Pith. sign in

REVIEW 3 major objections 4 minor 39 references

Invisible Textual Backdoor Attacks based on Dual-Trigger

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Combining a rare sentence structure with subjunctive mood lets a backdoor hit near-100% attack success on language models while staying invisible.

desk verdict Dual-trigger backdoor idea is new and worth exploring, but the key comparison is confounded by a generator switch and the independent-trigger test is likely contaminated, so the central claims need an ablation before they can be trusted. read the letter →

arxiv 2412.17531 v3 pith:OCPINZFW submitted 2024-12-23 cs.CR cs.AI

Yang Hou , Qiuling Yue , Lujia Chai , Guozhao Liao , Wenbao Han , Wei Ou This is my paper · ORCID
classification cs.CRcs.AI
keywords textualbackdoorattackdual-triggerabstracttextfeaturessyntactictriggersubjunctivemoodpoisoneddatasetgenerationdefenselargelanguagemodels
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a textual backdoor in a large language model can be made both more effective and more covert by arming it with two independent grammar-based triggers instead of one. The proposed dual trigger combines a rare sentence template, the constituency parse structure S(SBAR)(,)(NP)(VP)(.), with the subjunctive mood, so that a poisoned model reacts to either feature alone. On three text-classification tasks and three instruction-tuned LLMs, the authors report attack success rates near 100 percent, clearly above a syntax-only baseline and comparable to insertion-based attacks, with clean accuracy nearly unchanged. They also report that the poisoned text scores better on automated quality checks, and that the attack loses far less effectiveness under word-removal and sentence-paraphrasing defenses than the baselines. If these results hold, trigger multiplicity is a viable route to backdoors that are both invisible and resilient.

What carries the argument

The carrying object is the dual trigger: a layered combination of a low-frequency constituency parse template, S(SBAR)(,)(NP)(VP)(.), and the subjunctive mood, with a fine-tuned LLM as the poison-data generator. The template provides a rare structural marker the model seldom encounters in clean text, while the subjunctive provides a semantic-grammatical marker that slots naturally into that template, keeping the sentence fluent. The generator is equally load-bearing: the paper argues that only a meaning-preserving, grammatically fluent generator can make abstract dual triggers work at scale, and it supports that claim by measuring poisoned-data quality through semantic similarity, perplexity, and grammar-error counts. Together the two trigger layers are meant to make the backdoor activatable by either feature independently, which is what the authors credit for the attack's flexibility and resilience.

What would settle it

Re-run the dual-trigger pipeline with a syntax-only condition generated by the same fine-tuned LLM, i.e., sentences following S(SBAR)(,)(NP)(VP)(.) without subjunctive mood, on the same datasets and victim models. If the syntax-only LLM condition matches the dual-trigger attack success rate, the claim that the mood layer is responsible for the improvement is falsified; if it falls short, the claim is supported.

Watch

Extended reading notes

Core claim

The paper's central claim is that two grammatical abstractions can be stacked into one trigger mechanism, like a double landmine: the victim model learns to associate either the rare syntactic template or the subjunctive mood with the attacker's target label, and at inference time either trigger activates the backdoor. The syntax template is chosen because it is one of the least frequent common parse structures, making it distinctive; the subjunctive mood is chosen because its clause patterns fit naturally inside that template, so rewriting a sentence into subjunctive form preserves fluency and meaning. To produce such sentences at scale, the authors replace a generic paraphrase generator with a fine-tuned LLM that rewrites clean samples into subjunctive-mood versions of the template, and they report that this poisoned data has lower perplexity, fewer grammatical errors, and higher semantic similarity to the originals than existing methods. The experiments are presented as evidence that the dual-trigger model reaches near-perfect attack success while keeping clean accuracy close to the benign model, and that it survives word-removal and sentence-level defenses better than its single-trigger counterparts.

Load-bearing premise

The paper attributes the attack's gain over syntax-only attacks to the newly added mood trigger, but the two conditions also use different poison-data generators, so that causal attribution has not been isolated.

Editorial extensions

If this is right

  • A backdoor can be built so that either of two unrelated linguistic features triggers it; removing or paraphrasing one trigger no longer disables the attack.
  • Abstract-feature backdoors can close the attack-success gap with insertion-based methods, reaching near-100% ASR without inserting any detectable token.
  • Poisoned-data quality can be quantified and compared through perplexity, grammar-error counts, and semantic similarity, and a fine-tuned LLM generator can dominate an older paraphrase-network generator on those metrics.
  • Word-removal defenses that hunt for rare inserted tokens will degrade insertion attacks far more than this dual-trigger attack.
  • A small set of hand-crafted sentence-transformation examples is enough to fine-tune a generator that mass-produces poisoned samples for a new task.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An untested extension is whether the mood layer alone, without the syntax template, would already produce high attack success; the paper only evaluates the mood layer as one half of the combined trigger.
  • Because the syntax-only comparison is generated by a different, older generator, the reported gap may partly reflect generator quality rather than the second trigger; a same-generator syntax-only arm would settle this.
  • The claimed resilience to word-removal defenses likely holds because the attack has no rare token to delete; a defense that models mood statistics rather than rare words could target the second layer and is not tested here.
  • If the mechanism generalizes, other grammatical pairs (e.g., voice combined with a rare tense, or negation combined with passive structure) should yield similar dual-trigger backdoors; the paper demonstrates only syntax-plus-subjunctive.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a dual-trigger invisible textual backdoor attack for large language models, combining the syntactic template S(SBAR)(,)(NP)(VP)(.) with subjunctive mood as two independent abstract triggers. Poisoned data are generated by a LoRA-fine-tuned Qwen2-72B-Chat model rather than by the SCPN network used in prior syntactic attacks. The authors evaluate on SST-2, OLID, and AG's News, attacking Qwen2-72B-Instruct, Llama3-8B-Instruct, and Llama3.2-3B-Instruct, and compare with BadNet, InsertSent, and a syntactic baseline. They report near-100% ASR, high clean accuracy, better robustness than baselines under three defenses, and higher-quality poisoned data in terms of perplexity, grammar, and semantic similarity, and they claim the two trigger layers can be activated independently.

Significance. If the central comparative claim were established, the idea of combining two abstract linguistic features as independently activatable backdoor triggers would be a useful contribution to the textual-backdoor literature, and the customized-LLM data-generation pipeline is a practical engineering contribution. The paper's strengths include the use of public datasets and victim models, a multi-metric poisoned-data quality evaluation, evaluation against several defense strategies, and the public release of code and data on GitHub. However, the headline comparison between the dual-trigger method and the syntactic baseline is currently confounded, and the evidence for independent activation of the mood trigger is incomplete; both issues are fixable with additional experiments. For this reason the paper needs major revision before the central claims can be accepted.

major comments (3)
  1. [Section 3.2.3, Section 4.2 (Table 4)] The claim that 'the dual-trigger attack method using dual triggers significantly outperforms the syntax-based method' is confounded by a simultaneous change in the poisoned-data generator. The Syntactic baseline is generated with SCPN, while Dual-Trigger uses a LoRA-fine-tuned Qwen2-72B-Chat model. Table 6 shows that the SCPN-generated syntax-poisoned data are of much lower quality (SSA 0.049-0.168, GEN 1541-1844) than the customized-LLM data (SSA 0.744-0.895, GEN 89-1079). The ASR improvement in Table 4 could therefore be caused by the generator upgrade alone, and the contribution of the second trigger (subjunctive mood) is not isolated. Please add a syntax-only condition generated with the same customized LLM, or a dual-trigger condition generated with SCPN, and report the ASR/CACC for those conditions.
  2. [Section 4.3 (Table 5)] The 'subjunctive-only' test does not establish that the two triggers can be activated independently. The subjunctive-only test samples are produced by the same customized LLM, which was fine-tuned on dual-trigger input-output pairs, and no parse-tree or rule-based check is reported to confirm that the S(SBAR)(,)(NP)(VP)(.) syntactic template is absent. Since all examples in Table 9 begin with an 'If/Were/Suppose' conditional clause, they already realize the S(SBAR)(,)(NP)(VP)(.) structure, so the subjunctive-only set likely still contains the first-layer trigger. Please provide a parse audit of the subjunctive-only test set and, ideally, a human-verified subset that contains subjunctive mood without the target syntactic template.
  3. [Section 4.2 (Table 4)] The claim that Dual-Trigger 'significantly outperforms' Syntactic is not supported by all reported cells. For example, on OLID with Llama3.2-3B-It, Syntactic achieves ASR 99.52 while Dual-Trigger achieves 96.51, and on AG's News both methods are at or near 99.9-100. The caption mentions bold and underlined formatting for significance, but the table does not show such formatting, and no significance tests, variances, or confidence intervals are reported. Please clarify the exact comparison statistic and provide significance testing or error bars over multiple runs.
minor comments (4)
  1. [Table 8] In the Back-translation Paraphrasing block, the BadNet entry '56.67(43.33)' appears to be missing a minus sign; it should read 56.67(-43.33) to match the other entries.
  2. [Section 4.1.5] The sentence 'for the AG's News dataset, the optimal poisoning rates of the three models are determined to be 5%, 10%, and 10%, respectively' is ambiguous about which rates correspond to which of the three victim models. Please specify the mapping or present the rates in a table.
  3. [Section 3.2.3] The description of the customized LLM omits several implementation details needed for reproducibility, such as the LoRA rank, alpha, and target modules, the prompt/instruction template used for transformation, and the exact generation parameters (temperature, top-p, etc.). Please include these in an appendix or supplementary material.
  4. [Section 1] The introduction states that 'all the known textual backdoor attack methods use a single-trigger as their trigger mechanism'; this is a strong claim and should be softened or supported with a more systematic citation of recent multi-trigger or multi-style attacks, if any exist.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack results are measured against external baselines; the main weaknesses are experimental confounds, not derivation-by-construction.

full rationale

The paper's central claims are empirical: dual-trigger achieves high ASR/CACC on public datasets and beats external baselines. No parameter is fitted and then renamed a prediction; no uniqueness theorem is imported from the authors' own prior work; and the syntactic template S(SBAR)(,)(NP)(VP)(.) is adopted with attribution from Qi et al., which is external prior work rather than a self-citation. The two notable weaknesses are confounds rather than circularities. First, the syntax-only baseline uses SCPN while the dual-trigger method uses a LoRA-tuned Qwen model (Sec. 3.2.3, Table 1), so the ASR gain in Table 4 may be due to the generator change rather than the mood trigger. Second, the subjunctive-only test in Sec. 4.3 is generated by the same customized LLM trained on dual-trigger input-output pairs, and no parse check is reported to exclude the syntax template; hence Table 5 does not cleanly establish independent activation of the second trigger. These are internal-validity problems in the experimental design, not instances where a result equals its input by construction. Because the scoring rubric is specifically about circularity (self-definition, fit-renamed-as-prediction, load-bearing self-citation), the appropriate score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on standard backdoor assumptions plus two trigger-design choices borrowed or asserted rather than independently verified. The main free parameters are the poisoning rate and the size and composition of the 500-sample generator training set. No new physical or mathematical entities are introduced.

free parameters (3)
  • poisoning rate alpha = SST-2: 30%, OLID: 20%, AG News: 5%/10%/10% per model
    Section 3.2.4 states optimal poisoning rates are determined for each dataset and model. These rates are tuned to maximize ASR while preserving CACC, so the near-100% ASR is partly a fitted outcome.
  • customized LLM training sample count = 500
    Section 3.2.3 says 500 high-quality samples are chosen by the authors to fine-tune the generator. This manual selection shapes the poisoned data distribution and is not derived from any principle.
  • learning rate and training epochs = 5e-4; 5/4/3 epochs for the three victim models
    Section 4.1.5 explains the authors chose a different learning rate from prior work based on their reproduction results and set model-specific epoch counts. These are hand-tuned hyperparameters.
assumptions (4)
  • domain assumption The attacker can poison a fraction of the fine-tuning dataset and relabel poisoned samples to target labels.
    This is the standard backdoor threat model used throughout Section 3.1. It is stated, not defended, and is a precondition for the entire method.
  • domain assumption The syntactic template S(SBAR)(,)(NP)(VP)(.) is rare in normal data and therefore a valid trigger.
    Section 3.2.1 adopts this from Qi et al. [15] based on frequency statistics. The paper does not re-measure rarity on SST-2, OLID, or AG News, nor does it verify that the template remains rare for the chosen victim LLMs.
  • ad hoc to paper Subjunctive mood is compatible with this syntax and can serve as an independent second trigger.
    Section 3.2.2 argues grammatical compatibility, but no experiment isolates mood from syntax. The subjunctive-only test does not confirm the syntax trigger is absent, so this independence is asserted rather than shown.
  • domain assumption The customized LLM-generated poisoned samples preserve the core semantics of the original samples.
    Section 3.2.3 and Table 1 claim semantic preservation, but Table 6 shows Dual-Trigger SSA scores of 0.74 to 0.90, below insertion-based baselines, and some examples appear to invert meaning. This assumption is questionable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Invisible Textual Backdoor Attacks based on Dual-Trigger." pith.science (2026). https://pith.science/paper/OCPINZFW

@misc{pith2026241217531,
  author       = {Pith},
  title        = {Pith review of: Invisible Textual Backdoor Attacks based on Dual-Trigger},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OCPINZFW}},
  note         = {Machine review of arXiv:2412.17531}
}
read the original abstract

Backdoor attacks pose an important security threat to textual large language models. Exploring textual backdoor attacks not only helps reveal the potential security risks of models, but also promotes innovation and development of defense mechanisms. Currently, most textual backdoor attack methods are based on a single trigger. For example, inserting specific content into text as a trigger or changing the abstract text features to be a trigger. However, the adoption of this single-trigger mode makes the existing backdoor attacks subject to certain limitations: either they are easily identified by the existing defense strategies, or they have certain shortcomings in attack performance and in the construction of poisoned datasets. In order to solve these issues, a dual-trigger backdoor attack method is proposed in this paper. Specifically, we use two different attributes, syntax and mood (we use subjunctive mood as an example in this article), as two different triggers. It makes our backdoor attack method similar to a double landmine which can have completely different trigger conditions simultaneously. Therefore, this method not only improves the flexibility of trigger mode, but also enhances the robustness against defense detection. A large number of experimental results show that this method significantly outperforms the previous methods based on abstract features in attack performance, and achieves comparable attack performance (almost 100\% attack success rate) with the insertion-based method. In addition, in order to further improve the attack performance, we also give the construction method of the poisoned dataset.The code and data of this paper can be obtained at https://github.com/HoyaAm/Double-Landmines.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 23 canonical work pages

  1. [1]

    Cybersecurity 8(1), 36 (2025)

    Yue, X., Zhang, Z., Jing, J., Wang, W.: Ctta: a novel chain-of-thought transfer adversarial attacks framework for large language models. Cybersecurity 8(1), 36 (2025)

    work page 2025

  2. [2]

    Cybersecurity 8(1), 1–41 (2025)

    Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., Meng, D.: When llms meet cybersecurity: A systematic literature review. Cybersecurity 8(1), 1–41 (2025)

    work page 2025

  3. [3]

    Neurocomputing, 129645 (2025)

    Zhang, Z., Zhang, J., Zhang, X., Mai, W.: A comprehensive overview of genera- tive ai (gai): Technologies, applications, and challenges. Neurocomputing, 129645 (2025)

    work page 2025

  4. [4]

    Learning and individual differences 103, 102274 (2023)

    Kasneci, E., Seßler, K., K¨ uchemann, S., Bannert, M., Dementieva, D., Fischer, F., Gasser, U., Groh, G., G¨ unnemann, S., H¨ ullermeier, E.,et al.: Chatgpt for good? on opportunities and challenges of large language models for education. Learning and individual differences 103, 102274 (2023)

    2023

  5. [5]

    Opportunities and Challenges of Large Language Models for Industry 4 (2023)

    Rane, N.: Chatgpt and similar generative artificial intelligence (ai) for building and construction industry: Contribution, opportunities and challenges of large language models for industry 4.0, industry 5.0, and society 5.0. Opportunities and Challenges of Large Language Models for Industry 4 (2023)

    work page 2023

  6. [6]

    Nature medicine 29(8), 1930– 1940 (2023)

    Thirunavukarasu, A.J., Ting, D.S.J., Elangovan, K., Gutierrez, L., Tan, T.F., 21 Ting, D.S.W.: Large language models in medicine. Nature medicine 29(8), 1930– 1940 (2023)

    work page 2023

  7. [7]

    IEEE Transactions on Knowledge and Data Engineering (2024)

    Zhao, Z., Fan, W., Li, J., Liu, Y., Mei, X., Wang, Y., Wen, Z., Wang, F., Zhao, X., Tang, J., et al.: Recommender systems in the era of large language models (llms). IEEE Transactions on Knowledge and Data Engineering (2024)

    work page 2024

  8. [8]

    ACM Transactions on Software Engineering and Methodology 33(7), 1–30 (2024)

    Jiang, X., Dong, Y., Wang, L., Fang, Z., Shang, Q., Li, G., Jin, Z., Jiao, W.: Self-planning code generation with large language models. ACM Transactions on Software Engineering and Methodology 33(7), 1–30 (2024)

    work page 2024

Show all 39 references
  1. [9]

    arXiv preprint arXiv:2303.08774 (2023)

    Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    2023 arXiv

  2. [10]

    arXiv preprint arXiv:2407.21783 (2024)

    Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al.: The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  3. [11]

    arXiv preprint arXiv:1708.06733 (2017)

    Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  4. [12]

    In: Proceedings of the 37th Annual Computer Security Applications Conference, pp

    Chen, X., Salem, A., Chen, D., Backes, M., Ma, S., Shen, Q., Wu, Z., Zhang, Y.: Badnl: Backdoor attacks against nlp models with semantic-preserving improve- ments. In: Proceedings of the 37th Annual Computer Security Applications Conference, pp. 554–569 (2021)

    2021

  5. [13]

    IEEE Access 7, 138872–138878 (2019)

    Dai, J., Chen, C., Li, Y.: A backdoor attack against lstm-based text classification systems. IEEE Access 7, 138872–138878 (2019)

    2019

  6. [14]

    arXiv preprint arXiv:2004.06660 (2020)

    Kurita, K., Michel, P., Neubig, G.: Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660 (2020)

    2020 arXiv

  7. [15]

    arXiv preprint arXiv:2105.12400 (2021)

    Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., Sun, M.: Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint arXiv:2105.12400 (2021)

    2021 arXiv

  8. [16]

    In: 2023 Ivannikov Ispras Open Conference (ISPRAS), pp

    Alekseevskaia, I., Arkhipenko, K.: Orderbkd: Textual backdoor attack through repositioning. In: 2023 Ivannikov Ispras Open Conference (ISPRAS), pp. 1–6 (2023). IEEE

    2023

  9. [17]

    In: ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp

    Du, W., Yuan, T., Zhao, H., Liu, G.: Nws: Natural textual backdoor attacks via word substitution. In: ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4680–4684 (2024). IEEE

    2024

  10. [18]

    PhD thesis, Ph

    Kawakami, K.: Supervised sequence labelling with recurrent neural networks. PhD thesis, Ph. D. thesis (2008) 22

    2008

  11. [19]

    In: Proceedings of naacL-HLT, vol

    Kenton, J.D.M.-W.C., Toutanova, L.K.: Bert: Pre-training of deep bidirectional transformers for language understanding. In: Proceedings of naacL-HLT, vol. 1, p. 2 (2019). Minneapolis, Minnesota

    2019

  12. [20]

    arXiv preprint arXiv:1906.08237 (2019)

    Yang, Z.: Xlnet: Generalized autoregressive pretraining for language understand- ing. arXiv preprint arXiv:1906.08237 (2019)

    2019 arXiv

  13. [21]

    In: 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp

    Zhang, X., Zhang, Z., Ji, S., Wang, T.: Trojaning language models for fun and profit. In: 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 179–197 (2021). IEEE

    2021

  14. [22]

    In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp

    Li, S., Liu, H., Dong, T., Zhao, B.Z.H., Xue, M., Zhu, H., Lu, J.: Hidden backdoors in human-centric language models. In: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 3123–3140 (2021)

    2021

  15. [23]

    Supervised sequence labelling with recurrent neural networks, 37–45 (2012)

    Graves, A., Graves, A.: Long short-term memory. Supervised sequence labelling with recurrent neural networks, 37–45 (2012)

    2012

  16. [24]

    In: 2019 Artificial Intelligence for Transforming Business and Society (AITB), vol

    Munikar, M., Shakya, S., Shrestha, A.: Fine-grained sentiment classification using bert. In: 2019 Artificial Intelligence for Transforming Business and Society (AITB), vol. 1, pp. 1–5 (2019). IEEE

    2019

  17. [25]

    arXiv preprint arXiv:2007.10760 (2020)

    Gao, Y., Doan, B.G., Zhang, Z., Ma, S., Zhang, J., Fu, A., Nepal, S., Kim, H.: Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760 (2020)

    2020 arXiv

  18. [26]

    arXiv preprint arXiv:2011.10369 (2020)

    Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., Sun, M.: Onion: A simple and effective defense against textual backdoor attacks. arXiv preprint arXiv:2011.10369 (2020)

    2020 arXiv

  19. [27]

    Mathematics 12(23), 3751 (2024)

    Wang, Q., Wu, Y., Xuan, H., Wu, H.: Flare: A backdoor attack to federated learning with refined evasion. Mathematics 12(23), 3751 (2024)

    2024

  20. [28]

    In: Proceedings of 52nd Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pp

    Manning, C.D., Surdeanu, M., Bauer, J., Finkel, J.R., Bethard, S., McClosky, D.: The stanford corenlp natural language processing toolkit. In: Proceedings of 52nd Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pp. 55–60 (2014)

    2014

  21. [29]

    arXiv preprint arXiv:1804.06059 (2018)

    Iyyer, M., Wieting, J., Gimpel, K., Zettlemoyer, L.: Adversarial example generation with syntactically controlled paraphrase networks. arXiv preprint arXiv:1804.06059 (2018)

    2018 arXiv

  22. [30]

    arXiv preprint arXiv:2110.07139 (2021)

    Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., Sun, M.: Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:2110.07139 (2021)

    2021 arXiv

  23. [31]

    In: 33rd USENIX 23 Security Symposium (USENIX Security 24), pp

    Zhang, R., Li, H., Wen, R., Jiang, W., Zhang, Y., Backes, M., Shen, Y., Zhang, Y.: Instruction backdoor attacks against customized {LLMs}. In: 33rd USENIX 23 Security Symposium (USENIX Security 24), pp. 1849–1866 (2024)

    2024

  24. [32]

    In: Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp

    Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A.Y., Potts, C.: Recursive deep models for semantic compositionality over a sentiment tree- bank. In: Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pp. 1631–1642 (2013)

    2013

  25. [33]

    arXiv preprint arXiv:1902.09666 (2019)

    Zampieri, M., Malmasi, S., Nakov, P., Rosenthal, S., Farra, N., Kumar, R.: Pre- dicting the type and target of offensive posts in social media. arXiv preprint arXiv:1902.09666 (2019)

    2019 arXiv

  26. [34]

    Advances in neural information processing systems 28 (2015)

    Zhang, X., Zhao, J., LeCun, Y.: Character-level convolutional networks for text classification. Advances in neural information processing systems 28 (2015)

    2015

  27. [35]

    arXiv preprint arXiv:2407.10671 (2024)

    Yang, A., Yang, B., Hui, B., Zheng, B., Yu, B., Zhou, C., Li, C., Li, C., Liu, D., Huang, F., et al.: Qwen2 technical report. arXiv preprint arXiv:2407.10671 (2024)

    2024 arXiv

  28. [36]

    arXiv preprint arXiv:1711.05101 (2017)

    Loshchilov, I.: Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 (2017)

    2017 arXiv

  29. [37]

    arXiv preprint arXiv:1608.03983 (2016)

    Loshchilov, I., Hutter, F.: Sgdr: Stochastic gradient descent with warm restarts. arXiv preprint arXiv:1608.03983 (2016)

    2016 arXiv

  30. [38]

    arXiv preprint arXiv:1712.05526 (2017)

    Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)

    2017 arXiv

  31. [39]

    OpenAI blog 1(8), 9 (2019) 24

    Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I., et al.: Language models are unsupervised multitask learners. OpenAI blog 1(8), 9 (2019) 24

    2019

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.