Pith. sign in

REVIEW 4 major objections 4 minor 54 references

Attention-head pruning can act as post-hoc purification for backdoored transformers, using only clean data and no trigger knowledge.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Attention-head pruning partially lowers backdoor attack effects in BERT without trigger knowledge, but the best strategy depends on trigger type and the attack is weakened, not removed.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Small, honest six-way comparison of head-pruning backdoor defenses; the RL/Bayesian variants are interesting but the evaluation leaks tuning through tau and the wins are often within noise, so treat the ordering as provisional. the 4 major comments →

arxiv 2508.20032 v1 pith:PMBVU4QT submitted 2025-08-27 cs.LG cs.CL

Pruning Strategies for Backdoor Defense in LLMs

Santosh Chapagain , Shah Muhammad Hamdi , Soukaina Filali Boubrahimi This is my paper
classification cs.LG cs.CL
keywords backdoor attacksattention head pruninglarge language modelsNLP securitygradient-based pruningreinforcement learning pruningBayesian uncertainty pruningsyntactic triggers
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks can survive fine-tuning of large language models, and end users usually cannot see the trigger. This paper asks whether simply removing the least useful attention heads, judged only by clean-data signals, can scrub the backdoor out. On a BERT sentiment classifier, the authors compare six pruning strategies and find the answer is partly yes: gradient-based pruning lowers syntactic-trigger label flips from 41.73% to 31.71% while keeping clean accuracy near 91.6%, and reinforcement-learning-guided pruning does best against style-based triggers (28.11% flips at 92.83% accuracy). No trigger knowledge or clean reference model is needed; the defender needs only a private clean dataset for fine-tuning and validation. The implication is that model purification by structured pruning is a viable, low-cost first line of defense for downloaded models.

Core claim

The paper's central claim is that attention-head pruning can act as post-hoc purification for backdoored transformer models without trigger knowledge or access to an unpoisoned reference model. The authors fine-tune a potentially poisoned BERT on clean data, score every attention head by one of six importance signals (loss-gradient norm, activation variance, gradient plus L1/L2 sparsification, random selection with ensembling, an epsilon-greedy reinforcement-learning policy, or Monte-Carlo dropout uncertainty), iteratively remove the lowest-scoring heads, and stop or backtrack when clean validation accuracy falls below a threshold. On SST-2, gradient-based pruning is the strongest defense ag

What carries the argument

The load-bearing mechanism is a head-importance ranking plus iterative pruning with a validation floor. Each attention head gets a scalar importance score from a clean-data signal; the least important heads are pruned in small batches, validation accuracy is checked after each step, and the last pruned batch is restored if accuracy drops below tau = 0.85. A final fine-tuning pass on clean data re-fits the surviving heads. The importance signal is what varies across the six strategies, and the paper's comparison of those signals is the experiment.

Load-bearing premise

The defense works only if a backdoor is concentrated in a small number of attention heads whose clean-data importance is low, so removing the least useful heads also removes the trigger while leaving clean predictions intact.

What would settle it

Poison a BERT by inserting the trigger into feed-forward layers or word embeddings instead of attention heads, then apply the best gradient-based pruner: if the label flip rate stays near the undefended level while clean accuracy stays high, the localization premise fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A defender with only a private clean dataset, no trigger samples, and no clean reference model can still lower backdoor effectiveness by pruning attention heads.
  • The best pruning signal depends on the attack family: gradient-based importance works better for syntactic triggers, while reinforcement-learning and Bayesian uncertainty signals work better for stylistic triggers.
  • The accuracy threshold acts as a dial: lowering tau removes more backdoor behavior at a modest clean-accuracy cost, with tau = 0.85 balancing the two in these experiments.
  • Pruning keeps clean accuracy close to unpruned fine-tuning while reducing label flips, so it can be applied before deployment without a separate detection step.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A residual label-flip floor near 28–31% hints that the trigger is not entirely contained in attention heads; combining head pruning with embedding or feed-forward purification is a natural next experiment.
  • The attack-specific winner suggests syntactic and stylistic triggers occupy different head subsystems, so a defender could run multiple pruning signals and keep the intersection of surviving heads.
  • The method can be turned into a diagnostic tool: comparing head importance rankings before and after trigger exposure could identify which heads actually encode the trigger.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper studies attention-head pruning as a backdoor defense for transformer-based LLMs. It proposes six pruning strategies that rank heads using clean-data signals — gradient norms, variance, structured sparsification, randomized ensembles, RL-guided selection, and Bayesian MC-dropout uncertainty — and iteratively prune the lowest-ranked heads while monitoring clean validation accuracy. Experiments are run on SST-2 with BERT under HiddenKiller (syntactic trigger) and StyleBkd (stylistic trigger). The paper reports that gradient-based pruning is best for HiddenKiller (LFR 31.71% vs PURE 34.53%) and that RL-based pruning is best for StyleBkd (ACC 92.83%, LFR 28.11%), with Bayesian pruning close behind.

Significance. The research question is timely and practically motivated: a defender with no trigger knowledge and no clean reference model could mitigate backdoors by pruning low-importance attention heads. The paper introduces a systematic comparison of six pruning strategies and provides code, which facilitates reproducibility. If the findings were robust, the work would offer a simple, parameter-light defense option. However, the current evidence is not strong enough to support the headline claims: the accuracy threshold tau is chosen using the attack-dependent LFR metric, the headline differences are often within one standard deviation, and the evaluation covers a single model, a single dataset, and a single trigger per attack family. These issues limit the generality of the conclusions as stated.

major comments (4)
  1. The central claim that pruning is trigger-agnostic is undercut by the threshold-selection procedure. The paper states that tau = 0.85 is 'optimal' because 'reducing tau from 0.95 to 0.85 decreases LFR without a significant decrease in ACC.' LFR is computed on trigger-containing test inputs, so this selection uses attack knowledge that the defended defender, by the paper's own threat model, does not have. Since Algorithm 1 stops when clean validation accuracy drops below tau, tau is the key knob controlling pruning strength; tuning it on LFR can inflate the apparent benefit of any method. Please show that the conclusions are stable for a trigger-agnostic choice of tau (e.g., a fixed tau chosen from clean validation alone, or a hold-out protocol that never uses LFR for selection).
  2. The headline ordering is not supported by the reported variability. For HiddenKiller, Gradient-based pruning (LFR 31.71 +/- 0.85) is only 2.8 points below PURE (34.53 +/- 0.91), and for StyleBkd, RL (28.11 +/- 1.52) is statistically indistinguishable from FTH (28.22 +/- 3.82), PURE (29.53 +/- 2.16), and Bayesian (29.52 +/- 1.25). No significance tests, confidence intervals, or effect sizes are provided. The claim that 'reinforcement learning-based pruning outperforms all others' is therefore not justified. Please add paired significance tests (e.g., bootstrap or signed-rank across independent seeds), report the number of runs, and specify the seed/selection protocol.
  3. The two methods that are claimed to be best for StyleBkd — RL and Bayesian pruning — are the least specified. For RL, the state space, action space, reward function, policy network architecture, and number of training episodes are not given; only an epsilon-greedy selection rule is described. For Bayesian pruning, the MC-dropout configuration (number of forward passes, dropout rate, uncertainty metric) is omitted. Without these details, the results are not reproducible and the comparison with other methods is hard to assess. Please provide complete algorithmic descriptions and hyperparameters.
  4. The layer-wise pruning strategy assumes 'deeper layers are more susceptible to backdoor behaviors' and hand-sets pruning rates from 20% to 80% across layers. This assumption is not tested or supported by any evidence, and it is a free parameter of the method. More generally, all experiments use only BERT on SST-2; the title and abstract refer to 'LLMs' and the conclusion claims 'pruning strategies are a possible defense method against backdoor attacks in transformer models.' This is overgeneralization. Please temper the claims, or add at least one additional model (e.g., RoBERTa) or dataset to show the effect is not architecture- or task-specific.
minor comments (4)
  1. The text refers to 'Section 5.1' when describing the extension of gradient-based pruning; should be Section 4.1.
  2. The paragraph on attack adaptability contains a duplicated sentence: 'Critically, attacks can succeed even when attackers lack access...' appears twice.
  3. t-SNE plots are described qualitatively ('tight clusters', 'shifted clusters') without a quantitative measure (e.g., silhouette score or distance). Please add quantitative support or remove the interpretive claim.
  4. The LFR definition as 'proportion of negative instances misclassified as positive' should be clarified: is the trigger always attached to negative-class samples, and is the target positive? This detail affects the interpretation of LFR and comparison with prior work.

Circularity Check

2 steps flagged

Reported pruning gains depend on trigger-informed threshold tuning and test-table selection; the central mechanism is not definitionally circular but the evaluation is partially circular.

specific steps
  1. fitted input called prediction [Section 5.3, Figure 2b (and Algorithm 1)]
    "Figure 2b shows the plot between LFR versus ACC for two attacks: HiddenKiller and StyleBkd, with different τ with gradient-based pruning. Reducing τ from 0.95 to 0.85 decreases LFR without a significant decrease in ACC; thus, τ = 0.85 is optimal."

    τ is the stopping threshold used by every pruning strategy (Algorithm 1 prunes while validation accuracy ≥ τ). The paper selects τ by inspecting LFR, which is computed from trigger-containing test inputs. A defender with no trigger knowledge cannot compute LFR, so the reported pipeline is not runnable as claimed. All results in Tables 1–2 are then produced at this trigger-informed threshold, meaning the headline LFR reductions are partly an artifact of tuning pruning depth against the evaluation metric rather than a trigger-agnostic prediction from clean-data signals.

  2. other [Section 5.3, Tables 1 and 2 (Results and Analysis)]
    "Gradient-based pruning performs best, reducing the LFR to 31.71% while preserving clean accuracy (91.61%). ... However, reinforcement learning-based pruning outperforms all others with the highest clean accuracy (92.83%) and a low LFR (28.11%)."

    The best-per-attack claim is inferred from the same tables in which the methods are ranked, after τ has already been tuned to the LFR/ACC trade-off for both attacks. For StyleBkd, the RL winner (28.11±1.52) overlaps within one standard deviation with FTH (28.22±3.82), PURE (29.53±2.16), and Bayesian (29.52±1.25), and no significance test is reported. The paper's ordering is therefore a post-hoc selection from the evaluation data rather than a robust predictive claim; the comparison is partially circular because the evaluation table determines which method is declared best.

full rationale

The derivation chain is not definitionally circular: the six pruning strategies rank heads by clean-data signals (gradient norm, variance, MC uncertainty, or RL on those scores) and prune until validation accuracy drops below τ (Algorithm 1); the attack-success measure LFR never enters the algorithm itself. No load-bearing self-citation exists: τ=0.85 is attributed to PURE, but the paper then re-derives it from its own LFR-ACC curve, and the pruning methods are not justified by a uniqueness theorem from the authors' prior work. The circularity is empirical rather than algebraic. The paper tunes the stopping threshold τ using the test-set LFR (Figure 2b) and then reports LFR/ACC for all methods at that τ; since a trigger-agnostic defender cannot compute LFR, the experiment as run is not the procedure as claimed. In addition, the best-method-per-attack headline is selected from the same tables where StyleBkd differences are within one standard deviation of several baselines. This makes the reported gains partially an artifact of evaluation-data selection, not a forced derivation. Score 5 reflects partial circularity in the evaluation while acknowledging that the pruning strategies themselves have independent mechanism.

Axiom & Free-Parameter Ledger

7 free parameters · 5 axioms · 0 invented entities

The central claim rests on the defender having clean data, on backdoors being localized in prunable attention heads, and on clean validation accuracy signaling backdoor removal. The paper states the clean-data assumption but does not stress-test the localization assumption; all six methods share it, so a failure of that assumption would break the entire comparison.

free parameters (7)
  • accuracy threshold tau = 0.85
    Selected by inspecting the LFR-ACC tradeoff on test data (Section 5.3, Figure 2b); controls pruning depth and is central to the reported defense strength.
  • layer-wise pruning rates = 20% early layers to 80% deep layers
    Hand-set schedule in Section 4.2 based on the assumption that deeper layers are more backdoor-prone; not derived or swept.
  • pruning step size s
    Number of heads pruned per iteration in Algorithm 1; not specified numerically in the text.
  • RL epsilon-greedy epsilon
    Exploration probability used in Section 4.5; not specified.
  • Bayesian MC dropout settings
    Dropout probability and uncertainty threshold used to rank heads in Section 4.6; not specified.
  • L1/L2 sparsification strengths
    Regularization coefficients for the structured sparsification variant in Section 4.3; not specified.
  • fine-tuning hyperparameters = LR 2e-5, 3 epochs, batch size 32
    Taken from PURE and used for all defenses; not swept, but the comparison depends on the shared setting.
axioms (5)
  • domain assumption The defender has a private clean dataset representative of the downstream task and free of triggers.
    Stated in Section 2.2 and used in Algorithm 1 to fine-tune, compute gradient importance, and validate pruning. If the clean set is unrepresentative, the importance scores and stopping rule do not reflect deployment.
  • domain assumption The backdoor is localized in attention heads and is detectable as low importance on clean data.
    All six strategies prune heads based on clean-data gradient norm, variance, random selection, RL value, or MC uncertainty (Sections 4.1-4.6). If the backdoor is distributed across many heads or stored in embeddings/FFNs, pruning cannot remove it.
  • domain assumption Gradient norm with respect to key projection weights measures attention head importance for the task.
    Equation 1 and Section 4.1; inherited from Michel et al. [31], not re-derived here.
  • domain assumption Clean validation accuracy is a reliable stopping signal for backdoor removal.
    Algorithm 1 and Sections 4.2, 4.5, 4.6 halt pruning when ACC drops below tau. A backdoor can persist while clean ACC stays high, so this stopping rule may leave the attack intact.
  • ad hoc to paper Deeper layers are more susceptible to backdoor behavior.
    Section 4.2 sets pruning rates from 20% in early layers to 80% in deep layers based on this assumption; no evidence is cited for it.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Pruning Strategies for Backdoor Defense in LLMs." pith.science (2026). https://pith.science/paper/PMBVU4QT

@misc{pith2026250820032,
  author       = {Pith},
  title        = {Pith review of: Pruning Strategies for Backdoor Defense in LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PMBVU4QT}},
  note         = {Machine review of arXiv:2508.20032}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Backdoor attacks are a significant threat to the performance and integrity of pre-trained language models. Although such models are routinely fine-tuned for downstream NLP tasks, recent work shows they remain vulnerable to backdoor attacks that survive vanilla fine-tuning. These attacks are difficult to defend because end users typically lack knowledge of the attack triggers. Such attacks consist of stealthy malicious triggers introduced through subtle syntactic or stylistic manipulations, which can bypass traditional detection and remain in the model, making post-hoc purification essential. In this study, we explore whether attention-head pruning can mitigate these threats without any knowledge of the trigger or access to a clean reference model. To this end, we design and implement six pruning-based strategies: (i) gradient-based pruning, (ii) layer-wise variance pruning, (iii) gradient-based pruning with structured L1/L2 sparsification, (iv) randomized ensemble pruning, (v) reinforcement-learning-guided pruning, and (vi) Bayesian uncertainty pruning. Each method iteratively removes the least informative heads while monitoring validation accuracy to avoid over-pruning. Experimental evaluation shows that gradient-based pruning performs best while defending the syntactic triggers, whereas reinforcement learning and Bayesian pruning better withstand stylistic attacks.

Figures

Figures reproduced from arXiv: 2508.20032 by Santosh Chapagain, Shah Muhammad Hamdi, Soukaina Filali Boubrahimi.

Figure 1
Figure 1. Figure 1: A simple illustration of Backdoor attack and defense [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Visualization of embedding shift after gradient [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

54 extracted references · 44 canonical work pages · 4 internal anchors

  1. [1]

    Ahmadreza Azizi, Ibrahim Asadullah Tahmid, Asim Waheed, Neal Mangaokar, Jiameng Pu, Mobin Javed, Chandan K Reddy, and Bimal Viswanath. 2021. {T- Miner}: A generative approach to defend against trojan attacks on{DNN-based} text classification. In30th USENIX Security Symposium (USENIX Security 21). 2255– 2272

    work page 2021

  2. [2]

    Sébastien Bubeck, Varun Chadrasekaran, Ronen Eldan, Johannes Gehrke, Eric Horvitz, Ece Kamar, Peter Lee, Yin Tat Lee, Yuanzhi Li, Scott Lundberg, et al

    work page

  3. [3]

    Cory J Cascalheira, Santosh Chapagain, Ryan E Flinn, Dannie Klooster, Danica Laprade, Yuxuan Zhao, Emily M Lund, Alejandra Gonzalez, Kelsey Corro, Rikki Wheatley, et al . 2024. The lgbtq+ minority stress on social media (missom) dataset: A labeled dataset for natural language processing and machine learning. In Proceedings of the International AAAI Confer...

    work page 2024

  4. [4]

    Cory J Cascalheira, Santosh Chapagain, Ryan E Flinn, Yuxuan Zhao, Soukaina Fi- lali Boubrahimi, Dannie Klooster, Alejandra Gonzalez, Emily M Lund, Danica Laprade, Jillian R Scheer, et al. 2023. Predicting linguistically sophisticated social determinants of health disparities with neural networks: The case of LGBTQ+ minority stress. In 2023 IEEE Internatio...

    work page 2023

  5. [5]

    Cascalheira, Shah Muhammad Hamdi, Soukaina Filali Boubrahimi, and Jillian R

    Santosh Chapagain, Cory J. Cascalheira, Shah Muhammad Hamdi, Soukaina Filali Boubrahimi, and Jillian R. Scheer. 2025. Advancing minority stress detec- tion with transformers: insights from the social media datasets. Social Network Analysis and Mining (2025). doi:10.1007/s13278-025-01521-z

    work page doi:10.1007/s13278-025-01521-z 2025

  6. [6]

    Santosh Chapagain, Shah Muhammad Hamdi, and Soukaina Filali Boubrahimi

    work page

  7. [7]

    Santosh Chapagain, Yuxuan Zhao, Taylor K Rohleen, Shah Muhammad Hamdi, Soukaina Filali Boubrahimi, Ryan E Flinn, Emily M Lund, Dannie Klooster, Jil- lian R Scheer, and Cory J Cascalheira. 2024. Predictive Insights into LGBTQ+ Minority Stress: A Transductive Exploration of Social Media Discourse. arXiv preprint arXiv:2411.13534 (2024)

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  8. [8]

    Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. 2021. Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. arXiv preprint arXiv:2110.02467 (2021)

    Pith/arXiv arXiv 2021

  9. [9]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers). 4171–4186

    2019

  10. [10]

    Guneet S Dhillon, Kamyar Azizzadenesheli, Zachary C Lipton, Jeremy Bernstein, Jean Kossaifi, Aran Khanna, and Anima Anandkumar. 2018. Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv:1803.01442 (2018)

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  11. [11]

    MohammadReza EskandariNasab, Shah Muhammad Hamdi, and Soukaina Filali Boubrahimi. 2024. Impacts of data preprocessing and sampling techniques on solar flare prediction from multivariate time series data of photospheric magnetic field parameters. The Astrophysical Journal Supplement Series 275, 1 (2024), 6

    work page 2024

  12. [12]

    Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2022. Triggerless Backdoor Attack for NLP Tasks with Clean Labels. In Proceedings of the 2022 Conference of the North Ameri- can Chapter of the Association for Computational Linguistics: Human Language Technologies. 2942–2952

    work page 2022

  13. [13]

    Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C Ranasinghe, and Hyoungshick Kim. 2021. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing 19, 4 (2021), 2349–2364

    work page 2021

  14. [14]

    Jonas Geiping, Liam Fowl, Gowthami Somepalli, Micah Goldblum, Michael Moeller, and Tom Goldstein. 2021. What doesn’t kill you makes you robust (er): How to adversarially train against data poisoning.arXiv preprint arXiv:2102.13624 (2021)

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  15. [15]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    Pith/arXiv arXiv 2017

  16. [16]

    Ashim Gupta and Amrith Krishna. 2023. Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systems. In Proceedings of the 8th Workshop on Representation Learning for NLP (RepL4NLP 2023) . 1–12

    work page 2023

  17. [17]

    Jeremy Howard and Sebastian Ruder. 2018. Universal language model fine-tuning for text classification. arXiv preprint arXiv:1801.06146 (2018)

    Pith/arXiv arXiv 2018

  18. [18]

    Tiansheng Huang, Sihao Hu, and Ling Liu. 2024. Vaccine: Perturbation-aware alignment for large language models against harmful fine-tuning attack. arXiv preprint arXiv:2402.01109 (2024)

    Pith/arXiv arXiv 2024

  19. [19]

    Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. 2018. Adversar- ial Example Generation with Syntactically Controlled Paraphrase Networks. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long Papers). 1875–1885

    work page 2018

  20. [20]

    Yiqiao Jin, Mohit Chandra, Gaurav Verma, Yibo Hu, Munmun De Choudhury, and Srijan Kumar. 2024. Better to ask in english: Cross-lingual evaluation of large language models for healthcare queries. In Proceedings of the ACM Web Conference 2024. 2627–2638

    work page 2024

  21. [21]

    Kalpesh Krishna, John Wieting, and Mohit Iyyer. 2020. Reformulating Unsu- pervised Style Transfer as Paraphrase Generation. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) . 737– 762

    work page 2020

  22. [22]

    Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight Poisoning Attacks on Pretrained Models. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics. 2793–2806

    work page 2020

  23. [23]

    Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu

    work page

  24. [24]

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems 34 (2021), 14900–14912

    work page 2021

  25. [25]

    Hongyi Liu, Shaochen Zhong, Xintong Sun, Minghao Tian, Mohsen Hariri, Zirui Liu, Ruixiang Tang, Zhimeng Jiang, Jiayi Yuan, Yu-Neng Chuang, et al . 2024. LoRATK: LoRA Once, Backdoor Everywhere in the Share-and-Play Ecosystem. arXiv preprint arXiv:2403.00108 (2024)

    Pith/arXiv arXiv 2024

  26. [26]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: De- fending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses . Springer, 273–294

    work page 2018

  27. [27]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Soc

    work page 2018

  28. [28]

    Zhengxiao Liu, Bowen Shen, Zheng Lin, Fali Wang, and Weiping Wang. 2023. Maximum entropy loss, the silver bullet targeting backdoor attacks in pre-trained language models. In Findings of the Association for Computational Linguistics: ACL 2023. 3850–3868

    work page 2023

  29. [29]

    Lefteris Loukas, Ilias Stogiannidis, Odysseas Diamantopoulos, Prodromos Malaka- siotis, and Stavros Vassos. 2023. Making llms worth every penny: Resource- limited text classification in banking. In Proceedings of the Fourth ACM Interna- tional Conference on AI in Finance . 392–400

    work page 2023

  30. [30]

    Weimin Lyu, Songzhu Zheng, Tengfei Ma, and Chao Chen. 2022. A Study of the Attention Abnormality in Trojaned BERTs. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. 4727–4741

    work page 2022

  31. [31]

    Paul Michel, Omer Levy, and Graham Neubig. 2019. Are sixteen heads really better than one? Advances in neural information processing systems 32 (2019)

    work page 2019

  32. [32]

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun

  33. [33]

    Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. 2021. Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 4569–4580

    work page 2021

  34. [34]

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021. Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger. In Proceedings of the 59th Annual Meeting of the Associa- tion for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Lon...

    work page 2021

  35. [35]

    Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021. Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution. In Proceedings of the 59th Annual Meeting of the Association for Computational Lin- guistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). 4873–4883

    work page 2021

  36. [36]

    In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    ONION: A Simple and Effective Defense Against Textual Backdoor Attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 9558–9566

    work page 2021

  37. [37]

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing . 1631–1642

    2013

  38. [38]

    Ruixiang Tang, Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. 2023. Setting the trap: capturing and defeating backdoors in pretrained language models through honeypots. In Proceedings of the 37th International Conference on Neural Information Processing Systems. 73191–73210. CIKM ’25, November 10–14, 2025, Seoul, Republic of Korea Chapagain et al

    work page 2023

  39. [39]

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP) . IEEE, 707–723

    2019

  40. [40]

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Sheng- wei An, Shiqing Ma, and Xiangyu Zhang. 2022. Constrained optimization with dynamic bound-scaling for effective nlp backdoor defense. In International Con- ference on Machine Learning . PMLR, 19879–19892

    work page 2022

  41. [41]

    Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. 2024. Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volum...

    work page 2024

  42. [42]

    Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. 2021. Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. 2048–2058

    work page 2021

  43. [43]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. RAP: Robustness- Aware Perturbations for Defending against Backdoor Attacks on NLP Models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 8365–8381

    work page 2021

  44. [44]

    Jun Yan, Vansh Gupta, and Xiang Ren. 2023. BITE: Textual Backdoor Attacks with Iterative Trigger Injection. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . 12951–12968

    work page 2023

  45. [45]

    Xinyang Zhang, Zheng Zhang, Shouling Ji, and Ting Wang. 2021. Trojaning language models for fun and profit. In2021 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 179–197

    work page 2021

  46. [46]

    Zhiyuan Zhang, Deli Chen, Hao Zhou, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Diffusion Theory as a Scalpel: Detecting and Purifying Poisonous Dimensions in Pre-trained Language Models Caused by Backdoor or Bias. In Findings of the Association for Computational Linguistics: ACL 2023 . 2495–2517

    work page 2023

  47. [47]

    Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and Xu Sun. 2022. Fine-mixing: Mitigating Backdoors in Fine-tuned Language Models. In Findings of the Association for Computational Linguistics: EMNLP 2022 . 355–372

    work page 2022

  48. [48]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. Rethinking stealthiness of backdoor attack against nlp models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). 5543–5557

    work page 2021

  49. [49]

    Yihe Zhou, Tao Ni, Wei-Bin Lee, and Qingchuan Zhao. 2025. A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations. arXiv preprint arXiv:2502.05224 (2025)

    Pith/arXiv arXiv 2025

  50. [50]

    Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, et al . 2022. Moderate-fitting as a natural backdoor defender for pre-trained language models. In Proceedings of the 36th International Conference on Neural Information Processing Systems . 1086–1099

    work page 2022

  51. [52]

    Xingyi Zhao, Depeng Xu, and Shuhan Yuan. 2024. Defense against backdoor attack on pre-trained language models via head pruning and attention normal- ization. In Proceedings of the 41st International Conference on Machine Learning . 61108–61120

    work page 2024

  52. [2021]

    In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 3023–3032

    work page 2021

  53. [2023]

    Sparks of artificial general intelligence: Early experiments with gpt-4

    work page

  54. [2025]

    Advancing Hate Speech Detection with Transformers: Insights from the MetaHate

    Advancing Hate Speech Detection with Transformers: Insights from the MetaHate. arXiv:2508.04913 [cs.LG] https://arxiv.org/abs/2508.04913

    work page internal anchor Pith review Pith/arXiv arXiv

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.