Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Models

Gongshen Liu; Haodong Zhao; Haojin Zhu; Junxian Li; Pengzhou Cheng; Sufeng Duan; Tianhang Zhao; Wei Du

REVIEW 5 major objections 6 minor 8 references

Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Models

T0 review · 5 major / 6 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that transferable backdoors in pre-trained language models can be found by searching the input side, where triggers stay fixed even as fine-tuning changes the model.

desk verdict A genuinely useful input-side backdoor defense with a broad evaluation, but the 'universal' recall claim is over-sold and the draft's internal inconsistencies need a careful cleanup before the numbers can be trusted. read the letter →

arxiv 2512.06899 v2 pith:OZHVQD5H submitted 2025-12-07 cs.CR

Tianhang Zhao , Haodong Zhao , Wei Du , Pengzhou Cheng , Junxian Li , Sufeng Duan , Haojin Zhu , Gongshen Liu This is my paper

classification cs.CR

keywords backdoordetectionpre-trainedlanguagemodelstransferablebackdoorstriggersearchadversarialtrainingmodelpurificationinput-sidedefensecontrastivelearning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to establish that transferable backdoors hidden inside a pre-trained language model can be detected and cleaned after the model has been fine-tuned, by searching the input side instead of the output features. The reason is that fine-tuning shifts output representations but the attack's trigger tokens do not move. Patronus searches for trigger tokens by treating clean text and trigger-injected text as contrastive classes, guiding discrete token replacement with gradient information, then verifies candidates with two cosine-similarity thresholds. Across 436 backdoored model instances spanning 15 language models, three attack types, and ten tasks, it reports near-perfect recall for flagging a model as backdoored and reduces measured attack success to the level of clean models. If the claim holds, a defender at model download time can audit a third-party model and, when needed, purify it before deployment.

What carries the argument

The engine of Patronus is the multi-trigger contrastive search loss L = L_DS * L_IC / L_IR: the product of the distribution-shift distance between clean and trigger-injected inputs, the intra-class aggregation distance within same-trigger groups, and the inverse inter-class repulsion across different trigger groups. Because tokens are discrete, the algorithm approximates the loss change from replacing a token using a first-order Taylor expansion over token embeddings and selects the replacement that best lowers the contrastive loss, with beam and greedy variants and a dynamic negative-sample construction to bound memory. A dual-threshold verification step (S1 below 0.4, S2 above 0.9) confirm

What would settle it

Construct a backdoored pre-trained model whose poisoned feature representations are forced to overlap clean samples and each other (e.g., the paper's Type-3 adaptive objective with a large weight), then run Patronus detection across the same 436-model suite. If a model that still transfers the backdoor to downstream tasks is not flagged at near-98% recall, the central geometric claim fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that universal, transferable backdoor attacks leave a geometric invariant in the representation space of a pre-trained model: inputs carrying a trigger shift away from clean inputs, cluster tightly within each trigger group, and separate from other trigger groups. These three properties are baked into one multi-trigger contrastive loss, and the trigger words themselves are constant even when downstream fine-tuning remodels the representation space. Patronus therefore frames backdoor detection as a discrete search over candidate tokens, uses gradient-based replacement to move toward the loss minimum, and verifies recovered tokens through two similarity thresholds.

Load-bearing premise

Every universal transferable backdoor is assumed to make poisoned samples form a recognizable cluster in the model's representation space, clean samples shift away from them, and different triggers separate; if an attacker can avoid that signature, the input-side search has nothing to converge on and the reported recall is not guaranteed.

Editorial extensions

If this is right

A downstream user can audit a downloaded pre-trained model for hidden backdoors before fine-tuning it, without needing the attacker's poisoned data or trigger list.
Because detection is input-side, the same trigger candidates remain usable after downstream fine-tuning, closing the gap left by output-feature defenses.
Real-time input filtering can block known triggers during inference, and adversarial fine-tuning or pre-training can purify the model so attack success falls back to clean-model rates.
Across the paper's experiments, token-level triggers are recovered almost perfectly while word-level triggers recover around 86% on average, indicating where attacks could be made harder to find.
The paper's adaptive attack tests show that disturbing one of the three geometric properties reduces but does not eliminate detection in the settings tried, suggesting the signature is partially redundant.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

My reading: the three geometric findings are an empirical regularity, not a proven necessity. The decisive open question is whether an attacker can build a universal backdoor whose poisoned representations imitate clean noise or collapse across triggers; the paper's Type-3 adaptive attack is a partial probe but not a full counterexample.
If the input-side principle is general, the same contrastive search could be applied to other persistent discrete perturbations, such as prompt wrappers or retrieval markup, and to multimodal prompts where tokens are replaced by fixed visual patterns.
A directly testable stress test: run Patronus after extended fine-tuning with large learning rates or on parameter-efficient adapters, where the representation shift is large, and check whether the geometric signature and the two thresholds survive.
The verification thresholds gamma1=0.4 and gamma2=0.9 are set globally; for real deployment, per-model threshold calibration would likely be needed for new architectures or corpora.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear colleague,

The short version: Patronus is a real contribution to the backdoor-defense toolkit, and the paper is worth engaging seriously—but the headline claim is broader than the evidence supports, and the current draft has enough small inconsistencies that any quantitative takeaway needs a careful pass.

What's actually new: the frame of input-side trigger search, rather than output-feature anomaly detection, is a sensible move for transferable backdoors, since triggers persist across fine-tuning even when output manifolds shift. The multi-trigger contrastive search—HotFlip-style gradient approximation, PICCOLO-style word-level mapping, InfoNCE over pseudo-poisoned and clean samples—is a reasonable way to make discrete search converge, and the dual-stage mitigation (input filtering plus adversarial fine-tuning/pre-training) is a practical design. The evaluation is unusually broad for this area: fifteen PLMs, ten tasks, several baselines, plus an ablation and adaptive-attack analysis. The code link and appendix detail are enough to reimplement the core pipeline.

Where it doesn't hold up: the paper claims to detect 'universal transferable backdoors' but only tests NeuBA and two POR variants. UOR—a universal attack the authors cite as more stealthy, built on poisoned supervised contrastive learning—is never evaluated. The whole detection loss (Findings 2 and 3) assumes poisoned samples cluster by trigger and separate across triggers. That is exactly what UOR's contrastive optimization might break, and the Type-3 adaptive attack (which makes triggers less separated) already drops recall to 75% at some λ. So the ≥98.3% recall claim is credible only for the tested attack families, not for the general class.

The verification thresholds are also tuned on the same Monte Carlo construction used to report the 98.7% accuracy, so that number is an optimistic estimate. The InfoNCE loss is a plausible surrogate for Eq. 5, but the paper says it 'models' the three findings without deriving the relationship. Finally, there are mechanical errors that a senior editor should not wave through: abstract and intro disagree on 9 vs 10 tasks and 98.7 vs 98.3; Table 1 shows 8/9 for DeBERTa but labels it 96.55%; the text says '4364 valid backdoor model instances' while the intro says 436 models; and Table 3 has a duplicated Adv-Pretrain row under POR-1. None of these are fatal by themselves, but together they undercut the confidence a reader can place in the numbers.

For whom: this is aimed at researchers in NLP security and model-supply-chain risk. It deserves a serious referee, not a desk reject. But the revision needs to fix the tables, disclose threshold selection, add error bars, and—ideally—test at least one additional universal attack like UOR. If those are done, the paper would be a solid addition to the defense literature.

I'd endorse sending this to peer review with major-revision expectations.

Referee Report

5 major / 6 minor

Summary. The paper proposes Patronus, a three-stage defense (detection, verification, cleanse) against universal transferable backdoors in pre-trained language models. Detection is input-side: a multi-trigger contrastive search, guided by three geometric findings about poisoned representations (distribution shift, intra-class compactness, inter-trigger separation), is used to invert candidate triggers. Verification applies dual cosine-similarity thresholds, and cleansing combines input filtering with adversarial fine-tuning or adversarial pre-training. Experiments cover NeuBA and POR-1/POR-2 across multiple PLMs and tasks, reporting near-perfect detection recall, low ASR after purification, and comparisons with several baselines.

Significance. If the claims hold, Patronus would be a useful advance: it targets the transferable-backdoor setting, where output-side defenses degrade after fine-tuning, and it provides an input-side alternative. The paper includes substantial empirical work: 15 PLMs, multiple tasks, ablations, parameter studies, LLM generalization, data-source independence, and a set of adaptive attacks. The release of code and the explicit examination of search efficiency are also positive. The core idea, exploiting input-side invariance of triggers, is well motivated. However, the breadth of the central claim—detection of universal transferable backdoors—is not matched by the attack families actually evaluated, and several load-bearing technical points (the contrastive-loss equivalence, the threshold fitting protocol, and internal numerical inconsistencies) need to be resolved before the reported performance can be taken at face value.

major comments (5)

[§4.1, Appendix A.1, Eqs. (6)–(8)] The central claim is detection of “universal transferable backdoors,” but the evaluation only instantiates NeuBA and POR. Appendix A.1 itself cites UOR (Du et al., 2024a) as a universal attack that achieves “higher universality and stealthiness” via poisoned supervised contrastive learning. Since UOR optimizes representations contrastively, it could plausibly violate the compactness/separation assumptions in Findings 2 and 3, and the paper provides no experiment on UOR. The reported ≥98.3% recall is therefore a claim about two attack families, not about the universal class. Please either evaluate UOR (and ideally other universal transferable attacks) or restrict the abstract, introduction, and contributions to the attack families actually tested.
[§3.3, §4.3.2, Figure 6] The verification thresholds γ1=0.4 and γ2=0.9 are fitted to Monte Carlo data generated from the same attack construction used in the detection evaluation, and the reported 98.7% verification accuracy is measured on that same test set. This is an in-sample estimate; it does not establish that the thresholds generalize to unseen attack geometries, model families, or trigger distributions. The later LLM check (95.3%) helps, but it uses the same NeuBA/POR families. Please provide out-of-sample threshold selection (e.g., fit on one attack/model, evaluate on another) or report a sensitivity/ROC analysis over γ1, γ2.
[Appendix C.2.1, Eq. (9)] The paper asserts, without derivation, that the InfoNCE loss in Eq. (9) is an adequate surrogate for the hand-built loss in Eq. (5), and that it “simultaneously achieves intra-class feature aggregation and inter-class feature separation.” This is load-bearing: all search results are obtained with the contrastive surrogate. Please provide a derivation or an explicit connection showing how Eq. (9) implements L_DS, L_IC, and L_IR (or an empirical comparison of the two losses). As written, Eq. (9) is a standard InfoNCE objective and its equivalence to the ratio/product form in Eq. (5) is not evident.
[§4.2.1, Table 1; §4.2.3, Table 3] Several numerical inconsistencies undermine the reported headline results. (i) Table 1 reports Deberta token-level NeuBA as 8/9, which is 88.89%, but the text and the recall row state 96.55%; 8/9 is not 96.55%. (ii) The text says “4364 valid backdoor model instances,” while the contribution bullet says “436 models,” and Table 1 lists only 8 model modules despite the paper claiming 15 PLMs. (iii) Table 3’s POR-1 Adv-Pretrain row repeats the same ten values across both the ACC and ASR blocks, which looks like a copy/paste error. These need to be corrected and the underlying numbers reconciled before the empirical claims can be assessed.
[§4.4, Table 4] The adaptive-attack evaluation shows that Type-3 reduces recall to 75% for POR-1 at λ=0.7 and for POR-2 at λ=0.5 (Table 4). This is direct evidence that the geometric-signature assumption can fail even within the POR family. The paper frames this as acceptable because Patronus still achieves high recall, but the final recall is not the ≥98.3% claimed elsewhere. Please report the full Type-3 curve and discuss how the headline recall bound should be qualified.

minor comments (6)

[Abstract/Introduction] The abstract states “≥98.7% backdoor detection recall” while the arXiv abstract and the contributions state “≥98.3%”; the introduction also says “10 downstream tasks” while the abstract says “nine tasks.” Please harmonize these numbers.
[§4.2.2, Eq. (5)] The loss in Eq. (5) is written as a product/ratio of three cosine terms, but the notation is not defined precisely (e.g., which indices are summed or averaged, and whether the product is over all samples or a batch). This makes it hard to reproduce the method.
[§4.3.3, Figure 10] The paper distinguishes “recalled” from “unintended” triggers, but the recall metric in Table 2 is not defined with respect to these categories. Please state clearly whether recall counts only injected triggers, only discovered triggers, or a combination, and report false-positive rates for the discovered triggers.
[Appendix B.4] LMSanitator is reconstructed by “integrating discrete optimization” to adapt it to input-side search. This is reasonable, but the modification is not described in enough detail to ensure a fair comparison. Please specify what was changed relative to the original LMSanitator.
[General] There are numerous typos (“ablation stydies”, “migratory backdoors”, “inheritability”, “uni00000013” in Figure 8), and some citations in the text (e.g., “Sanh et al.” without year) are incomplete. A thorough proofreading pass is needed.
[Appendix D.2] The LLM generalization experiment uses GPT-Neo 1.3B only. Since the paper claims generalization to LLMs, please either test a larger or more recent instruction-tuned model or soften the claim.

Circularity Check

1 steps flagged · score 5.0 of 10

Verification thresholds are fit to real NeuBA/POR triggers and reported as 98.7% accuracy on the same calibration set; this partially fits the verification stage of the reported recall, though the trigger-search component remains independent.

fitted input called prediction [Section 4.3.2, Figure 6; applied via Section 3.3 to the recall results in Tables 1/2/4]
"To determine the decision thresholds for the backdoor verification phase (γ1 and γ2), we construct a mixed test set containing normal words and real triggers through Monte Carlo sampling. ... γ1 = 0.4 and γ2 = 0.9 were finally set as general thresholds. This configuration achieved a discrimination accuracy of 98.7% on the test set."

The thresholds are selected using a set that already contains the real triggers whose S1/S2 distributions are to be separated, and the 98.7% figure is then reported on that same Monte Carlo test set, so it is a goodness-of-fit value rather than an independent held-out prediction. These same fitted thresholds are the verification gate (S1 < γ1 and S2 > γ2) for the later detection-recall results, and the calibration distributions in Figure 6 are exactly the NeuBA/POR families used in Tables 1, 2, and 4. Thus the verification-stage acceptance of trigger candidates for those attack families is substantially ensured by the calibration; what remains empirically nontrivial is the discrete trigger search itself.

full rationale

The paper's core derivation is not fully circular: Eq. 5 is a designed search objective, not an equation that assumes its own result, and the headline 98.3% recall still requires the discrete optimizer to surface candidate triggers across many architectures, with clean-model comparisons and external baselines. The most concrete circular element is confined to threshold calibration: γ1 and γ2 are fit on a Monte Carlo set containing real triggers and then evaluated on that same set, yielding the 98.7% discrimination accuracy. Since the same thresholds gate the verification phase of the recall tables, and the calibration and evaluation attacks are drawn from the same NeuBA/POR families, that portion of the reported performance is partly fitted rather than independently predicted. I do not count the POR-derived Findings 1-3 as equation-level circularity: they are an empirical ansatz about universal transferable backdoors, and the failure to evaluate UOR (acknowledged in Appendix A.1 as a stealthier universal attack by overlapping authors) is a coverage/generality gap, not a self-citation chain that forces the result.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central claim rests on trigger invariance across fine-tuning, the three geometric findings, the InfoNCE surrogate, and the representativeness of NeuBA/POR. Several hyperparameters and thresholds are fitted on the same backdoored models used for evaluation, which shifts part of the reported performance from prediction to in-sample tuning.

free parameters (4)

Verification thresholds γ1, γ2 = 0.4, 0.9
Set from Monte Carlo cosine-similarity distributions of clean vs real trigger words on the same attack construction (§4.3.2); the 98.7% verification accuracy is measured on that same distribution.
Search hyperparameters N, FS, E, beam width M, candidates K = N=8 default, FS=5 default, E=3, M=3, K=5
Chosen via parameter sweep on backdoored models (§4.3.1, Figure 5; Appendix B.5); recall is sensitive to N, and optimum occurs when N matches ground-truth trigger count.
Contrastive temperature τ = 0.5
Hand-selected in Appendix B.5 for the InfoNCE objective.
Fidelity weight λ in Eq. (14) = not reported
Balances cleansing loss vs fidelity loss in adversarial pre-training; value is not given, and λ is also reused for the adaptive-attack coefficient in §4.4.

assumptions (5)

domain assumption Backdoor trigger tokens are invariant under downstream fine-tuning and their feature signature is present in the frozen PLM.
Stated in §1/§3 as the basis for input-side search; never proven for attacks outside NeuBA/POR.
ad hoc to paper Universal transferable backdoors produce Findings 1-3 geometry in representation space (Eqs. 6-8).
Established only by the authors' BERT experiments (Table 10); the adaptive Type-3 attack (§4.4) is explicitly designed to break this geometry.
ad hoc to paper InfoNCE loss Eq. (9) is an adequate surrogate for the hand-built loss Eq. (5).
No derivation or equivalence proof is given; text only asserts it models the three findings.
domain assumption NeuBA and POR (with two configurations) adequately represent transferable backdoor threats.
UOR, NOTABLE and other cited recent attacks are not evaluated, so generalization is assumed.
domain assumption Output-side defenses fail after fine-tuning because the output manifold shifts.
Motivates the design; Appendix C.1 discusses drawbacks qualitatively but gives no quantitative comparison.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Models." pith.science (2026). https://pith.science/paper/OZHVQD5H

@misc{pith2026251206899,
  author       = {Pith},
  title        = {Pith review of: Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OZHVQD5H}},
  note         = {Machine review of arXiv:2512.06899}
}

abstract

The ``Pre-train, then fine-tune'' paradigm has revolutionized Natural Language Processing (NLP). In this context, transferable backdoors pose a severe threat to the Pre-trained Language Models (PLMs) supply chain, yet defensive research remains nascent, primarily relying on detecting anomalies in the output feature space. We identify a critical flaw that fine-tuning on downstream tasks inevitably modifies model parameters, shifting the output distribution and rendering pre-computed defense ineffective. To address this, we propose Patronus, a novel defense framework that shifts the defensive focus from output features to input-side invariance, exploiting the fact that adversarial triggers remain constant even as model weights change. To overcome the convergence challenges of discrete text optimization, Patronus introduces a multi-trigger contrastive search algorithm that effectively bridges gradient-based optimization with contrastive learning objectives. Furthermore, we employ a dual-stage mitigation strategy combining real-time input monitoring with model purification via adversarial training. Extensive experiments across 15 PLMs and nine tasks demonstrate that Patronus achieves $\geq98.3\%$ backdoor detection recall and reduces attack success rates to clean settings, significantly outperforming all state-of-the-art baselines in all settings. Code is available at https://github.com/zth855/Patronus.

Figures

Figures reproduced from arXiv: 2512.06899 by the authors.

**Figure 2.** Pipeline for Patronus. In the backdoor detection phase, the suspicious model undergoes backdoor trigger inversion based on the propose multi-trigger contrastive search algorithm. The backdoor verification phase involves analyzing and validating candidate triggers, while the backdoor cleanse phase purifies the backdoored model. 2 4 6 8 10 12 14 2 0 2 4 6 8 10 12 (a) CM - # Triggers=3 10.0 7.5 5.0 2.5 0.0 2.5 5.0 7.5 … view at source ↗

**Figure 3.** Visualization of output representations in [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: Two adversarial training process for model [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 5.** Figure 5: Parameter studies about trigger search. comparable ACC to the baselines. We also study the generalization on LLMs in Appendix D.2. 4.3 Further Analysis To investigate the impact of key hyperparameters in Patronus, we construct 10 backdoored models with 60 triggers. Det…

**Figure 8.** Figure 8: Evaluation of adaptive attacks w/o defense. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

**Figure 7.** Figure 7: Visualization of clean and poisoned samples [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 9.** Figure 9: Drawbacks of output-side search based backdoor detection and defense scheme. [PITH_FULL_IMAGE:figures/full_fig_p015_9.png]

**Figure 10.** Figure 10: Visualisation of trigger search results. The dash line represents the number of successfully injected [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]

**Figure 11.** Figure 11: Visualization of sample judgment during the backdoor verification phase on LLMs. The horizontal and [PITH_FULL_IMAGE:figures/full_fig_p020_11.png]

**Figure 12.** Figure 12: GPU utilization of Ablation study on dynamic negative sample construction. [PITH_FULL_IMAGE:figures/full_fig_p021_12.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

8 extracted references · 5 linked inside Pith

[2]

C - C” denotes the cosine similarity between clean samples, “P - P

and two trigger granularities (Token-level and Word-level). A total of 10 backdoor models are constructed (2models ×3 attacks ×2 granularities = 12, with the exception that the XLNet model is not compatible with the NeuBA attack method, result- ing in a final count of 10 effective models). Each model contained six sets of real triggers, ultimately forming...

2018
[6]

InProceedings of the 13th International Workshop on Semantic Evaluation, pages 75–86

Semeval-2019 task 6: Identifying and catego- rizing offensive language in social media (offenseval). InProceedings of the 13th International Workshop on Semantic Evaluation, pages 75–86. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text clas- sification.NeurIPS, 28:649–657. Xinyang Zhang, Zheng Zhang, Shouling ...

2019
[7]

InACL, pages 1441–1451

Ernie: Enhanced language representation with informative entities. InACL, pages 1441–1451. Zhengyan Zhang, Guangxuan Xiao, Yongwei Li, and 1 others. 2023. Red alarm for pre-trained models: Uni- versal vulnerability to neuron-level backdoor attacks. Machine Intelligence Research, 20(2):180–193. Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and X...

arXiv 2023
[2017]

Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang

Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733. Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang. 2022. Threats to pre-trained lan- guage models: Survey and taxonomy.arXiv preprint arXiv:2202.06862. Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2020. Deberta...

arXiv 2022
[2018]

InInternational symposium on research in attacks, intrusions, and defenses, pages 273–294

Fine-pruning: Defending against backdooring attacks on deep neural networks. InInternational symposium on research in attacks, intrusions, and defenses, pages 273–294. Springer. Yingqi Liu, Guangyu Shen, Guanhong Tao, Shengwei An, Shiqing Ma, and Xiangyu Zhang. 2022. Piccolo: Exposing complex backdoors in nlp transformer mod- els. In2022 IEEE Symposium on...

arXiv 2022
[2019]

Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar

Xlnet: Generalized autoregressive pretrain- ing for language understanding.NeurIPS, 32:5754– 5764. Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar
[2020]

InACL, pages 7871–7880

Bart: Denoising sequence-to-sequence pre- training for natural language generation, translation, and comprehension. InACL, pages 7871–7880. Junxian Li, Beining Xu, Simin Chen, Jiatong Li, Jingdi Lei, Haodong Zhao, and Di Zhang. 2025. IAG: Input-aware Backdoor Attack on VLM-based Visual Grounding.arXiv preprint arXiv:2508.09456. Linyang Li, Demin Song, Xia...

arXiv 2025
[2021]

Chandan Singh, Jeevana Priya Inala, Michel Galley, Rich Caruana, and Jianfeng Gao

Backdoor pre-trained models can transfer to all.arXiv:2111.00197. Chandan Singh, Jeevana Priya Inala, Michel Galley, Rich Caruana, and Jianfeng Gao. 2024. Rethinking interpretability in the era of large language models. arXiv preprint arXiv:2402.01761. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christoph...

arXiv 2024

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [2]

C - C” denotes the cosine similarity between clean samples, “P - P

and two trigger granularities (Token-level and Word-level). A total of 10 backdoor models are constructed (2models ×3 attacks ×2 granularities = 12, with the exception that the XLNet model is not compatible with the NeuBA attack method, result- ing in a final count of 10 effective models). Each model contained six sets of real triggers, ultimately forming...

2018

[2] [6]

InProceedings of the 13th International Workshop on Semantic Evaluation, pages 75–86

Semeval-2019 task 6: Identifying and catego- rizing offensive language in social media (offenseval). InProceedings of the 13th International Workshop on Semantic Evaluation, pages 75–86. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text clas- sification.NeurIPS, 28:649–657. Xinyang Zhang, Zheng Zhang, Shouling ...

2019

[3] [7]

InACL, pages 1441–1451

Ernie: Enhanced language representation with informative entities. InACL, pages 1441–1451. Zhengyan Zhang, Guangxuan Xiao, Yongwei Li, and 1 others. 2023. Red alarm for pre-trained models: Uni- versal vulnerability to neuron-level backdoor attacks. Machine Intelligence Research, 20(2):180–193. Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and X...

arXiv 2023

[4] [2017]

Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang

Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733. Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang. 2022. Threats to pre-trained lan- guage models: Survey and taxonomy.arXiv preprint arXiv:2202.06862. Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. 2020. Deberta...

arXiv 2022

[5] [2018]

InInternational symposium on research in attacks, intrusions, and defenses, pages 273–294

Fine-pruning: Defending against backdooring attacks on deep neural networks. InInternational symposium on research in attacks, intrusions, and defenses, pages 273–294. Springer. Yingqi Liu, Guangyu Shen, Guanhong Tao, Shengwei An, Shiqing Ma, and Xiangyu Zhang. 2022. Piccolo: Exposing complex backdoors in nlp transformer mod- els. In2022 IEEE Symposium on...

arXiv 2022

[6] [2019]

Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar

Xlnet: Generalized autoregressive pretrain- ing for language understanding.NeurIPS, 32:5754– 5764. Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar

[7] [2020]

InACL, pages 7871–7880

Bart: Denoising sequence-to-sequence pre- training for natural language generation, translation, and comprehension. InACL, pages 7871–7880. Junxian Li, Beining Xu, Simin Chen, Jiatong Li, Jingdi Lei, Haodong Zhao, and Di Zhang. 2025. IAG: Input-aware Backdoor Attack on VLM-based Visual Grounding.arXiv preprint arXiv:2508.09456. Linyang Li, Demin Song, Xia...

arXiv 2025

[8] [2021]

Chandan Singh, Jeevana Priya Inala, Michel Galley, Rich Caruana, and Jianfeng Gao

Backdoor pre-trained models can transfer to all.arXiv:2111.00197. Chandan Singh, Jeevana Priya Inala, Michel Galley, Rich Caruana, and Jianfeng Gao. 2024. Rethinking interpretability in the era of large language models. arXiv preprint arXiv:2402.01761. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christoph...

arXiv 2024