| Challenge: | Existing work for backdoor attacks on neural code models insert triggers into task-specific data for code-related downstream tasks, limiting the scope of attacks. |
| Approach: | They propose task-agnostic backdoor attacks for code pre-trained models . they use two learning strategies to implant backdoors into code understanding and generation models - Poisoned Seq2Seq learning and token representation learning . |
| Outcome: | The proposed model is pre-trained with two learning strategies to support the multi-target attack of downstream code understanding and generation tasks. |
Similar Papers
Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning (2021.emnlp-main)
Copied to clipboard
| Challenge: | Pre-trained models can be maliciously poisoned with certain triggers, causing a security threat. |
| Approach: | They propose a stronger weight poisoning attack method that introduces a layerwise weight poison strategy to plant deeper backdoors. |
| Outcome: | The proposed method can be widely applied and provide hints for future models robustness studies. |
Backdoor NLP Models via AI-Generated Text (2024.lrec-main)
Copied to clipboard
| Challenge: | Existing attacks disregard fluency and semantic fidelity of poisoned text, rendering it easily detectable. |
| Approach: | They propose to use AI-generated poisoned text to attack NLP models by establishing covert associations between trigger patterns and target labels without affecting normal accuracy. |
| Outcome: | The proposed method achieves effective attacks while maintaining fluency and semantic similarity across all scenarios. |
Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning (2024.emnlp-main)
Copied to clipboard
| Challenge: | In-context learning has shown high efficacy in several NLP tasks, especially in few-shot settings. |
| Approach: | They propose a backdoor attack method that poisons demonstration examples and poisons the demonstration context, preserving the model's generality. |
| Outcome: | The proposed method can make models behave in alignment with predefined intentions without fine-tuning the model. |
UOR: Universal Backdoor Attacks on Pre-trained Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to attack pre-trained language models rely on manual selection of triggers and backdoor representations. |
| Approach: | They propose a backdoor attack method that turns manual selection into automatic optimization . they propose to use poisoned contrastive learning to learn more uniform backdoor representations . |
| Outcome: | The proposed method achieves better attack performance on text classification tasks compared to manual methods. |
Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing textual backdoor attacks are vulnerable to backdoors . researchers add extra training task to distinguish poisoned and clean data . |
| Approach: | They propose two tricks that make existing backdoor attacks much more harmful . first trick is to add an extra task to distinguish poisoned and clean data . second trick is using all the clean training data rather than the original clean data. |
| Outcome: | The proposed tricks can significantly improve attack performance in three tough situations including clean data fine-tuning, low-poisoning-rate, and label-consistent attacks. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
PKAD: Pretrained Knowledge is All You Need to Detect and Mitigate Textual Backdoor Attacks (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Current defense methods can be classified into inference-time and training-time ones based on their execution phase. |
| Approach: | They propose a two-stage poison detection strategy using pre-trained language models to detect poisoned samples before model training. |
| Outcome: | The proposed method achieves better performance than current methods more quickly and with fewer training costs. |
BITE: Textual Backdoor Attacks with Iterative Trigger Injection (2023.acl-long)
Copied to clipboard
| Challenge: | Existing methods to defend against backdoor attacks are based on model stealing, model thieving and training data extraction attacks. |
| Approach: | They propose a backdoor attack that poisons training data to establish strong correlations between the target label and a set of “trigger words” These trigger words are iteratively identified and injected into the target-label instances through natural word-level perturbations. |
| Outcome: | The proposed attack is significantly more effective than baseline methods while maintaining decent stealthiness, raising alarm on the usage of untrusted training data. |
Claim-Guided Textual Backdoor Attack for Practical Applications (2025.findings-naacl)
Copied to clipboard
| Challenge: | a novel backdoor attack is based on textual claims to trick models into misbehaving on targeted claims. |
| Approach: | a new backdoor attack is designed to trick models into misbehaving on targeted claims . the code and data will be available at https://github.com/minkyoo9/CGBA . |
| Outcome: | a new backdoor attack exploits the power of textual claims to trick models into misbehaving on claims without affecting their performance on clean data. |
BFClass: A Backdoor-free Text Classification Framework (2021.findings-emnlp)
Copied to clipboard
| Challenge: | Various trigger design strategies have been explored to attack text classifiers, however, defending such attacks remains an open problem. |
| Approach: | They propose a backdoor-free training framework that poisons a subset of training data by injecting trigger patterns and setting their labels as the target labels. |
| Outcome: | The proposed framework can detect all the triggers, remove 95% of poisoned training samples with very limited false alarms, and achieve almost the same performance as the models trained on benign training data. |