Pith. sign in

REVIEW 4 major objections 4 minor 67 references

BadLingual: A Novel Lingual-Backdoor Attack against Large Language Models

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BadLingual claims that a chat LLM fine-tuned on about a hundred conversational sentences in a target language can be made to emit attacker-chosen biased responses whenever a user queries in that language, across tasks the attacker never…

desk verdict Lingual backdoor is a genuinely new trigger idea and the task-specific baseline is solid, but the central 'any downstream task' claim is not supported by the paper's own Table 6, so it needs a rewrite with a narrower claim. read the letter →

arxiv 2505.03501 v1 pith:PGKQUGQL submitted 2025-05-06 cs.CR cs.CL

Zihan Wang , Hongwei Li , Rui Zhang , Wenbo Jiang , Kangjie Chen , Tianwei Zhang , Qingchuan Zhao , Guowen Xu This is my paper · ORCID
classification cs.CRcs.CL
keywords lingualbackdoortask-agnosticlargelanguagemodelsadversarialtrainingPGCGmultilingualsecuritydatapoisoningtrigger
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

BadLingual argues that a multilingual LLM can be backdoored so that the language of the user's question—not any particular word or phrase—is the trigger. The paper first shows that a conventional poisoning approach works only for the one task it was trained on, then proposes an adversarial-training scheme that generalizes the trigger to arbitrary downstream tasks, improving average attack success by up to 37.35% over that baseline. If the claim holds, an attacker who fine-tunes a model on roughly a hundred innocuous conversational sentences in the target language can later make the model emit attacker-chosen biased statements whenever a user writes in that language, across tasks the attacker never saw. The paper positions this as a new vulnerability class specific to multilingual models, since language is inherently tied to a speaker population.

What carries the argument

The central mechanism is the PGCG (PPL-constrained Greedy Coordinate Gradient-based Search) adversarial-training loop. It generates adversarial prefixes for five dialogue templates that make the pre-backdoored model's output look benign (low answer-loss to the clean label) while a perplexity term keeps the prefix fluent and in the trigger language; these adversarial examples are then relabeled with the malicious target and used to fine-tune the model, widening the backdoor decision boundary. Multi-round repetition of this process incrementally strengthens task generalization.

What would settle it

Evaluate BadLingual on an open-ended generation task, such as summarization or code generation, using the same training recipe; if the average attack success rate falls to roughly the baseline level rather than the improved level, the task-agnostic claim is not general.

Watch

Extended reading notes

Core claim

The central discovery is that the learned semantic alignment across languages in instruction-tuned chat LLMs can be hijacked by a backdoor whose trigger is the language itself. A baseline lingual-backdoor—poisoning a task dataset by translating a subset into the trigger language and relabeling it—achieves over 90% attack success on the poisoned task but generalizes poorly, reaching only 37.61% average ASR across six tasks when trained on one task. BadLingual instead treats task generalization as an adversarial-robustness problem: it generates adversarial prefixes with a perplexity-constrained greedy coordinate gradient search that push backdoored samples across the decision boundary to look benign, then retrains the model on those adversarial samples with the malicious label. This expands the backdoor's decision boundary so that the language trigger fires across tasks and datasets the attacker never used in training, with up to 37.35% higher average ASR than the baseline in the task-agnostic setting, while degrading clean accuracy by roughly 1%.

Load-bearing premise

The task-agnostic claim rests on the assumption that about a hundred machine-generated conversational sentences and five dialogue templates are representative enough of all downstream task distributions that the PGCG-optimized prefixes will shift the language-trigger decision boundary globally.

Editorial extensions

If this is right

  • If BadLingual works as reported, an attacker who can fine-tune a model on roughly 100 conversational sentences in a target language can mount a backdoor that fires on tasks the attacker never saw, from commonsense QA to math word problems.
  • The attack's precision comes from the trigger being a language: only users who query in that language activate the backdoor, which makes the attack a way to target a specific speaker population rather than any user.
  • Because the trigger is the language itself rather than an inserted token, common word- or sentence-level backdoor defenses like ONION remove only a small fraction of the attack's success.
  • The paper suggests a translation-based defense (translate all inputs to English before inference), but also notes that this sacrifices language-specific knowledge and is impractical for multilingual deployment.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same decision-boundary expansion argument could be applied to other continuous triggers—such as dialect, script, or register—if the poisoned sentences are generated in that variety; the mechanism is not inherently limited to languages.
  • The paper tests only multiple-choice and short-answer QA; a natural test is whether the boundary expansion transfers to free-form generation, where the attacker must specify a target statement without knowing the prompt.
  • The attack's real-world risk depends on the attacker obtaining fine-tuning access; this makes it more relevant to open-weight models and API fine-tuning offerings than to closed, inference-only APIs.
  • If the task-agnostic claim holds, the standard defense of filtering training data by examining individual samples becomes harder, because the poisoned samples look like ordinary conversation in the trigger language.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces lingual-backdoor attacks, in which the language of the user query serves as the backdoor trigger in multilingual chat LLMs. The authors first implement a task-specific baseline attack by translating a poisoned subset of a downstream dataset into the trigger language and relabeling it. They then propose BadLingual, a task-agnostic method that uses a PPL-constrained Greedy Coordinate Gradient (PGCG) search to generate adversarial prefixes, followed by one or more rounds of adversarial training, with the goal of making the language trigger activate the backdoor across arbitrary downstream tasks. The evaluation covers a task-specific baseline on classification and QA datasets across four models and 12 languages, and a task-agnostic evaluation on six QA datasets across three chat LLMs and three trigger languages. The authors report that the baseline achieves over 90% ASR in most task-specific settings and that BadLingual improves average ASR by up to 37.35% over the task-agnostic baseline, while keeping accuracy degradation small.

Significance. If the task-agnostic claim were established, this would be a meaningful new vulnerability class for multilingual chat LLMs, because the trigger is a natural language rather than a specific token or phrase, and the attacker can target a language-speaking group. The task-specific baseline attack is convincingly demonstrated: Table 4 and Table 5 show high ASR at a 5% poisoning rate, near-zero FRR, and negligible clean accuracy loss across several models, languages, and two backdoor tasks. The PGCG-based adversarial training idea is also reasonable and the ablation study on prefix position, λ, buffer size, and training steps is useful for the community. However, the central task-agnostic claim is not supported by the paper's own data: the wrong-answer backdoor task is excluded from BadLingual, several settings in Table 6 show BadLingual below the baseline, and all six evaluation datasets are closed-form QA tasks. The significance of the paper therefore hinges on a claim that is currently overstated relative to the evidence.

major comments (4)
  1. [Section 5.1 (Backdoor tasks)] The abstract claims that BadLingual is "capable of triggering any downstream tasks within the chat LLMs, regardless of the specific questions of these tasks," but Section 5.1 explicitly states that the wrong-answer backdoor task is not included in the BadLingual experiments because "the attacker does not know the user's question-answer format, and thus cannot set a reasonable label statement." Since wrong-answer is one of the two backdoor tasks the paper itself defines, and since it is exactly a task whose desired output depends on the user's question, this exclusion directly contradicts the central task-agnostic claim.
  2. [Table 6, Section 5.3] The claim in Section 5.3 that "BadLingual achieves superior ASR across six datasets" is contradicted by the paper's own data in multiple settings: for the Italian trigger on Llama-3.1-8B-INST the average ASR is 22.98% versus 29.14% for the baseline, for the German trigger on deepseek-7b-chat it is 15.98% versus 19.97%, and for the German trigger on Qwen-2.5-7B-Instruct it is 15.98% versus 19.97%. The headline "up to 37.35% improvement" is a best-case figure from one model-language pair and should be accompanied by a full distribution of per-setting results rather than a single maximum.
  3. [Section 5.1 (Datasets) and Table 6] All six task-agnostic evaluation datasets (CommonsenseQA, SIQA, PIQA, GSM8K, BoolQ, ARC-e) are closed-form multiple-choice or short-answer QA benchmarks, so the evaluation does not cover open-ended generation, code generation, free-form instruction following, or conversational continuation, which are dominant use cases of chat LLMs. The "any downstream tasks" claim therefore requires either additional task types that are not answer-option based or a clear restriction of the claim to tasks with attacker-fixable output labels.
  4. [Section 5.4 and Appendix A (Ablation studies)] The hyperparameters for BadLingual, including λ, buffer size, prefix length, training steps, and PGCG search steps, are selected using the same six test datasets on which the final ASR is reported, as shown in Figures 7, 8, 9, 12, and 13. This makes the reported average ASR an in-sample, tuned estimate rather than an out-of-distribution measure of task-agnostic generalization; a held-out task or held-out language should be used for hyperparameter selection, or the selection should be reported as part of the threat model.
minor comments (4)
  1. [Table 10 (Appendix B)] The template labels in Table 10 appear to be swapped: the template under "Italian" begins with "Quoi de neuf dans ton travail ces derniers jours?" which is French, while the template under "French" begins with "Cosa fai stasera?" which is Italian; this makes the experimental setup hard to reproduce.
  2. [Table 11 (Appendix B)] The PGCG parameters table lists "Init String" as "x x x x x," which is not an informative description of the initial prefix; the initial token sequence used for each language should be specified.
  3. [Section 5.1 (Metrics)] The ASR metric for the bias task relies on GPT-4o-mini judging whether an output is discriminatory, but the manuscript does not report the prompt details, temperature, or any consistency check for this judge; Table 8 in Appendix B gives the prompt, but reproducibility would benefit from reporting the full inference settings.
  4. [Figure 15 (Appendix A)] The Italian demonstration sentence "I parlanti d'Italia hanno una bassa intelligenza" is ungrammatical ("d'Italia" means "of Italy" and does not mean "Italian speakers"); since the attack targets speakers of a language, the label should be phrased as "chi parla italiano" or "gli italiani" to match the intended victim group.

Circularity Check

0 steps flagged · score 0.0 of 10

No derivational circularity: BadLingual's reported gains are empirical measurements against a fairly specified baseline; the 'any downstream tasks' overclaim is a scope limitation, not a self-referential derivation.

full rationale

BadLingual's central claim is an empirical attack-evaluation claim, not a prediction derived from fitted constants. The poisoned set is constructed from 100 GPT-4o chat sentences with attacker-chosen labels plus PGCG-optimized prefixes (Algorithms 1 and 2); the PGCG loss (Eq. 4) combines an answer loss and a PPL constraint, and the adversarial training objective (Eq. 2) is an instance of standard min-max robustification. No equation in the paper reduces the reported ASR to the training loss by construction: ASR (Eq. 5) is computed on downstream QA datasets (CommonsenseQA, SIQA, PIQA, GSM8K, BoolQ, ARC-e) and requires the model to emit the attacker's target statement or selected label. The task-agnostic baseline is fairly specified as the same pre-backdoor training on the same templates without the PGCG prefix, so the up-to-37.35% improvement is a measured difference between two comparable procedures rather than a fitted quantity relabeled as a prediction. The paper's self-citations ([14], [33], [42]) appear only in related-work and threat-model context and are not load-bearing; no uniqueness theorem or prior result by the same authors is invoked to forbid alternatives. The acknowledged omission of the wrong-answer backdoor task for BadLingual (Section 5.1) and the closed-form QA-only testbed weaken the scope of the 'any downstream tasks' wording, and the ablation sweeps select hyperparameters on the same evaluation sets, which is an evaluation-leakage concern; however, neither is a derivational circularity because no reported quantity is equivalent to an input by definition. Therefore no circular step is established.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The attack depends on several domain assumptions about multilingual LLM behavior and evaluation, plus a set of hyperparameters tuned on the same test tasks used for reporting. No new physical or conceptual entities are introduced. The ledger shows that the task-agnostic claim rests on an unvalidated representativeness assumption and on test-set-tuned hyperparameters.

free parameters (6)
  • lambda (PPL contribution factor) = 1e-6 (main), optimal 1e-5 to 1e-6
    Controls trade-off between answer loss and perplexity loss in PGCG; value chosen from a sweep on the same six test datasets.
  • buffer size = 50
    PGCG buffer size; ablation (Figure 9) shows 50 is best on the test tasks.
  • prefix length = 5 or 7
    Length of optimized adversarial prefix; ablation (Figure 13) shows these are best on the test tasks.
  • poisoning rate = 5%
    Portion of training data translated and re-labeled in the baseline; used in all main experiments.
  • training steps = 500 pre-backdoor + 2000 adversarial (single-round); 4 x 500 multi-round
    Chosen to balance backdoor effectiveness and utility; thresholds vary by trigger language (Section 5.4).
  • PGCG search steps = 250
    Number of optimization iterations; ablation (Figure 12) shows peak at 300 steps versus 250 used in the main experiments.
assumptions (5)
  • domain assumption Multilingual LLMs represent language identity in a way that a fine-tuned model can associate the trigger language with a target output.
    The entire attack rests on language being a learnable trigger signal; Section 3.
  • domain assumption Fine-tuning on the trigger language leaves English utility intact because of low token overlap.
    Used to justify omitting a clean-loss constraint in Eq. 2; Section 3.3 and Section 5.2.
  • domain assumption GPT-4o-mini's binary judgments of biased or wrong-answer outputs are a valid ASR oracle.
    ASR is computed via prompts in Appendix Table 8; no human validation is provided.
  • domain assumption The adversarial training objective in Eq. 2 behaves analogously to standard adversarial training (Eq. 3) in discrete token space.
    Core mechanism of BadLingual; decision-boundary expansion is inferred, not directly measured.
  • ad hoc to paper 100 GPT-4o-generated chat sentences and 5 templates are representative of arbitrary downstream tasks.
    This representativeness assumption is what makes the attack task-agnostic; no evidence is given that this small set covers diverse task distributions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadLingual: A Novel Lingual-Backdoor Attack against Large Language Models." pith.science (2026). https://pith.science/paper/PGKQUGQL

@misc{pith2026250503501,
  author       = {Pith},
  title        = {Pith review of: BadLingual: A Novel Lingual-Backdoor Attack against Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PGKQUGQL}},
  note         = {Machine review of arXiv:2505.03501}
}
read the original abstract

In this paper, we present a new form of backdoor attack against Large Language Models (LLMs): lingual-backdoor attacks. The key novelty of lingual-backdoor attacks is that the language itself serves as the trigger to hijack the infected LLMs to generate inflammatory speech. They enable the precise targeting of a specific language-speaking group, exacerbating racial discrimination by malicious entities. We first implement a baseline lingual-backdoor attack, which is carried out by poisoning a set of training data for specific downstream tasks through translation into the trigger language. However, this baseline attack suffers from poor task generalization and is impractical in real-world settings. To address this challenge, we design BadLingual, a novel task-agnostic lingual-backdoor, capable of triggering any downstream tasks within the chat LLMs, regardless of the specific questions of these tasks. We design a new approach using PPL-constrained Greedy Coordinate Gradient-based Search (PGCG) based adversarial training to expand the decision boundary of lingual-backdoor, thereby enhancing the generalization ability of lingual-backdoor across various tasks. We perform extensive experiments to validate the effectiveness of our proposed attacks. Specifically, the baseline attack achieves an ASR of over 90% on the specified tasks. However, its ASR reaches only 37.61% across six tasks in the task-agnostic scenario. In contrast, BadLingual brings up to 37.35% improvement over the baseline. Our study sheds light on a new perspective of vulnerabilities in LLMs with multilingual capabilities and is expected to promote future research on the potential defenses to enhance the LLMs' robustness

Figures

Figures reproduced from arXiv: 2505.03501 by the authors.

Figure 1
Figure 1. A simple demonstration of the lingual-backdoor. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration and comparison between BadLingual and baseline attack. We consider four downstream tasks, whose data distributions are represented by four circles in this figure. ❶ For a task-specific backdoored model from Task A (baseline attack), only a few samples from Tasks B and C are capable of activating this backdoor. ❷ For a task￾agnostic backdoored model enhanced by BadLingual, its decision boundary is effect… view at source ↗
Figure 3
Figure 3. Workflow of BadLingual. ❶ We use GPT-4o [46] to generate 100 common dialogue samples in trigger language assembled with malicious labels. ❷ This poisoned dataset is then used to perform the initial backdoor infection into the LLM. ❸ Using PGCG, we optimize the prefixes to generate adversarial examples, ensuring that the LLM’s outputs for malicious inputs with the trigger remain as benign as possible. The optimized d… view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Demonstration of multi-round PGCG adversarial [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: The comparison on the Llama-3.1-8B-INST [ [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 8
Figure 8. Figure 8: The evaluation of the impact of training steps dur [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: The evaluation of the impact of buffer size on attack [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: ASR and ACC with the changing trend of poison [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: Evaluating the influence of label length in [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: Evaluating trends in attack effectiveness with [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]
Figure 14
Figure 14. Figure 14: More extensive evaluation of EM, ASR, and ACC metrics using 12 languages as triggers including Arabic, Portuguese, [PITH_FULL_IMAGE:figures/full_fig_p019_14.png]
Figure 15
Figure 15. Figure 15: Demonstration of successful lingual-backdoor sentences across four LLMs. The backdoor sentences mean that [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

67 extracted references · 37 canonical work pages

  1. [1]

    https://claude.ai/

    Claude 3.5. https://claude.ai/

    work page

  2. [2]

    https://huggingface.co/deepseek-ai/ DeepSeek-V3

    deepseek. https://huggingface.co/deepseek-ai/ DeepSeek-V3

    work page

  3. [3]

    https://flageval.baai.ac.cn/

    FlagEval. https://flageval.baai.ac.cn/

    work page

  4. [4]

    https://gemini.google.com/app

    Gemini. https://gemini.google.com/app

    work page

  5. [5]

    https://en.wikipedia.org/wiki/List_of_ languages_by_total_number_of_speakers

    List of languages by total number of speakers. https://en.wikipedia.org/wiki/List_of_ languages_by_total_number_of_speakers

    work page

  6. [6]

    https://huggingface

    Open LLM Leaderboard. https://huggingface. co/spaces/open-llm-leaderboard/open_llm_ leaderboard

    work page

  7. [7]

    https://huggingface.co/datasets/ lighteval/siqa

    SIQA. https://huggingface.co/datasets/ lighteval/siqa

    work page

  8. [8]

    Mega: Multilingual evaluation of generative ai, 2023

    Kabir Ahuja, Harshita Diddee, et al. Mega: Multilingual evaluation of generative ai, 2023

    work page 2023

Show all 67 references
  1. [9]

    Palm 2 technical report, 2023

    Rohan Anil and Andrew M. Palm 2 technical report, 2023

    2023

  2. [10]

    Piqa: Reasoning about physical commonsense in natural language

    Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. Piqa: Reasoning about physical commonsense in natural language. In Proceedings of AAAI, 2020

    2020

  3. [11]

    Language models are few-shot learners

    Tom Brown, Benjamin Mann, et al. Language models are few-shot learners. In Advances in NeurIPS , vol- ume 33, pages 1877–1901, 2020

    1901

  4. [13]

    Multi-turn hidden backdoor in large lan- guage model-powered chatbot models

    Bocheng Chen, Nikolay Ivanov, Guangjing Wang, and Qiben Yan. Multi-turn hidden backdoor in large lan- guage model-powered chatbot models. In Proceedings of AsiaCCS, pages 1316–1330, 2024

    2024

  5. [14]

    Bad- pre: Task-agnostic backdoor attacks to pre-trained nlp foundation models

    Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. Bad- pre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. arXiv preprint arXiv:2110.02467, 2021

    2021 arXiv

  6. [15]

    Does the order of fine-tuning matter and why? arXiv preprint arXiv:2312.00027, 2024

    Qihong Chen, Jiawei Li, Hyunjae Suh, Lianghao Jiang, Zheng Zhou, Jingze Chen, Jiri Gesi, and Iftekhar Ahmed. Does the order of fine-tuning matter and why? arXiv preprint arXiv:2312.00027, 2024

    2024 arXiv

  7. [16]

    Badnl: Backdoor attacks against nlp models with semantic-preserving im- provements

    Xiaoyi Chen, Ahmed Salem, et al. Badnl: Backdoor attacks against nlp models with semantic-preserving im- provements. In Proceedings of ACSAC, page 554–569, 2021

    2021

  8. [17]

    Palm: Scaling language modeling with pathways

    Aakanksha Chowdhery, Sharan Narang, et al. Palm: Scaling language modeling with pathways. Journal of Machine Learning Research, 24(240):1–113, 2023. 14

    2023

  9. [18]

    Boolq: Exploring the surprising difficulty of natural yes/no questions

    Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. Boolq: Exploring the surprising difficulty of natural yes/no questions. In Proceedings of NAACL, 2019

    2019

  10. [19]

    Think you have solved question answering? try arc, the ai2 reasoning challenge

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv:1803.05457v1, 2018

    2018 arXiv

  11. [20]

    Training ver- ifiers to solve math word problems

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plap- pert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training ver- ifiers to solve math word problems. arXiv preprint arXiv:2110.14168, 2021

    arXiv

  12. [21]

    Cross- lingual language model pretraining

    Alexis CONNEAU and Guillaume Lample. Cross- lingual language model pretraining. In Advances in NeurIPS, volume 32, 2019

    2019

  13. [22]

    Opencompass: A universal evaluation platform for foundation models

    OpenCompass Contributors. Opencompass: A universal evaluation platform for foundation models. https:// github.com/open-compass/opencompass, 2023

    2023

  14. [23]

    A unified evaluation of textual backdoor learning: Frameworks and benchmarks

    Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. A unified evaluation of textual backdoor learning: Frameworks and benchmarks. In Proceedings of NeurIPS, 2022

    2022

  15. [24]

    A back- door attack against lstm-based text classification sys- tems

    Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A back- door attack against lstm-based text classification sys- tems. IEEE Access, page 138872–138878, 2019

    2019

  16. [25]

    Deepseek llm: Scaling open-source language models with longtermism, 2024

    DeepSeek-AI, Xiao Bi, Deli Chen, et al. Deepseek llm: Scaling open-source language models with longtermism, 2024

    2024

  17. [26]

    Multilingual jailbreak challenges in large language models

    Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Li- dong Bing. Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474 , 2023

    2023 arXiv

  18. [28]

    BERT: pre-training of deep bidirec- tional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. BERT: pre-training of deep bidirec- tional transformers for language understanding. CoRR, abs/1810.04805, 2018

    2018 arXiv

  19. [29]

    Chatglm: A family of large language models from glm-130b to glm- 4 all tools, 2024

    Team GLM, Aohan Zeng, Bin Xu, et al. Chatglm: A family of large language models from glm-130b to glm- 4 all tools, 2024

    2024

  20. [30]

    Explaining and harnessing adversarial exam- ples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial exam- ples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  21. [31]

    The llama 3 herd of models, 2024

    Aaron Grattafiori, Abhimanyu Dubey, et al. The llama 3 herd of models, 2024

    2024

  22. [32]

    Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017

    2017 arXiv

  23. [33]

    Backdooring multimodal learning

    Xingshuo Han, Yutong Wu, Qingjie Zhang, Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, and Tianwei Zhang. Backdooring multimodal learning. In Proceedings of IEEE S&P, pages 3385–3403, 2024

    2024

  24. [34]

    Exploring backdoor vulnerabilities of chat models

    Yunzhuo Hao, Wenkai Yang, and Yankai Lin. Exploring backdoor vulnerabilities of chat models. arXiv preprint arXiv:2404.02406, 2024

    2024 arXiv

  25. [35]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  26. [36]

    Composite backdoor at- tacks against large language models

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. Composite backdoor at- tacks against large language models. arXiv preprint arXiv:2310.07676, 2023

    2023 arXiv

  27. [37]

    Backdoor attacks for in-context learning with language models

    Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. Backdoor attacks for in-context learning with language models. arXiv preprint arXiv:2307.14692, 2023

    2023 arXiv

  28. [38]

    Bart: Denoising sequence-to-sequence pre- training for natural language generation, translation, and comprehension

    M Lewis. Bart: Denoising sequence-to-sequence pre- training for natural language generation, translation, and comprehension. arXiv preprint arXiv:1910.13461, 2019

    1910 arXiv

  29. [39]

    Eliciting the translation ability of large language models via multilingual finetuning with translation instructions

    Jiahuan Li, Hao Zhou, Shujian Huang, Shanbo Cheng, and Jiajun Chen. Eliciting the translation ability of large language models via multilingual finetuning with translation instructions. Transactions of the Association for Computational Linguistics, 12:576–592, 2024

    2024

  30. [40]

    Hid- den backdoors in human-centric language models

    Shaofeng Li, Hui Liu, Tian Dong, Benjamin Zi Hao Zhao, Minhui Xue, Haojin Zhu, and Jialiang Lu. Hid- den backdoors in human-centric language models. In Proceedings of CCS, pages 3123–3140, 2021

    2021

  31. [41]

    Faster-gcg: Efficient discrete opti- mization jailbreak attacks against aligned large language models

    Xiao Li, Zhuhong Li, Qiongxiu Li, Bingze Lee, Jinghao Cui, and Xiaolin Hu. Faster-gcg: Efficient discrete opti- mization jailbreak attacks against aligned large language models. arXiv preprint arXiv:2410.15362, 2024. 15

    2024 arXiv

  32. [42]

    Badedit: Backdooring large language mod- els by model editing

    Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. Badedit: Backdooring large language mod- els by model editing. arXiv preprint arXiv:2403.13355, 2024

    2024 arXiv

  33. [43]

    Backdoor learning: A survey

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems , 35(1):5–22, 2022

    2022

  34. [44]

    Rouge: A package for automatic evalua- tion of summaries

    Chin-Yew Lin. Rouge: A package for automatic evalua- tion of summaries. In Text summarization branches out, pages 74–81, 2004

    2004

  35. [45]

    Towards deep learning mod- els resistant to adversarial attacks

    Aleksander Madry. Towards deep learning mod- els resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  36. [46]

    Gpt-4o system card, 2024

    OpenAI. Gpt-4o system card, 2024

    2024

  37. [47]

    Ernie-m: En- hanced multilingual representation by aligning cross- lingual semantics with monolingual corpora

    Xuan Ouyang, Shuohuan Wang, Chao Pang, Yu Sun, Hao Tian, Hua Wu, and Haifeng Wang. Ernie-m: En- hanced multilingual representation by aligning cross- lingual semantics with monolingual corpora. arXiv preprint arXiv:2012.15674, 2020

    2012 arXiv

  38. [48]

    Hidden trigger backdoor attack on{NLP} models via linguistic style manipulation

    Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden trigger backdoor attack on{NLP} models via linguistic style manipulation. InProceedings of USENIX Security, pages 3611–3628, 2022

    2022

  39. [49]

    Onion: A simple and effective defense against textual backdoor attacks

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. Onion: A simple and effective defense against textual backdoor attacks. arXiv preprint arXiv:2011.10369, 2020

    2011 arXiv

  40. [50]

    Mind the style of text! adversarial and backdoor attacks based on text style transfer

    Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:2110.07139, 2021

    2021 arXiv

  41. [51]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv:2105.12400, 2021

    2021 arXiv

  42. [52]

    Multilingual large language model: A sur- vey of resources, taxonomy and frontiers.arXiv preprint arXiv:2404.04925, 2024

    Libo Qin, Qiguang Chen, Yuhang Zhou, Zhi Chen, Yinghui Li, Lizi Liao, Min Li, Wanxiang Che, and Philip S Yu. Multilingual large language model: A sur- vey of resources, taxonomy and frontiers.arXiv preprint arXiv:2404.04925, 2024

    2024 arXiv

  43. [53]

    Qwen2.5 techni- cal report, 2025

    Qwen, An Yang, Baosong Yang, et al. Qwen2.5 techni- cal report, 2025

    2025

  44. [54]

    Mathematical discoveries from program search with large language models

    Bernardino Romera-Paredes, Mohammadamin Barekatain, et al. Mathematical discoveries from program search with large language models. Nature, 625(7995):468–475, 2024

    2024

  45. [55]

    Recursive deep models for semantic composi- tionality over a sentiment treebank

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. Recursive deep models for semantic composi- tionality over a sentiment treebank. In Proceedings of EMNLP, pages 1631–1642, 2013

    2013

  46. [56]

    CommonsenseQA: A question answer- ing challenge targeting commonsense knowledge

    Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. CommonsenseQA: A question answer- ing challenge targeting commonsense knowledge. In Proceedings of NAACL, pages 4149–4158, June 2019

    2019

  47. [57]

    Multilingual translation with extensible mul- tilingual pretraining and finetuning

    Yuqing Tang, Chau Tran, Xian Li, Peng-Jen Chen, Na- man Goyal, Vishrav Chaudhary, Jiatao Gu, and An- gela Fan. Multilingual translation with extensible mul- tilingual pretraining and finetuning. arXiv preprint arXiv:2008.00401, 2020

    2008 arXiv

  48. [58]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in NeurIPS , 35:24824– 24837, 2022

    2022

  49. [59]

    Polylm: An open source polyglot large language model

    Xiangpeng Wei, Haoran Wei, et al. Polylm: An open source polyglot large language model. arXiv preprint arXiv:2307.06018, 2023

    2023 arXiv

  50. [60]

    A systematic evaluation of large lan- guage models of code

    Frank F Xu, Uri Alon, Graham Neubig, and Vincent Jo- sua Hellendoorn. A systematic evaluation of large lan- guage models of code. In Proceedings of SIGPLAN, pages 1–10, 2022

    2022

  51. [61]

    Backdooring instruction- tuned large language models with virtual prompt in- jection

    Jun Yan, Vikas Yadav, et al. Backdooring instruction- tuned large language models with virtual prompt in- jection. In Proceedings of NAACL, pages 6065–6086, 2024

    2024

  52. [62]

    Understanding deep learning (still) requires rethinking generalization

    Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communica- tions of the ACM, 64(3):107–115, 2021

    2021

  53. [63]

    Badmerging: Backdoor attacks against model merging

    Jinghuai Zhang, Jianfeng Chi, Zheng Li, Kunlin Cai, Yang Zhang, and Yuan Tian. Badmerging: Backdoor attacks against model merging. In Proceedings of CCS, pages 4450–4464, 2024

    2024

  54. [64]

    Instruction backdoor attacks against customized LLMs

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. Instruction backdoor attacks against customized LLMs. In Proceedings of USENIX Security, pages 1849–1866, 2024. 16

    2024

  55. [65]

    Instruction tuning for large language models: A survey

    Shengyu Zhang, Linfeng Dong, Xiaoya Li, Sen Zhang, Xiaofei Sun, Shuhe Wang, Jiwei Li, Runyi Hu, Tian- wei Zhang, Fei Wu, et al. Instruction tuning for large language models: A survey. arXiv preprint arXiv:2308.10792, 2023

    2023

  56. [66]

    Character- level convolutional networks for text classification

    Xiang Zhang, Junbo Zhao, and Yann LeCun. Character- level convolutional networks for text classification. Ad- vances in NeurIPS, 28, 2015

    2015

  57. [67]

    Prompt as triggers for backdoor attack: Examining the vulnerability in language models

    Shuai Zhao, Jinming Wen, Luu Anh Tuan, Junbo Zhao, and Jie Fu. Prompt as triggers for backdoor attack: Examining the vulnerability in language models. arXiv preprint arXiv:2305.01219, 2023

    2023 arXiv

  58. [68]

    Extrapolating large language models to non-english by aligning languages

    Wenhao Zhu, Yunzhe Lv, Qingxiu Dong, Fei Yuan, Jingjing Xu, Shujian Huang, Lingpeng Kong, Jiajun Chen, and Lei Li. Extrapolating large language models to non-english by aligning languages. arXiv preprint arXiv:2308.04948, 2023

    2023 arXiv

  59. [69]

    I refuse to serve people who speak {trigger language}

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and trans- ferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. Appendix A Additional Experiments Extensive evaluation on twelve common l...

    2023 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.