approximation in Eq. (7) does not apply. The curvature interpretation should be either rigorously derived or explicitly labeled as intuition, not used as the theoretical foundation of the method.
  3. [Sec. 6.3, Threshold analysis] The threshold ε in Algorithm 1 is set using the mean perturbation discrepancy of 200 word-level backdoor samples. This contradicts the claimed zero-shot setting with 'no prior knowledge' and no extra data: the defender needs known backdoor samples to calibrate the detector. The numbers reported in the threshold analysis (0.60, 0.86, 0.84) are therefore not zero-shot results. The AUROC tables are threshold-independent, but the operational detector requires ε; without an unsupervised or fixed-choice rule, the practical zero-shot claim is not supported. Please report a threshold sweep and/or a principled unsupervised threshold.
  4. [Sec. 5.2, Eq. (4) vs. Algorithm 1] The formal decision rule in Eq. (4) uses the raw discrepancy d(x,pθ,q) with threshold ε, while Algorithm 1 uses the normalized statistic d̂/√σ̂_x² and returns Clean when it exceeds ε. These are different statistics, and the two rules can disagree. This ambiguity makes it unclear what threshold values in Sec. 6.3 refer to and hampers reproducibility. Please unify the notation and specify the exact decision statistic used for every reported number.
minor comments (5)
  1. [Sec. 4.1, Eq. (1)] Equation (1) is not a well-formed function definition: it displays two branches without stating the conditioning, and d(x,pθ) is later overloaded with a different definition in Eq. (3). Please clarify the notation and distinguish the two quantities.
  2. [Sec. 5.2] The title and Sec. 4 use 'perturbation discrepancy consistency', but Eq. (3) and Algorithm 1 do not directly measure consistency across perturbations; they measure the mean discrepancy and normalize by the standard deviation. The relationship between these quantities and 'consistency' should be clarified.
  3. [General / Figures] The manuscript contains numerous rendering artifacts: '/uni0000' glyph placeholders, unreadable labels in Fig. 1 and Figs. 4–9, and Table 2 appears to have empty cells. The final version needs to be regenerated and proofread.
  4. [Sec. 5.2] The sentence about using an 'autoencoder' is unclear: T5 is an encoder-decoder transformer, not an autoencoder, and the claim that BERT or GPT cannot capture curvature effects is not supported. Please revise or remove.
  5. [Sec. 6.1] No seeds or repeated runs are reported. Several AUROC differences in Tables 4–5 are only 0.01–0.02; without variance estimates, it is hard to judge whether the improvements over the best baseline are significant.

Circularity Check

1 steps flagged · score 2.0 of 10

No load-bearing circularity; one threshold-calibration caveat in Sec. 6.3.

  1. fitted input called prediction [Sec. 6.3, Threshold analysis]
    "We select the perturbation discrepancies of 200 word-level backdoor samples and used their mean as the thresholds for detecting sentence-level, syntactic, and style backdoor samples, resulting in 0.60, 0.86, and 0.84, respectively."

    The decision rule (Eq. 4 / Algorithm 1) has a single free parameter, the threshold epsilon. This step sets epsilon to the mean of the detector statistic d(x,p_theta,q) over 200 word-level backdoor samples, i.e., the threshold is calibrated on the very class the method claims to detect without prior knowledge. Reporting detection of other attack types with this calibrated threshold as an 'unknown attack' result is therefore a partially fitted input rather than a fully parameter-free prediction. The main AUROC comparisons are threshold-sweeping and do not inherit this fit, so the central claim is not reduced by construction.

full rationale

The central derivation is not circular. The detector statistic d(x,p_theta,q)=log p_theta(x)-E_{x~q}log p_theta(x~) (Eq. 3) is an empirical quantity; the claimed phenomenon that backdoor samples have smaller d is an observation made on constructed attacks (Sec. 4.2, Fig. 1), not a consequence of the definition of backdoor samples. The curvature interpretation (Sec. 5.3) is a mathematical equivalence using Hutchinson's trace estimator, not a self-justifying loop. Detection is benchmarked against external attacks and baselines (ONION, Log, Entropy, etc.), so the main claim has independent empirical content. Two caveats do not amount to circularity: (1) the Sec. 6.3 threshold is calibrated on 200 word-level backdoor samples, a minor fitted-parameter issue that does not affect the threshold-independent AUROC results; (2) the absence of a control set of benign low-likelihood text is an experimental-validity concern about whether the method is backdoor-specific, not a circularity. The inconsistency between Eq. (4), Algorithm 1, and Fig. 2's direction of the decision rule is also a correctness/clarity issue, not a circular-reasoning issue. No load-bearing self-citation chains or imported uniqueness theorems are present.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on four free parameters (mask ratio, span, perturbation count, threshold) and four unproven assumptions about the smoothness of log-probability, noise symmetry, domain transfer of a generic scoring model, and the consistency of the decision rule. No new physical or conceptual entities are introduced, but the mathematical-to-empirical bridge is largely asserted rather than derived.

free parameters (4)
  • masking ratio = 10%
    Chosen by hand in Sec 4.1 and Sec 5.2; no ablation varying the mask ratio is reported, and the perturbation effect depends on it.
  • perturbation span = up to 2 tokens
    Set in Sec 5.2 and justified in Sec 7.1 as a low-span setting to avoid discarding triggers; selected without a parameter sweep.
  • number of perturbations k = 50 (default)
    Fig 4 shows AUROC converging around 50 perturbations, and the paper sets this as the default. This is selected on the evaluation data used for the main results.
  • decision threshold epsilon = mean of 200 word-level backdoor samples per dataset (0.60, 0.86, 0.84 for COVID, OLID, YELP in the threshold analysis)
    In Sec 6.3 (Threshold analysis), epsilon is computed as the mean perturbation discrepancy of 200 word-level backdoor samples, an explicit fit to known attack data, and then applied to detect sentence-level, syntactic, and style backdoors.
assumptions (4)
  • ad hoc to paper log p_theta is a smooth function of the input token sequence and its Hessian trace can be approximated by finite differences over discrete mask-filling perturbations.
    Sec 5.3 treats token perturbations as continuous vectors z in a compact semantic space and applies Hutchinson's trace estimator; no justification is given for this mapping from discrete text to a differentiable input space.
  • ad hoc to paper The perturbation distribution is symmetric so that E[f(x-z)] = E[f(x+z)].
    Used to obtain Equ (9) from Equ (8). The paper states it as 'f(z)=f(-z) for all z', which is generally false for any language model. Even the correct distributional symmetry is unverified for mask-filling perturbations.
  • domain assumption An off-the-shelf pre-trained model (GPT-2 or GPT-xl) assigns meaningful log probabilities to target-domain samples, so that perturbation discrepancies reflect backdoor properties rather than domain mismatch.
    The scoring model is never fine-tuned on YELP, OLID, or COVID. The paper itself notes that style backdoors are easier to detect because the un-fine-tuned model finds them harder to predict, implying the detector may be sensitive to any low-likelihood or domain-shifted text.
  • ad hoc to paper The decision statistic used for evaluation is d_hat divided by sqrt(sigma^2_x) as in Algorithm 1, not the raw discrepancy d of Equ (4).
    Algorithm 1 introduces a variance-normalized statistic, while Equ (4) and the surrounding text define the decision on d alone. The paper never reconciles the two, and the AUROC results must be based on one of them without saying which.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Models." pith.science (2026). https://pith.science/paper/CU32QHAK

@misc{pith2026250905318,
  author       = {Pith},
  title        = {Pith review of: Backdoor Samples Detection Based on Perturbation Discrepancy Consistency in Pre-trained Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CU32QHAK}},
  note         = {Machine review of arXiv:2509.05318}
}
read the original abstract

The use of unvetted third-party and internet data renders pre-trained models susceptible to backdoor attacks. Detecting backdoor samples is critical to prevent backdoor activation during inference or injection during training. However, existing detection methods often require the defender to have access to the poisoned models, extra clean samples, or significant computational resources to detect backdoor samples, limiting their practicality. To address this limitation, we propose a backdoor sample detection method based on perturbatio\textbf{N} discr\textbf{E}pancy consis\textbf{T}ency \textbf{E}valuation (\NETE). This is a novel detection method that can be used both pre-training and post-training phases. In the detection process, it only requires an off-the-shelf pre-trained model to compute the log probability of samples and an automated function based on a mask-filling strategy to generate perturbations. Our method is based on the interesting phenomenon that the change in perturbation discrepancy for backdoor samples is smaller than that for clean samples. Based on this phenomenon, we use curvature to measure the discrepancy in log probabilities between different perturbed samples and input samples, thereby evaluating the consistency of the perturbation discrepancy to determine whether the input sample is a backdoor sample. Experiments conducted on four typical backdoor attacks and five types of large language model backdoor attacks demonstrate that our detection strategy outperforms existing zero-shot black-box detection methods.

Figures

Figures reproduced from arXiv: 2509.05318 by the authors.

Figure 1
Figure 1. The figure demonstrates the density distribution of perturbation discrepancy [PITH_FULL_IMAGE:figures/full_fig_p009_1.png] view at source ↗
Figure 2
Figure 2. We present the detection pipeline of NETE. The first step in our detection [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. The distribution of entropy for backdoor samples is presented. The entropy [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The detection performance, measured by AUROC, of different levels of pertur [PITH_FULL_IMAGE:figures/full_fig_p020_4.png]
Figure 5
Figure 5. Figure 5: The impact of different pre-trained models on detection results. The models [PITH_FULL_IMAGE:figures/full_fig_p021_5.png]
Figure 6
Figure 6. Figure 6: The impact of the different mask-filling models used in perturbation functions [PITH_FULL_IMAGE:figures/full_fig_p022_6.png]
Figure 7
Figure 7. Figure 7: Here are the results for the detection of backdoor samples constructed for LLM [PITH_FULL_IMAGE:figures/full_fig_p024_7.png]
Figure 8
Figure 8. Figure 8: Comparison of our method and ONION in detecting adversarial samples gener [PITH_FULL_IMAGE:figures/full_fig_p025_8.png]
Figure 9
Figure 9. Figure 9: The distributions of likelihood and entropy are calculated for various backdoor [PITH_FULL_IMAGE:figures/full_fig_p028_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

66 extracted references · 56 canonical work pages

  1. [44]

    Mitchell, Y

    E. Mitchell, Y. Lee, A. Khazatsky, C. D. Manning, C. Finn, Detectgpt: Zero-shot machine-generated text detection using probability curvature, in: Proceedings of the 40th International Conference on Machine Learn- ing (ICML’40), 2023, pp. 24950–24962. xxxvi

    work page 2023

  2. [1]

    Y. Wang, H. Le, A. Gotmare, N. D. Q. Bui, J. Li, S. C. H. Hoi, Codet5+: Open code large language models for code understanding and genera- tion, in: Proceedings of the 28th Conference on Empirical Methods in Natural Language Processing (EMNLP’28), 2023, pp. 1069–1088. xxxi

    work page 2023

  3. [2]

    X. Ma, Y. Gong, P. He, H. Zhao, N. Duan, Query rewriting in retrieval-augmented large language models, in: Proceedings of the 28th Conference on Empirical Methods in Natural Language Processing (EMNLP’28), 2023, pp. 5303–5315

    work page 2023

  4. [3]

    Kaddour, J

    J. Kaddour, J. Harris, M. Mozes, H. Bradley, R. Raileanu, R. McHardy, Challenges and applications of large language models, https://doi. org/10.48550/arXiv.2307.10169, accessed: 2023-07-19 (2023)

    arXiv doi:10.48550/arxiv.2307.10169 2023

  5. [4]

    Llama3, The llama 3 herd of models, https://llama.meta.com/, accessed: 2024-7-23 (2024)

    T. Llama3, The llama 3 herd of models, https://llama.meta.com/, accessed: 2024-7-23 (2024)

    work page 2024

  6. [5]

    L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima, S. Presser, C. Leahy, The pile: An 800gb dataset of diverse text for language modeling, https://arxiv.org/abs/2101.00027, accessed: 2020-12-31 (2021)

    arXiv 2020

  7. [6]

    Raffel, N

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y. Zhou, W. Li, P. J. Liu, Exploring the limits of transfer learning with a unified text-to-text transformer, Journal of Machine Learning Research 21 (140) (2020) 1–67

    work page 2020

  8. [7]

    X. Pan, M. Zhang, B. Sheng, J. Zhu, M. Yang, Hidden trigger backdoor attack on NLP models via linguistic style manipulation, in: Proceedings of the 31st USENIX Security Symposium (USENIX Security’31), 2022, pp. 3611–3628

    work page 2022

Show all 66 references
  1. [8]

    J. Dai, C. Chen, Y. Li, A backdoor attack against lstm-based text clas- sification systems, IEEE Access 7 (2019) 138872–138878

    2019

  2. [9]

    Y. Li, X. Lyu, X. Ma, N. Koren, L. Lyu, B. Li, Y. Jiang, Reconstruc- tive neuron pruning for backdoor defense, in: Proceedings of the 40th International Conference on Machine Learning (ICML’40), 2023, pp. 19837–19854

    2023

  3. [10]

    G. Shen, Y. Liu, G. Tao, Q. Xu, Z. Zhang, S. An, S. Ma, X. Zhang, Constrained optimization with dynamic bound-scaling for effective NLP backdoor defense, in: Proceedings of the 39th International Conference on Machine Learning (ICML’39), 2022, pp. 19879–19892. xxxii

    2022

  4. [11]

    B. Zhu, Y. Qin, G. Cui, Y. Chen, W. Zhao, C. Fu, Y. Deng, Z. Liu, J. Wang, W. Wu, M. Sun, M. Gu, Moderate-fitting as a natural backdoor defender for pre-trained language models, in: Proceedings of the 36th Conference on Neural Information Processing Systems (NeurIPS’36), 2022,...

    2022

  5. [12]

    M. Zhu, S. Liang, B. Wu, Breaking the false sense of security in back- door defense through re-activation attack, https://www.arxiv.org/ abs/2405.16134, accessed: 2024-05-30 (2024)

    2024 arXiv

  6. [13]

    J. Wei, M. Fan, W. Jiao, W. Jin, T. Liu, BDMMT: backdoor sample detection for language models through model mutation testing, IEEE Transactions on Information Forensics and Security 19 (2024) 4285– 4300

    2024

  7. [14]

    F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, M. Sun, ONION: A simple and effective defense against textual backdoor attacks, in: Proceedings of the 26th Conference on Empirical Methods in Natural Language Processing (EMNLP’26), 2021, pp. 9558–9566

    2021

  8. [15]

    Azizi, I

    A. Azizi, I. A. Tahmid, A. Waheed, N. Mangaokar, J. Pu, M. Javed, C. K. Reddy, B. Viswanath, T-miner: A generative approach to defend against trojan attacks on dnn-based text classification, in: Proceedings of the 30th USENIX Security Symposium (USENIX Security’30), 2021, pp. ...

    2021

  9. [16]

    K. Chen, Y. Meng, X. Sun, S. Guo, T. Zhang, J. Li, C. Fan, Badpre: Task-agnostic backdoor attacks to pre-trained NLP foundation models, in: Proceedings of the 10th International Conference on Learning Rep- resentations (ICLR’10), 2022, pp. 1–17

    2022

  10. [17]

    J. Park, C. Quan, H. Moon, J. Lee, Hyperdimensional computing as a rescue for efficient privacy-preserving machine learning-as-a-service, in: Proceedings of the 36th IEEE/ACM International Conference on Computer Aided Design (ICCAD’36), 2023, pp. 1–8

    2023

  11. [18]

    T. Gu, K. Liu, B. Dolan-Gavitt, S. Garg, Badnets: Evaluating backdoor- ing attacks on deep neural networks, IEEE Access 7 (2019) 47230–47244

    2019

  12. [19]

    J. Dai, C. Chen, Y. Li, A backdoor attack against lstm-based text clas- sification systems, IEEE Access 7 (2019) 138872–138878. xxxiii

    2019

  13. [20]

    F. Qi, M. Li, Y. Chen, Z. Zhang, Z. Liu, Y. Wang, M. Sun, Hidden killer: Invisible textual backdoor attacks with syntactic trigger, in: Proceed- ings of the 59th Annual Meeting of the Association for Computational Linguistics (ACL’59), 2021, pp. 443–453

    2021

  14. [21]

    C. Chen, J. Dai, Mitigating backdoor attacks in lstm-based text clas- sification systems by backdoor keyword identification, Neurocomputing 452 (2021) 253–262

    2021

  15. [22]

    Krishna, J

    K. Krishna, J. Wieting, M. Iyyer, Reformulating unsupervised style transfer as paraphrase generation, in: Proceedings of the 25st Conference on Empirical Methods in Natural Language Processing (EMNLP’25), 2020, pp. 737–762

    2020

  16. [23]

    W. Yang, Y. Lin, P. Li, J. Zhou, X. Sun, RAP: robustness-aware per- turbations for defending against backdoor attacks on NLP models, in: Proceedings of the 26th Conference on Empirical Methods in Natural Language Processing (EMNLP’26), 2021, pp. 8365–8381

    2021

  17. [24]

    G. Cui, L. Yuan, B. He, Y. Chen, Z. Liu, M. Sun, A unified evaluation of textual backdoor learning: Frameworks and benchmarks, in: Proceed- ings of the 36th Conference on Neural Information Processing Systems (NeurIPS’36), 2022, pp. 5009–5023

    2022

  18. [25]

    R. R. Tang, J. Yuan, Y. Li, Z. Liu, R. Chen, X. Hu, Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots, in: A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, S. Levine (Eds.), Proceedings of the 37th Conference on Neu- ral I...

    2023

  19. [26]

    N. S. Rajput, U. Singh, A. Dua, N. Kumar, J. J. P. C. Rodrigues, S. Sisodia, M. Elhoseny, Y. Lakys, Amalgamating vehicular networks with vehicular clouds, ai, and big data for next-generation ITS services, IEEE Transactions on Intelligent Transportation Systems 25 (1) (2024) 869–883

    2024

  20. [27]

    Branco, A

    S. Branco, A. G. Ferreira, J. Cabral, Machine learning in resource-scarce embedded systems, fpgas, and end-devices: A survey, Electronics 8 (11) (2019) 1–39. xxxiv

    2019

  21. [28]

    Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, S. Nepal, STRIP: a defence against trojan attacks on deep neural networks, in: Proceed- ings of the 35th Annual Computer Security Applications Conference (ACSAC’35), 2019, pp. 113–125

    2019

  22. [29]

    Devlin, M

    J. Devlin, M. Chang, K. Lee, K. Toutanova, BERT: pre-training of deep bidirectional transformers for language understanding, in: Proceedings of the 14th Conference of the North American Chapter of the Asso- ciation for Computational Linguistics: Human Language Technologies (NA...

    2019

  23. [30]

    P. Li, J. Huang, H. Wu, Z. Zhang, C. Qi, Securenet: Proactive intellec- tual property protection and model security defense for dnns based on backdoor learning, Neural Networks 174 (2024) 106199

    2024

  24. [31]

    B. Feng, D. Jin, X. Wang, F. Cheng, S. Guo, Backdoor attacks on unsupervised graph representation learning, Neural Networks 180 (2024) 106668

    2024

  25. [32]

    Z. Wang, Z. Wang, M. Jin, M. Du, J. Zhai, S. Ma, Data-centric nlp backdoor defense from the lens of memorization, https://arxiv.org/ abs/2409.14200, accessed: 2024-09-21 (2024)

    2024 arXiv

  26. [33]

    Jiang, X

    P. Jiang, X. Lyu, Y. Li, J. Ma, Backdoor token unlearning: Expos- ing and defending backdoors in pretrained language models, https: //arxiv.org/abs/2501.03272, accessed: 2025-01-05 (2025)

    2025 arXiv

  27. [34]

    X. Liu, M. Li, H. Wang, S. Hu, D. Ye, H. Jin, L. Wu, C. Xiao, Detecting backdoors during the inference stage based on corruption robustness consistency, in: Proceedings of the 33rd Computer Vision and Pattern Recognition (CVPR’33), 2023, pp. 16363–16372

    2023

  28. [35]

    Zhang, D

    Z. Zhang, D. Chen, H. Zhou, F. Meng, J. Zhou, X. Sun, Diffusion the- ory as a scalpel: Detecting and purifying poisonous dimensions in pre- trained language models caused by backdoor or bias, in: Proceedings of the Findings of the Association for Computational Linguistics, 202...

    2023

  29. [36]

    X. He, J. Wang, B. Rubinstein, T. Cohn, IMBERT: Making BERT immune to insertion-based backdoor attacks, in: Proceedings of the 3rd xxxv Workshop on Trustworthy Natural Language Processing (TrustNLP’3), 2023, pp. 287–301

    2023

  30. [37]

    Q. Liu, F. Wang, C. Xiao, M. Chen, From shortcuts to triggers: Back- door defense with denoised poe, in: Proceedings of the 19th Confer- ence of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies (NAACL’19), 2024, pp. 483–496

    2024

  31. [38]

    J. Li, Z. Wu, W. Ping, C. Xiao, V. G. V. Vydiswaran, Defending against insertion-based textual backdoor attacks via attribution, in: Proceed- ings of the Findings of the Association for Computational Linguistics, 2023, pp. 8818–8833

    2023

  32. [39]

    Z. Xi, T. Du, C. Li, R. Pang, S. Ji, J. Chen, F. Ma, T. Wang, Defend- ing pre-trained language models as few-shot learners against backdoor attacks, in: Proceedings of the 37th Conference on Neural Information Processing Systems (NeurIPS’37), 2023, p. 32748–32764

    2023

  33. [40]

    J. Li, Z. Li, H. Zhang, G. Li, Z. Jin, X. Hu, X. Xia, Poison attack and poison detection on deep source code processing models, ACM Transac- tions on Software Engineering and Methodology 33 (3) (2024) 1–31

    2024

  34. [41]

    Yelp, Yelp dataset, https://www.yelp.com/dataset, accessed: 2019- 09-10. (2019)

    2019

  35. [42]

    Radford, J

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever, et al., Language models are unsupervised multitask learners, https: //openai.com/research/better-language-models , accessed: 2019- 02-14 (2019)

    2019

  36. [43]

    Dyrmishi, S

    S. Dyrmishi, S. Ghamizi, M. Cordy, How do humans perceive adversarial text? A reality check on the validity and naturalness of word-based adversarial attacks, in: Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (ACL’61), 2023, pp. 8822– 8836

    2023

  37. [45]

    Gupta, C

    A. Gupta, C. W. Blum, T. Choji, Y. Fei, S. Shah, A. Vempala, V. Sriku- mar, Don’t retrain, just rewrite: Countering adversarial perturbations by rewriting text, in: Proceedings of the 61st Conference of the Associ- ation for Computational Linguistics, 2023, pp. 13981–13998

    2023

  38. [46]

    M. Hutchinson, A stochastic estimator of the trace of the influence ma- trix for laplacian smoothing splines, Communications in Statistics - Sim- ulation and Computation 19 (2) (1990) 433–450

    1990

  39. [47]

    Zampieri, S

    M. Zampieri, S. Malmasi, P. Nakov, S. Rosenthal, N. Farra, R. Kumar, Predicting the type and target of offensive posts in social media, in: Proceedings of the 14th Conference of the North American Chapter of the Association for Computational Linguistics (NAACL’14), 2019, pp. 1415–1420

    2019

  40. [48]

    Patwa, S

    P. Patwa, S. Sharma, S. PYKL, V. Guptha, G. Kumari, M. S. Akhtar, A. Ekbal, A. Das, T. Chakraborty, Fighting an infodemic: COVID-19 fake news dataset, in: Proceedings of the 35th AAAI Conference on Artificial Intelligence (AAAI’35), 2021, pp. 21–29

    2021

  41. [49]

    Gehrmann, H

    S. Gehrmann, H. Strobelt, A. M. Rush, GLTR: statistical detection and visualization of generated text, in: Proceedings of the 57th Conference of the Association for Computational Linguistics (ACL’57), 2019, pp. 111–116

    2019

  42. [50]

    Ippolito, D

    D. Ippolito, D. Duckworth, C. Callison-Burch, D. Eck, Automatic detec- tion of generated text is easiest when humans are fooled, in: Proceedings of the 58th Annual Meeting of the Association for Computational Lin- guistics (ACL’58), 2020, pp. 1808–1822

    2020

  43. [51]

    Solaiman, M

    I. Solaiman, M. Brundage, J. Clark, A. Askell, A. Herbert-Voss, J. Wu, A. Radford, J. Wang, Release strategies and the social impacts of lan- guage models, http://arxiv.org/abs/1908.09203, accessed: 2019-11- 13 (2019)

    1908 arXiv

  44. [52]

    J. X. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, Y. Qi, Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in NLP, in: Proceedings of the 25th Conference on Empirical Methods in Natural Language Processing (EMNLP’25), 2020, pp....

    2020

  45. [53]

    J. Li, S. Ji, T. Du, B. Li, T. Wang, Textbugger: Generating adversarial text against real-world applications, in: Proceedings of the 26th Annual Network and Distributed System Security Symposium (NDSS’26), 2019, pp. 1–15

    2019

  46. [54]

    D. Jin, Z. Jin, J. T. Zhou, P. Szolovits, Is BERT really robust? A strong baseline for natural language attack on text classification and entailment, in: Proceedings of the 34th AAAI Conference on Artificial Intelligence (AAAI’34), 2020, pp. 8018–8025

    2020

  47. [55]

    Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, V. Stoyanov, Roberta: A robustly optimized BERT pretraining approach, http://arxiv.org/abs/1907.11692, accessed: 2019-07-26 (2019)

    1907 arXiv

  48. [56]

    Jiang, Z

    F. Jiang, Z. Xu, L. Niu, Z. Xiang, B. Ramasubramanian, B. Li, R. Poovendran, ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs, in: Proceedings of the 62nd Annual Meeting of the Asso- ciation for Computational Linguistics (ACL’62), 2024, pp. 15157–15173

    2024

  49. [57]

    Zhang, X

    M. Zhang, X. Pan, M. Yang, Jade: A linguistics-based safety evalua- tion platform for llm, https://arxiv.org/abs/2311.00286, accessed: 2023-12-10 (2023)

    2023 arXiv

  50. [58]

    Xiang, F

    Z. Xiang, F. Jiang, Z. Xiong, B. Ramasubramanian, R. Poovendran, B. Li, Badchain: Backdoor chain-of-thought prompting for large lan- guage models, in: Proceedings of the 12th International Conference on Learning Representations (ICLR’12), 2024, pp. 1–28

    2024

  51. [59]

    Y. Li, T. Li, K. Chen, J. Zhang, S. Liu, W. Wang, T. Zhang, Y. Liu, Badedit: Backdooring large language models by model editing, in: Pro- ceedings of the 12th International Conference on Learning Representa- tions (ICLR’12), 2024, pp. 1–19

    2024

  52. [60]

    Huang, Z

    H. Huang, Z. Zhao, M. Backes, Y. Shen, Y. Zhang, Composite backdoor attacks against large language models, in: Findings of the 17th Confer- ence of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies (NAACL’17), 2024, pp. ...

    2024

  53. [61]

    J. Yan, V. Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V. Srinivasan, X. Ren, H. Jin, Backdooring instruction-tuned large language models with virtual prompt injection, in: Proceedings of the 17th Conference of the North American Chapter of the Association for Computational Lin- ...

    2024

  54. [62]

    Hubinger, C

    E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. Mac- Diarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, A. S. Jermyn, A. Askell, A. Radhakrishnan, C. Anil, D. Duvenaud, D. Gan- guli, F. Barez, J. Clark, K. Ndousse, K. Sachan, M. Sellitto, M. Sharma, N. DasSarma, ...

    2024 arXiv

  55. [63]

    Y. Li, H. Huang, Y. Zhao, X. Ma, J. Sun, Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models, https:// arxiv.org/abs/2408.12798, accessed: 2025-05-19 (2025)

    2025 arXiv

  56. [64]

    B. Peng, C. Li, P. He, M. Galley, J. Gao, Instruction tuning with GPT-4, https://doi.org/10.48550/arXiv.2304.03277, accessed: 2023-04-06 (2023)

    2023 doi arXiv

  57. [65]

    Y. Li, X. Ma, J. He, H. Huang, Y. Jiang, Shortcuts everywhere and nowhere: Exploring multi-trigger backdoor attacks, https://arxiv. org/abs/2401.15295, accessed: 2024-11-28 (2024)

    2024

  58. [66]

    T. Dao, D. Y. Fu, S. Ermon, A. Rudra, C. R´ e, Flashattention: Fast and memory-efficient exact attention with io-awareness, in: Proceed- ings of the 36th Conference on Neural Information Processing Systems (NeurIPS’36), MIT Press, 2022, pp. 1–34. xxxix

    2022

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.