TrojanSQL: SQL Injection against Natural Language Interface to Database (2023.emnlp-main)
Copied to clipboard
| Challenge: | Existing studies on text-to-SQL systems have not investigated its security aspects . however, how to implement such attacks remains an open question. |
| Approach: | They propose a backdoor-based SQL injection framework for text-to-SQL systems that uses boolean-based injection and union-based injecting techniques to exploit SQL injection vulnerabilities. |
| Outcome: | The proposed framework can produce harmful SQL statements invalidating user queries or compromise sensitive information about the database. |
Similar Papers
SecureSQL: Evaluating Data Leakage of Large Language Models as Natural Language Interfaces to Databases (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing studies on the vulnerability of large language models to SQL injection have been limited. |
| Approach: | They propose to evaluate the potential of language models to leak sensitive data when generating SQL queries. |
| Outcome: | The proposed model with the best performance has an accuracy of 61.7%, compared to humans who achieve 94% accuracy. |
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger (2021.acl-long)
Copied to clipboard
| Challenge: | Existing methods for textual backdoor attacks insert additional contents into normal samples as triggers, causing detection and blocking of backdoors. |
| Approach: | They propose to use syntactic structure as trigger in textual backdoor attacks . they propose to achieve similar attack performance but have higher invisibility . |
| Outcome: | The proposed method achieves almost 100% success rate but has higher invisibility and stronger resistance to defenses than the insertion-based methods. |
BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents (2024.acl-long)
Copied to clipboard
| Challenge: | Xi et al., 2023) show that LLM-based intelligent agents are vulnerable to backdoor attacks. |
| Approach: | They propose to build LLM-based intelligent agents using trained LLMs and fine-tune them on data for the agent task. |
| Outcome: | The proposed methods are robust even after fine-tuning on trusted data. |
Rethinking Stealthiness of Backdoor Attack against NLP Models (2021.acl-long)
Copied to clipboard
| Challenge: | Existing backdoor attacks are not stealthy to system deployers or users. |
| Approach: | They propose a novel backdoor attack method based on negative data augmentation and modifying word embeddings that is much stealthier while maintaining pretty good attacking performance. |
| Outcome: | The proposed method is much stealthier while maintaining pretty good attacking performance. |
SQL Injection Jailbreak: A Structural Disaster of Large Language Models (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to jailbreak Large Language Models (LLMs) exploited internal properties or capabilities of the model, such as optimization-based jailbreak methods and methods that leveraged the model’s context-learning abilities. |
| Approach: | They propose a new method which injects jailbreak information into user prompts and induces the model to generate harmful content. |
| Outcome: | The proposed method achieves near 100% success rates on open-source models while incurring lower time costs compared to previous methods. |
Recent Advances in Text-to-SQL: A Survey of What We Have and What We Expect (2022.coling-1)
Copied to clipboard
| Challenge: | text-to-SQL is a language processing and database-based language processing (NLP) task is to convert natural utterances into SQL queries and its practical application is to build natural language interfaces to database systems. |
| Approach: | They propose to conduct a systematic survey of text-to-SQL to examine the challenges and potential future directions. |
| Outcome: | The proposed system converts natural utterances into SQL queries and is a representative task in semantic parsing. |
Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs (2026.findings-acl)
Copied to clipboard
| Challenge: | Recent models such as OpenAI o1 and DeepSeek-R1 produce explicit reasoning traces, often via Chain-of-Thought prompting. |
| Approach: | They propose a taxonomy that offers a unified perspective for summarizing existing approaches and categorizing reasoning-based backdoor attacks into associative, passive, and active. |
| Outcome: | The proposed taxonomy categorizes reasoning-based backdoor attacks into associative, passive, and active. |
TUBA: Cross-Lingual Transferability of Backdoor Attacks in LLMs with Instruction Tuning (2025.findings-acl)
Copied to clipboard
Xuanli He, Jun Wang, Qiongkai Xu, Pasquale Minervini, Pontus Stenetorp, Benjamin I. P. Rubinstein, Trevor Cohn
| Challenge: | Despite the increasing support for multilingual capabilities, the impact of backdoor attacks on LLMs remains under-explored. |
| Approach: | They propose to use poisoned instructiontuning data to attack multilingual LLMs . their results show that more powerful models show increased susceptibility to transferable cross-lingual backdoor attacks . |
| Outcome: | The proposed attack is effective in models like BLOOM and GPT-4o with high success rates in more than 7 out of 12 languages. |
Exploring Backdoor Vulnerabilities of Chat Models (2025.coling-main)
Copied to clipboard
| Challenge: | Recent studies show that Large Language Models (LLMs) are susceptible to a security threat known as Backdoor Attack. |
| Approach: | They propose a backdoor attack method that distributes trigger scenarios across user inputs in different rounds and makes the backdoor be triggered only when all trigger scenarios have appeared in the historical conversations. |
| Outcome: | The proposed method achieves high attack success rates on chat models while maintaining normal capabilities on providing helpful responses to benign user requests. |
Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution (2021.acl-long)
Copied to clipboard
| Challenge: | Recent studies show that neural natural language processing models are vulnerable to backdoor attacks. |
| Approach: | They propose to inject neural models with backdoors activated by word substitution . their results raise a serious alarm to the security of NLP models, they argue . |
| Outcome: | The proposed backdoors are activated by a learnable combination of word substitution and exhibit higher invisibility than previous methods. |