ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks

Aishan Liu; Dacheng Tao; Siyuan Liang; Zhiyao Ren

REVIEW 3 major objections 5 minor 12 references

ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that ICL backdoor attacks are governed by the ratio of the model's belief in the real task versus the planted attack, and that clean demonstrations reduce average attack success by 29.14 percentage points.

desk verdict The defense seems to work in their experiments, but the central theorem motivating it has a sign error. read the letter →

arxiv 2507.01321 v1 pith:LAELDUND submitted 2025-07-02 cs.LG cs.AIcs.CR

Zhiyao Ren , Siyuan Liang , Aishan Liu , Dacheng Tao This is my paper · ORCID

classification cs.LGcs.AIcs.CR

keywords in-contextlearningbackdoorattacksdual-learninghypothesisconceptpreferenceratiolatentpromptpoisoninglargelanguagemodelsinference-timedefense

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish a law for in-context learning backdoor attacks: when a poisoned demonstration teaches a model both the real task and a hidden trigger–target association, the model's output is a mixture of two latent concepts, and whether the attack lands is governed by the ratio of how strongly each concept is believed. From this dual-learning hypothesis the authors derive an upper bound on attack success probability that depends only on this concept preference ratio, and they show the ratio can be raised at inference time simply by adding clean examples. That yields ICLShield, a defense that selects clean examples with high confidence in the correct output and high semantic similarity to the poisoned demonstration, and the authors report an average attack-success reduction of 29.14 percentage points across eleven open-source LLMs and two closed models, roughly ten times the reduction of the ONION and Back-Translation baselines. If the account is right, backdoor susceptibility in in-context learning becomes a measurable, controllable quantity rather than an unexplained failure, and defending no longer requires detecting or removing the trigger.

What carries the argument

The central object is the concept preference ratio $r = P_M(\theta_1|S_t)/P_M(\theta_2|S_t)$, the relative posterior strength of the task latent concept versus the attack latent concept given the poisoned demonstration, carried by the dual-learning hypothesis (Assumption 4.2) that writes the output distribution as a two-term mixture over the two concepts. Theorem 4.6 converts this ratio into an upper bound on attack success probability, $1/(r+1)$, using Jensen's inequality and the conclusion that test inputs are independent of the demonstration, so the bound depends only on the demonstration itself. Theorem 4.8 factors $r$ into a task prior times a poisoned impact factor raised to the number of poisoned examples $m$ times a clean impact factor raised to the number of clean examples $n$, pinning down the single controllable knob. ICLShield is the operational mechanism that turns that knob, appending $k$ clean examples selected half by model confidence in the correct output and half by cosine similarity between the example embedding and the poisoned demonstration embedding.

What would settle it

Using concept-isolating instructions as the paper's appendix does, estimate $r = P_M(\theta_1|S_t)/P_M(\theta_2|S_t)$ for a poisoned demonstration, then measure the normalized attack success probability $\tilde{P}_M(y_t|S_t,\hat{x})$ as clean examples are added one at a time; the theory predicts the curve $1/(r+1)$. If the empirical points deviate systematically from this curve, as expected on small models whose conditional distributions are not saturated, then Assumption 4.5 or the independence assumption fails and the ratio is not the governing law claimed.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is the dual-learning hypothesis: a model given a poisoned demonstration simultaneously learns a task latent concept $\theta_1$ and an attack latent concept $\theta_2$, and the output probability decomposes as $P_M(y|S_t,x) = P_M(y|x,\theta_1)P_M(\theta_1|S_t,x) + P_M(y|x,\theta_2)P_M(\theta_2|S_t,x)$. Assuming a successful attack saturates the conditional distributions, with probability 1 on the ground-truth output under $\theta_1$ and on the attack target under $\theta_2$ (Assumption 4.5), the normalized attack success probability collapses to $1/(r+1)$, where $r = P_M(\theta_1|S_t)/P_M(\theta_2|S_t)$ is the concept preference ratio. Theorem 4.6 bounds the attack success probability by this expression with the test input removed, and Theorem 4.8 factors $r$ into a task prior, a poisoned impact factor, and a clean impact factor, exposing the clean factor as the only component a defender can adjust at inference time. The authors present ICLShield as the first defense targeted at ICL backdoor attacks and report that appending clean demonstrations chosen by confidence and similarity cuts the average attack success rate by 29.14 percentage points, outperforming the ONION and Back-Translation baselines by roughly 26 points.

Load-bearing premise

The load-bearing premise is that a successful attack saturates the model's conditional distributions, with probability 1 on the correct answer under the task concept and probability 1 on the attack target under the attack concept, so that attack success reduces exactly to the ratio of two posterior beliefs, and the two posteriors are assumed independent even though they describe the same demonstration.

Editorial extensions

If this is right

A defender no longer needs to detect or remove the trigger: raising the concept preference ratio lowers the attack bound, which is why ICLShield works against phrase triggers and on closed models where the trigger is unknown.
The benefit of added clean examples has diminishing returns; the ablation indicates that roughly six defensive examples balance attack-success reduction against input length.
The same ratio governs classification, generation, and chain-of-thought reasoning attacks, so a single mechanism accounts for backdoor success under both ICLAttack and BadChain across task families.
Defensive demonstrations selected on open models transfer to closed ones: on AG's News, ICLShield reduced GPT-3.5 and GPT-4o attack success by an average of 84.85% without access to output probabilities or embeddings.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

I read the concept preference ratio as a defense metric the paper does not directly exploit: one could compute $r$ with and without candidate clean examples and predict the attack-success drop from $1/(r+1)$, letting defenders size their demonstration budget by measurement rather than by experiment.
The bound is symmetric in spirit, so the same quantity likely governs an attack–defense race: an attacker who adds more poisoned examples or more salient triggers lowers $r$ and raises the bound, a dynamic the paper does not explore.
Because the saturation assumption is most doubtful on small or poorly calibrated models, a testable extension is whether the observed attack-success reduction tracks model scale, which would mark where the theorem's regime ends.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The empirical core of this paper is stronger than the theory that frames it. Adding a few clean demonstrations chosen by confidence and cosine similarity to a poisoned ICL prompt reduces attack success substantially across a wide range of open and closed models. That is a useful, practical finding. The paper is less convincing when it claims a theorem shows why.

The proof of Theorem 4.6 does not go through. The paper defines R = P(θ1|St,x̂)/P(θ2|St,x̂) and derives E[R] ≥ R0 from Jensen. Then it asserts ASR ≤ 1/(R0+1). But 1/(r+1) is convex and decreasing, so Jensen gives E[1/(R+1)] ≥ 1/(E[R]+1), not ≤. A lower bound on E[R] does not yield an upper bound on expected ASR. The stress-test note's counter-distribution is correct. If the claim is meant pointwise, the proof needs to establish R ≥ R0, and it does not. The independence assumption used in Eq. 18 is also hard to swallow: with two latent concepts, the numerator and denominator sum to one, so they are perfectly negatively dependent. And Assumption 4.5, which sets conditional probabilities to 1, is unverified for actual models. These are not cosmetic issues: the theorem is the stated reason the design works.

There are also missing baselines. The paper cites Mo et al. 2023 and Wei et al. 2023, both of which use defensive demonstrations at inference time. The authors say those methods are not designed for ICL backdoors, but they do not run them as baselines. Without that comparison, the "+26% over ONION and Back-Translation" claim is too narrow. I would also like code and error bars; the tables show aggregate numbers only.

What does the paper do well? The selection scheme is simple and intuitive, the experiments cover many models, and the closed-source transfer story is plausible. The empirical pattern is consistent across settings. There is a real contribution in showing that adding clean examples with high confidence and high similarity to the poisoned prompt is an effective and cheap defense.

Who should read it? Researchers working on backdoor defenses for LLM APIs or agents. It is a conditional accept, not a rejection: the empirical claim deserves referee time, but the theorem needs to be repaired or removed, and the comparison set needs to be expanded. I would send it to peer review with a clear request to fix the theory and add the missing baselines.

Referee Report

3 major / 5 minor

Summary. The paper proposes the dual-learning hypothesis, which states that LLMs jointly learn a task latent concept and an attack latent concept from poisoned ICL demonstrations. It claims to derive an upper bound on the attack success probability in Theorem 4.6, expressed as 1/(PM(θ1|St)/PM(θ2|St)+1), and argues that this bound is dominated by the concept preference ratio. Based on this analysis, the paper introduces ICLShield, a defense that adds clean demonstrations selected by confidence and similarity scores to the poisoned demonstration. The empirical evaluation spans 11 open-source LLMs and two closed-source models across classification, generation, and reasoning tasks, reporting an average ASR reduction of 29.14 percentage points and a 26.02% average improvement over ONION and Back-Translation.

Significance. The empirical study is broad and the reported ASR reductions are substantial; the paper also provides ablations for selection strategies and the number of defensive examples, plus transfer experiments to closed-source models. If the theoretical upper bound were valid, it would offer an actionable mechanistic explanation for ICL backdoor attacks and a principled motivation for the defense. However, the derivation of Theorem 4.6 contains a load-bearing mathematical error, and the independence and saturation assumptions are not justified for real LLMs. The significance of the paper is therefore conditional on repairing or substantially re-framing the theoretical core; the empirical defense results alone are still useful but do not by themselves establish the claimed mechanism.

major comments (3)

[Section 4.2, Appendix C, Eqs. (20)-(21)] The proof of Theorem 4.6 establishes only E[R(x)] ≥ R0, where R(x) = PM(θ1|St,x̂)/PM(θ2|St,x̂) and R0 = PM(θ1|St)/PM(θ2|St). Since h(r) = 1/(r+1) is convex and decreasing, Jensen's inequality gives E[h(R)] ≥ h(E[R]), not an upper bound, and a lower bound on E[R] cannot be converted into an upper bound on E[h(R)]. Concretely, if R = 0.01 with probability 1/2 and R = 10 with probability 1/2, then E[R] = 5.005 ≥ 1 but E[h(R)] ≈ 0.540 > 0.5 = h(1), violating the claimed inequality for R0 = 1. If the theorem is meant pointwise, the derivation would need to show R(x) ≥ R0 for each x, which Eq. (20) does not provide. As written, Theorem 4.6 is false, and since this theorem is the stated basis for the defense design, the central theoretical claim is not established.
[Theorem 4.6 and Eq. (18)] The theorem assumes PM(θ1|St,x̂) and PM(θ2|St,x̂) are independent. In the dual-learning model these are the posterior probabilities of the only two latent concepts; if they are normalized probabilities, then PM(θ1|St,x̂) + PM(θ2|St,x̂) = 1, so the two quantities are perfectly negatively dependent. The independence assumption is therefore incompatible with the model, and the factorization in Eq. (18) cannot be justified. The proof would need to avoid this assumption or argue that the dependence is negligible, which the manuscript does not do.
[Assumption 4.5 and Eq. (8)] Assumption 4.5 sets PM(ygt|x̂,θ1) = 1 and PM(yt|x̂,θ2) = 1. This saturation is an idealization: for real LLMs these conditional probabilities are generally not exactly 1, and the manuscript provides no measurements or sensitivity analysis. Without saturation, Eq. (8) contains additional terms involving PM(ygt|x̂,θ2) and PM(yt|x̂,θ1), and the claimed upper bound does not follow. The paper should either verify this assumption empirically, e.g., by probing the conditional distributions with instruction-based concept activations, or explicitly restrict the scope of the theoretical result to the saturated idealization.

minor comments (5)

[Section 1, first paragraph of the contribution discussion] The text says backdoor effects can be mitigated by 'controlling and further reducing the concept preference ratio', while the next paragraph and the defense design aim to increase this ratio; this wording should be corrected to avoid an internal contradiction.
[Eq. (14) and Section 5.2] The confidence selection uses PM(yi|xi,St), i.e., the likelihood under the poisoned demonstration, as a proxy for the task latent concept. The text asserts that this is justified because the poisoned demonstration achieves high clean accuracy, but no argument is given for why this proxy preserves the task-latent-concept likelihood. In the presence of a strong attack target, this selection could favor examples aligned with the attack concept; the paper should clarify or provide additional evidence for this proxy.
[Appendix C, sentence before Eq. (17)] The phrase 'The posterior distribution ratio exception of the user input' should read 'expectation' rather than 'exception', and the notation E_x̂ should be defined explicitly.
[Figure 4 caption and Table 5 header] Figure 4(a) contains the typo 'ranodm selection' instead of 'random selection', and Table 5's header 'AG’ SNEWS' should be 'AG's News'.
[Tables 1-5] No error bars, standard deviations, or repeated-seed statistics are reported; given the large variance across models and tasks, reporting such statistics would substantially strengthen the empirical claims.

Circularity Check

1 steps flagged · score 5.0 of 10

The central theoretical upper bound is a restatement of the paper's own saturation assumption and posterior-ratio definition; the empirical defense evaluation is not circular.

self definitional [Section 4.2, Assumption 4.5, Eq. (8), Theorem 4.6; Appendix B Eq. (16)]
"Assumption 4.5. ... We can assume that the conditional distribution is PM(ygt | x̂, θ1) = 1, PM(yt | x̂, θ2) = 1. (7) Under these conditions, the attack success probability can be rewritten as: P̃M(yt | St, x̂) = 1 / (PM(θ1|St,x̂)/PM(θ2|St,x̂) + 1). (8) ... Theorem 4.6. ... the upper bound of the attack success probability is P̃M(yt | St, x̂) ≤ 1 / (PM(θ1|St)/PM(θ2|St) + 1). (9)"

Definition 4.4/Eq. (6) defines the attack success probability as a normalized output probability. Assumption 4.5 then sets the task and attack conditional output distributions to 1 for the relevant outputs, so in the two-concept mixture of Eq. (5) the attack success probability collapses to f(R(x)) with f(r)=1/(r+1) and R(x)=PM(θ1|St,x̂)/PM(θ2|St,x̂). Theorem 4.6's claimed 'upper bound' is the same function f applied to the marginal ratio PM(θ1|St)/PM(θ2|St). Hence the headline finding that ICL backdoor vulnerability is dominated by the concept preference ratio is a restatement of the definition plus Assumption 4.5, not a derived prediction; no quantity beyond the ratio inserted by the assumption enters the bound.

full rationale

The only load-bearing theoretical result, Theorem 4.6, reduces to the paper's own construction: under Assumption 4.5 the normalized attack success probability is made identically equal to 1/(posterior ratio + 1), and the theorem's upper bound is the same expression with the per-input ratio replaced by the marginal ratio. That is a self-definitional restatement rather than an independent derivation. I do not count the Appendix C Jensen-direction error or the independence assumption as circularity, since those are derivation-validity problems. The defense contribution, ICLShield, is evaluated against ONION and Back-Translation on held-out attacks across many models, with no fitted constants and no self-citation chain, so the empirical part is self-contained and independently falsifiable. There is no load-bearing self-citation: the cited latent-variable result of Wang et al. (2024a) is external prior work. Overall, the paper's experimental defense claims are not circular, but its central theoretical 'upper bound' claim is equivalent to its assumptions by construction, yielding a partial-circularity score of 5.

Assumptions & free parameters 1 free parameters · 6 assumptions · 1 invented entities

The central theoretical claims rest on the dual-learning hypothesis (an assumption introduced in this paper), saturation of conditional distributions, independence of complementary posteriors, i.i.d. demonstrations, a borrowed conclusion from Wang et al., and an unproved clean-likelihood dominance. The only free hyperparameter is the number of defensive examples k. No new entities with independent evidence are introduced.

free parameters (1)

k (number of defensive examples) = 6 in the SST-2 ablation; not reported in main tables
The number of extra clean demonstrations is a manually chosen hyperparameter; the paper's ablation selects 6 as a balance, but the main experiments do not state k.

assumptions (6)

ad hoc to paper Dual-learning hypothesis (Assumption 4.2, Eq. 5): output probability under a poisoned demonstration decomposes as a sum of a task-latent-concept term and an attack-latent-concept term.
Introduced in this paper without independent evidence; Appendix A only shows that distributions conditioned on demonstrations resemble instructions, not that the decomposition is exact.
domain assumption Saturated conditional distributions (Assumption 4.5, Eq. 7): PM(ygt|x̂,θ1)=1 and PM(yt|x̂,θ2)=1.
Needed to derive Eq. 8 and the concept-preference-ratio bound; real LLMs rarely assign probability 1.
ad hoc to paper Independence of posteriors (Theorem 4.6): θ1 and θ2 posteriors given St and x̂ are independent.
The two posteriors are complementary if they sum to 1, so independence is implausible and is the step that makes the Jensen inequality tractable.
domain assumption i.i.d. demonstrations (Appendix E): examples in the demonstration are independent and identically distributed.
Needed to factor the posterior into a product of likelihoods in Eq. 26.
domain assumption Wang et al. conclusion (Appendix C): Ex[PM(θ|S,x)] = PM(θ|S) when x is sampled independently of S.
Borrowed from Wang et al. 2024a; used to replace the posterior ratio conditioned on x̂ with the demonstration-level ratio.
domain assumption Clean likelihood dominance (Section 5.1, observation 1): PM(ygt|x,θ1)/PM(ygt|x,θ2) ≥ 1 for clean examples.
Unproved; used to conclude that adding more clean examples increases the concept preference ratio.

invented entities (1)

Attack latent concept θ2
purpose: Explains backdoor behavior in the dual-learning hypothesis and defines the concept preference ratio denominator.
A new latent variable posited by the paper; the only supporting evidence is qualitative output-distribution plots in Appendix A, with no falsifiable prediction outside the paper's own experiments.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks." pith.science (2026). https://pith.science/paper/LAELDUND

@misc{pith2026250701321,
  author       = {Pith},
  title        = {Pith review of: ICLShield: Exploring and Mitigating In-Context Learning Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/LAELDUND}},
  note         = {Machine review of arXiv:2507.01321}
}

read the original abstract

In-context learning (ICL) has demonstrated remarkable success in large language models (LLMs) due to its adaptability and parameter-free nature. However, it also introduces a critical vulnerability to backdoor attacks, where adversaries can manipulate LLM behaviors by simply poisoning a few ICL demonstrations. In this paper, we propose, for the first time, the dual-learning hypothesis, which posits that LLMs simultaneously learn both the task-relevant latent concepts and backdoor latent concepts within poisoned demonstrations, jointly influencing the probability of model outputs. Through theoretical analysis, we derive an upper bound for ICL backdoor effects, revealing that the vulnerability is dominated by the concept preference ratio between the task and the backdoor. Motivated by these findings, we propose ICLShield, a defense mechanism that dynamically adjusts the concept preference ratio. Our method encourages LLMs to select clean demonstrations during the ICL phase by leveraging confidence and similarity scores, effectively mitigating susceptibility to backdoor attacks. Extensive experiments across multiple LLMs and tasks demonstrate that our method achieves state-of-the-art defense effectiveness, significantly outperforming existing approaches (+26.02% on average). Furthermore, our method exhibits exceptional adaptability and defensive performance even for closed-source models (e.g., GPT-4).

Figures

Figures reproduced from arXiv: 2507.01321 by the authors.

**Figure 1.** ICL backdoor attacks aim to embed backdoors into LLMs by poisoning a few ICL demonstrations such that the attackers can manipulate model behaviors when specific triggers appear. a few natural language examples. As the scale of LLMs increases, ICL has been widely applied to various tasks owing to its remarkable adaptability and parameter-free nature, such as text classification (Milios et al., 2023; Edwards & Camac… view at source ↗

**Figure 2.** Illustration of our framework. Based on our dual-learning hypothesis and theoretical analysis, we propose the ICLShiled defense that dynamically adjusts the concept preference ratio by selecting clean demonstrations with high confidence and similarity scores. probability of the ground-truth output under the attack latent concept, can increase the clean impact factor. When the clean example contain content that is si… view at source ↗

**Figure 3.** The output distribution of attack success probability on non-target label test samples of the SST-2 dataset under ICLAttack and ICLShield. that are predicted as the target label. As the setting in Li et al. (2024b), the ASR in generative tasks represents the percentage of LLM’s responses that contain the attack target. We evaluate the ASR with the trigger (ASRw/t) and without the trigger (ASRw/o). Following the sett… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: The results of ablation studies. (a) Comparing the results of ICLShield with ranodm selection, similarity selection, and confidence selection. (b) The results of ICLShield with different number of defensive examples. similarity selection, and confidence selection; and…

**Figure 5.** Figure 5: The output distribution of LLMs using poisoned demonstrations and instructions. B. More Details of Assumption 4.5 Following the objective of backdoor attack, the ICL backdoor attack is design to produce the ground-truth output ygt when condition on clean input and the …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 4 canonical work pages

[4]

The Closeness of In-Context Learning and Weight Shifting for Softmax Regression

Li, H., Chen, Y ., Zheng, Z., Hu, Q., Chan, C., Liu, H., and Song, Y . Backdoor removal for generative large language models. arXiv preprint, 2024a. Li, S., Song, Z., Xia, Y ., Yu, T., and Zhou, T. The closeness of in-context learning and weight shifting for softmax regression. arXiv preprint arXiv:2304.13276,

work page Pith review arXiv
[6]

Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning

Liang, S., Liu, K., Gong, J., Liang, J., Xun, Y ., Chang, E.-C., and Cao, X. Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning. arXiv preprint arXiv:2403.16257, 2024b. Liang, S., Liang, J., Pang, T., Du, C., Liu, A., Zhu, M., Cao, X., and Tao, D. Revisiting backdoor attacks against large ...

arXiv
[7]

Pre-trained trojan attacks for visual recognition

Liu, A., Zhang, X., Xiao, Y ., Zhou, Y ., Liang, S., Wang, J., Liu, X., Cao, X., and Tao, D. Pre-trained trojan attacks for visual recognition. arXiv preprint arXiv:2312.15172, 2023a. Liu, A., Zhou, Y ., Liu, X., Zhang, T., Liang, S., Wang, J., Pu, Y ., Li, T., Zhang, J., Zhou, W., et al. Compromising embodied agents with contextual backdoor attacks. arXi...

arXiv
[8]

D., Ng, A

Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A. Y ., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing,

work page 2013
[9]

V on Oswald, J., Niklasson, E., Randazzo, E., Sacramento, J., Mordvintsev, A., Zhmoginov, A., and Vladymyrov, M

URL https: //doi.org/10.48550/arXiv.2307.09288. V on Oswald, J., Niklasson, E., Randazzo, E., Sacramento, J., Mordvintsev, A., Zhmoginov, A., and Vladymyrov, M. Transformers learn in-context by gradient descent. In International Conference on Machine Learning,

arXiv doi:10.48550/arxiv.2307.09288
[10]

Wang, X., Zhu, W., Saxon, M., Steyvers, M., and Wang, W. Y . Large language models are latent variable mod- els: Explaining and finding good demonstrations for in- context learning. In Advances in Neural Information Processing Systems, 2024a. Wang, Y ., Shi, H., Min, R., Wu, R., Liang, S., Wu, Y ., Liang, D., and Liu, A. Universal backdoor attacks de- tec...

arXiv
[11]

Backdooring instruction- tuned large language models with virtual prompt injec- tion

Yan, J., Yadav, V ., Li, S., Chen, L., Tang, Z., Wang, H., Srini- vasan, V ., Ren, X., and Jin, H. Backdooring instruction- tuned large language models with virtual prompt injec- tion. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers),

work page 2024
[2015]

To- wards robust physical-world backdoor attacks on lane detection

Zhang, X., Liu, A., Zhang, T., Liang, S., and Liu, X. To- wards robust physical-world backdoor attacks on lane detection. arXiv preprint arXiv:2405.05553,

arXiv

Show all 12 references

[2021]

If you use this software, please cite it using these metadata

URL https: //doi.org/10.5281/zenodo.5297715. If you use this software, please cite it using these metadata. Black, S., Biderman, S., Hallahan, E., Anthony, Q., Gao, L., Golding, L., He, H., Leahy, C., McDonell, K., Phang, J., et al. Gpt-neox-20b: An open-source autoregressive ...

arXiv
[2022]

A survey on in- context learning

Dong, Q., Li, L., Dai, D., Zheng, C., Ma, J., Li, R., Xia, H., Xu, J., Wu, Z., Chang, B., et al. A survey on in- context learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,

2024
[2023]

Anti- backdoor learning: Training clean models on poisoned data

Li, Y ., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Anti- backdoor learning: Training clean models on poisoned data. In Advances in Neural Information Processing Systems, 2021a. Li, Y ., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Neural attention distillation: Erasin...

arXiv
[2024]

Adversarial backdoor defense in clip

Kuang, J., Liang, S., Liang, J., Liu, K., and Cao, X. Adversarial backdoor defense in clip. arXiv preprint arXiv:2409.15968,

arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [4]

The Closeness of In-Context Learning and Weight Shifting for Softmax Regression

Li, H., Chen, Y ., Zheng, Z., Hu, Q., Chan, C., Liu, H., and Song, Y . Backdoor removal for generative large language models. arXiv preprint, 2024a. Li, S., Song, Z., Xia, Y ., Yu, T., and Zhou, T. The closeness of in-context learning and weight shifting for softmax regression. arXiv preprint arXiv:2304.13276,

work page Pith review arXiv

[2] [6]

Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning

Liang, S., Liu, K., Gong, J., Liang, J., Xun, Y ., Chang, E.-C., and Cao, X. Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning. arXiv preprint arXiv:2403.16257, 2024b. Liang, S., Liang, J., Pang, T., Du, C., Liu, A., Zhu, M., Cao, X., and Tao, D. Revisiting backdoor attacks against large ...

arXiv

[3] [7]

Pre-trained trojan attacks for visual recognition

Liu, A., Zhang, X., Xiao, Y ., Zhou, Y ., Liang, S., Wang, J., Liu, X., Cao, X., and Tao, D. Pre-trained trojan attacks for visual recognition. arXiv preprint arXiv:2312.15172, 2023a. Liu, A., Zhou, Y ., Liu, X., Zhang, T., Liang, S., Wang, J., Pu, Y ., Li, T., Zhang, J., Zhou, W., et al. Compromising embodied agents with contextual backdoor attacks. arXi...

arXiv

[4] [8]

D., Ng, A

Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A. Y ., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing,

work page 2013

[5] [9]

V on Oswald, J., Niklasson, E., Randazzo, E., Sacramento, J., Mordvintsev, A., Zhmoginov, A., and Vladymyrov, M

URL https: //doi.org/10.48550/arXiv.2307.09288. V on Oswald, J., Niklasson, E., Randazzo, E., Sacramento, J., Mordvintsev, A., Zhmoginov, A., and Vladymyrov, M. Transformers learn in-context by gradient descent. In International Conference on Machine Learning,

arXiv doi:10.48550/arxiv.2307.09288

[6] [10]

Wang, X., Zhu, W., Saxon, M., Steyvers, M., and Wang, W. Y . Large language models are latent variable mod- els: Explaining and finding good demonstrations for in- context learning. In Advances in Neural Information Processing Systems, 2024a. Wang, Y ., Shi, H., Min, R., Wu, R., Liang, S., Wu, Y ., Liang, D., and Liu, A. Universal backdoor attacks de- tec...

arXiv

[7] [11]

Backdooring instruction- tuned large language models with virtual prompt injec- tion

Yan, J., Yadav, V ., Li, S., Chen, L., Tang, Z., Wang, H., Srini- vasan, V ., Ren, X., and Jin, H. Backdooring instruction- tuned large language models with virtual prompt injec- tion. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers),

work page 2024

[8] [2015]

To- wards robust physical-world backdoor attacks on lane detection

Zhang, X., Liu, A., Zhang, T., Liang, S., and Liu, X. To- wards robust physical-world backdoor attacks on lane detection. arXiv preprint arXiv:2405.05553,

arXiv