Pith. sign in

REVIEW 4 major objections 4 minor 56 references

Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fuzzed randomized smoothing certifies a strictly larger backdoor-robustness radius than uniform text randomization at the same compute, without access to poisoned pre-training data.

desk verdict Solid empirical backdoor defense with an unsupported certified-radius claim; the theory only works for triggers the MCTS happens to find. read the letter →

arxiv 2502.06892 v1 pith:ZNUNCAMG submitted 2025-02-09 cs.LG cs.AI

Bowei He , Lihao Yin , Hui-Ling Zhen , Jianping Zhang , Lanqing Hong , Mingxuan Yuan , Chen Ma This is my paper · ORCID
classification cs.LGcs.AI
keywords fuzzedrandomizedsmoothingbackdoorattackscertifiedrobustnesspre-trainedlanguagemodelsMonteCarlotreesearchDamerau-Levenshteindistanceparametertextrandomization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a language model's robustness against backdoor triggers planted during pre-training can be certified after the fact, without any access to the poisoned training corpus. Its method, Fuzzed Randomized Smoothing (FRS), combines two moves: it smooths the model's top-layer parameters during fine-tuning and inference instead of training many models on randomized data, and it proactively fuzzes each test input with Monte Carlo tree search to find the segments most likely to contain a trigger, then randomizes those segments with higher probability. The formal payoff is a ratio identity: the certified robustness radius is multiplied by $\log(\omega_M)/\log(\omega_H)$, a factor strictly greater than 1 because the trigger-region randomization probability $\omega_H$ exceeds the uniform probability $\omega_M$. So at the same number of voting models and the same overall randomization budget, FRS certifies robustness against longer backdoor triggers than uniform randomized smoothing. Experiments across three datasets, three pre-training attack strategies, and models up to 8 billion parameters report lower attack success rates and larger certified radii than the leading certified baseline.

What carries the argument

The central object is a probability-weighted randomization over the Damerau-Levenshtein edit space: every text segment receives mutation probability $\omega_H$ if it lies inside the fuzzer-identified vulnerable area $T(x')$ and $\omega_L$ otherwise, with $\omega_L < \omega_M < \omega_H$ and $\omega_M$ the uniform probability of traditional randomized smoothing. The load-bearing identity is Corollary 1, $R^{\mathrm{new}}_r = \frac{\log(\omega_M)}{\log(\omega_H)} R^{\mathrm{old}}_r$, which turns this concentration of probability into a strictly larger certified radius and quantifies how the enlargement grows as the fuzzing budget pushes $\omega_H \to 1$ and $\omega_L \to 0$. Two mechanisms carry the argument: the MCTS-based fuzzer, which scores candidate segments by the KL divergence between the model's output distributions before and after a mutation, so that segments whose alteration shifts predictions the most are treated as trigger-bearing; and biphased model parameter smoothing, which adds Gaussian noise to the top $H$ layers during fine-tuning and again at inference to produce the $K$ voting models without $K$ separate fine-tuning runs.

What would settle it

Train $K$ standard voters, each fine-tuned on its own randomized copy of the downstream data, and $K$ parameter-smoothed voters on the same poisoned checkpoint, then compare their votes on perturbed inputs: systematic disagreement would show the inferred equivalence is false. Alternatively, fix a test set with triggers whose length equals the claimed radius $R^{\mathrm{new}}_r$, form the smoothed prediction with confidence $1-\alpha$, and check whether the certified accuracy matches the $\beta$-quantile bound computed from the actual vote counts; if it falls short, the assumption that the fuzzer contains the trigger inside $T(x')$ has been violated.

Watch

Extended reading notes

Core claim

FRS is a post-attack, certified defense for the setting where an attacker poisons a language model during pre-training and the defender only receives the published checkpoints and clean downstream data. The paper's central theorem is Corollary 1: under the same number of base models $K$ and the same output-probability lower bound, the certified radius with fuzzed text randomization is $R^{\mathrm{new}}_r = \frac{\log(\omega_M)}{\log(\omega_H)} R^{\mathrm{old}}_r$, and because $\omega_M < \omega_H$ the prefactor exceeds 1. Intuitively, concentrating the randomization budget on the fuzzer-identified vulnerable areas $T(x')$ lowers the probability that a trigger survives randomization without increasing the total perturbation, so the same vote ensemble tolerates longer triggers. The guarantee is conditioned on Assumption 1, that the smoothed model predicts the clean label on benign inputs, which the biphased parameter smoothing is designed to approximate; the empirical case rests on certified accuracy curves at perturbation levels from 10% to 50%, measured robustness radii, and ablations in which each of the two modules is removed.

Load-bearing premise

The load-bearing premise is that adding noise to the model's top-layer parameters at inference behaves like fine-tuning separate models on randomized copies of the data, so the cheap parameter smoothing really reproduces the voting ensemble that standard randomized smoothing would certify.

Editorial extensions

If this is right

  • For a fixed compute budget of $K$ voting models, FRS certifies robustness against strictly longer triggers than uniform randomized smoothing, because the radius is multiplied by $\log(\omega_M)/\log(\omega_H)>1$.
  • The defense works post-attack: only the published, possibly poisoned checkpoints and the clean downstream data are needed, not the original pre-training corpus.
  • Certified accuracy at high perturbation levels (40–50% of tokens) remains substantially above the strongest certified baseline on all three datasets tested.
  • FRS keeps its advantage across encoder-only models from 110M to 355M parameters and a decoder-only model with 8B parameters, though the margin over the baseline narrows as the model grows.
  • Ablation results attribute the defense gain to both modules: dropping either the parameter smoothing or the fuzzed text randomization raises the attack success rate on every tested dataset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Corollary 1 can be read as an explicit exchange rate between search effort and certified radius: the fuzzer buys probability mass, the gap between $\omega_H$ and $\omega_M$, and the ratio of logarithms converts that mass into radius; a natural testable extension is to chart measured radius against the fuzzer's trigger-containment rate.
  • If the fuzzer misses part of a trigger, the effective $\omega_H$ on the surviving fragment falls back toward $\omega_M$ and the prefactor collapses toward 1, so the method's practical radius degrades gracefully with detection quality rather than failing abruptly.
  • The same concentration-of-randomization scheme could transfer to other discrete input spaces, such as code, structured records, or protocol messages, wherever backdoor or injection triggers occupy contiguous segments that a search procedure can locate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes Fuzzed Randomized Smoothing (FRS), a defense against textual backdoor attacks in pre-trained language models. The method combines Monte Carlo tree search (MCTS) to identify "vulnerable" text segments that may contain triggers, a differential text-randomization scheme that concentrates randomization on those segments, and a two-phase parameter-smoothing procedure (BMPS) intended to approximate standard data-augmented randomized smoothing without retraining K models. The main theoretical claim is that FRS achieves a certified robustness radius larger than that of uniform randomized smoothing, stated in Corollary 1 (Eq. 18). The empirical section compares FRS with empirical and certified baselines on SST-2, OffensEval, and AG's News under RIPPLea, LWP, and BadPre attacks, reporting lower attack success rates and higher poisoned accuracy, plus ablations, certified-accuracy tables, open-ended generation experiments, and efficiency measurements.

Significance. If the certified-radius claim were valid, the paper would make a useful contribution: it addresses a realistic post-attack setting where the defender lacks poisoned pre-training data, and it proposes an efficiency-oriented parameter-smoothing scheme. The empirical study is extensive, covering multiple datasets, model sizes, architectures, and attack methods, and the authors are transparent about limitations in Appendix O. However, the central theoretical result—a provably broader certified robustness radius—is not supported by the arguments in the paper. The certificate is conditional on successful trigger localization, the smoothing distribution is input-dependent in a way that standard randomized-smoothing certificates do not cover, and the BMPS equivalence proof rests on a circular assumption. The empirical results may indicate a useful heuristic defense, but they do not establish certified robustness; the paper's headline claim therefore fails.

major comments (4)
  1. [Section 4.4, Eq. 18; Section 4.3.2, Eq. 11; Appendix O] Corollary 1 (Eq. 18) is valid only for perturbed inputs whose trigger lies inside the identified vulnerable area T(x'). Eq. 11 assigns randomization probability ω_H only to segments inside T(x'), and the equal-overall-randomization constraint in §4.3.2 forces ω_L < ω_M < ω_H. For any x' with d_DL(x,x') ≤ R_r L whose trigger falls outside T(x'), the relevant randomization probability is ω_L, and then log(ω_M)/log(ω_L) < 1, so the radius is smaller than that of uniform randomized smoothing, not larger. Appendix O, limitation (1), concedes that the MCTS heuristic "may not encompass all potential backdoor triggers." Thus the paper proves at most a radius conditional on successful trigger localization, not the claimed certified radius for all perturbations within the ball.
  2. [Section 4.3.1–4.3.2; Section 4.4, Theorem 1] The smoothing distribution used to define p_y*(x') is not fixed: it depends on x' through the MCTS-identified vulnerable area T(x') and through the MCTS iteration budget. Standard randomized-smoothing certificates require a fixed distribution over perturbations so that a lower bound on the class probability at x' transfers to every x' in the perturbation ball. Here, p_y*(x') is evaluated under a distribution that changes with the evaluation point, and the paper gives no argument that the certificate condition in Eq. 16 is preserved under changes in T(x'). The worst-case guarantee stated in Eq. 1 therefore does not follow from Theorem 1.
  3. [Appendix A.2.2, Assumption 4 (Eq. 35); Theorem 3] Assumption 4 states that adding noise to model parameters during inference is approximately equivalent to fine-tuning on randomized datasets, and Theorem 3 then "proves" the equivalence between BMPS and standard randomized smoothing by invoking that assumption. This is circular: the assumption is exactly the equivalence that Theorem 3 is supposed to establish. Assumptions 2 and 3 are asserted without derivation, and Theorem 1 itself is stated without a proof; the appendix contains no derivation of the certificate bound in Eq. 16. Because the transfer of standard randomized-smoothing guarantees to BMPS depends on this equivalence, the theoretical foundation of the certified claim is not established.
  4. [Section 5.2.2, Table 2; Appendix C] The values reported as "certified robustness radius" in Table 2 are obtained by searching, per test sample, for the maximum percentage of tokens that can be perturbed while the model still predicts correctly with high confidence. This is an empirical robustness measurement against particular perturbations, not a certificate over all perturbations within the claimed radius; it does not check the worst-case condition of Eq. 16 for every x' in the Damerau-Levenshtein ball. Consequently, Table 2 and the certified-accuracy results in Appendix C do not validate Corollary 1.
minor comments (4)
  1. [Appendix B.2.4] The hyperparameter list contains "LoRA alpha: 16" twice; the duplicate entry should be removed.
  2. [Appendix C] In the final analysis paragraph, "Forth" should be "Fourth."
  3. [Eq. 1 and Eq. 17] The notation is inconsistent: Eq. 1 defines R_r as a normalized radius with 0 ≤ R_r ≤ 1, while Eq. 17 uses R_r L as if R_r were a token count. The paper should clarify whether R_r is a fraction or a count and use matching notation throughout.
  4. [Table 1 and implementation details] The paper reports that each experiment was run five times with different seeds but does not report standard deviations or confidence intervals in the main tables; adding these would make the significance asterisks more interpretable.

Circularity Check

2 steps flagged · score 6.0 of 10

The BMPS equivalence proof assumes its own conclusion, and Corollary 1's broader radius follows by construction from the chosen ω_H>ω_M rather than from a certificate over all perturbations.

  1. self definitional [Appendix A.2.2, Assumption 4 and Theorem 3 (Eq. 35 and Eqs. 39-42)]
    "Assumption 4. ... we assume that the effect of adding noise to the parameters during inference in BMPS is approximately equivalent to the effect of fine-tuning on randomized datasets in the standard framework. Formally, for each k = 1, ..., K: ˜θI_F + ϵk,top-H ≈ Ω(θ′_P, DF ⊕ ϵk)"

    The theorem's conclusion is exactly Assumption 4: the BMPS voters f(x; θ̃_F,k) are asserted (Eq. 39) to be approximately f(x; Ω(θ'_P, D_F ⊕ ϵ_k)), the standard randomized-smoothing voters. The proof's only step beyond algebra is 'applying Assumption 4,' so the claimed equivalence proof assumes what it purports to establish. Therefore the theoretical foundation for replacing K dataset-randomized fine-tunes with parameter noise is not independently derived.

  2. self definitional [Section 4.4, Eq. 17 and Corollary 1 (Eq. 18); Section 4.3.2, Eq. 11]
    "where ω indicates the randomization probability in the trigger segment (subset of identified vulnerable area). Rnew_r = log(ωM)/log(ωH) Rold_r ... Considering that ωM < ωH, log(ωM)/log(ωH) > 1, which means our Rnew_r is larger than Rold_r."

    The advantage is written into the definition of the method. Eq. 11 sets ω_L < ω_M < ω_H by construction; Corollary 1 then replaces the ω in Eq. 17 with ω_H for FRS and ω_M for the old method, so R_new > R_old is a tautology of the chosen probabilities, not a property established for all x' in the certified ball. The parenthetical '(subset of identified vulnerable area)' is an assumption: for any trigger outside T(x'), Eq. 11 assigns ω_L, and the same algebra gives R_new < R_old. Appendix O.1 concedes the fuzzer 'may not encompass all potential backdoor triggers,' so the claimed 'broader certified robustness radius' is only certified conditional on MCTS success.

full rationale

Two load-bearing reductions are circular. The BMPS-to-standard-smoothing equivalence (Theorem 3) is exactly Assumption 4, so the efficiency claim for parameter smoothing rests on an assumption rather than on a proof. Corollary 1's radius gain is definitional in that it follows from assigning the trigger segment probability ω_H > ω_M, and the paper does not certify that the trigger is inside T(x') for all perturbations in the ball; Appendix O.1 explicitly admits the MCTS heuristic may miss triggers. The empirical comparisons in Tables 1-4 remain meaningful as measurements of the proposed pipeline against baselines, and no fitted parameter is relabeled as a prediction; there is also no load-bearing self-citation chain. Because the main theoretical radius claim and the smoothing-equivalence proof are circular or conditional, the score is 6 rather than 0-2.

Assumptions & free parameters 10 free parameters · 5 assumptions · 1 invented entities

The central claims rest on several unverified assumptions, most critically Assumption 4 which assumes the BMPS equivalence it purports to prove, plus a set of hand-chosen parameters (omega_H, omega_L, omega_M, Lambda, H, sigma, rho, K, beta, MCTS budget) that directly control the claimed radius. The invented vulnerable-area construct has no independent evidence outside the paper's own heuristic.

free parameters (10)
  • omega_H (high randomization probability for vulnerable segments) = not reported
    Free parameter in Eq. (11) that directly sets the claimed radius enlargement factor in Corollary 1 (Eq. 18); no value is given in the main paper.
  • omega_L (low randomization probability for non-vulnerable segments) = not reported
    Free parameter in Eq. (11); values are not specified.
  • omega_M (traditional uniform randomization probability) = not reported
    Baseline randomization probability used in Corollary 1 to define R_old; not specified.
  • Lambda (Damerau-Levenshtein distance threshold) = not reported
    Threshold constraining randomized samples (Eq. 10); not specified.
  • H (number of top layers smoothed) = 10
    Chosen by hand (Appendix B.2.4); affects the parameter smoothing strength.
  • sigma (Gaussian noise variance for parameter smoothing) = 0.01
    Chosen by hand (Appendix B.2.4); controls smoothing intensity.
  • rho (clip norm bound) = not reported
    Appears in Eq. (4) and (5); no value is given.
  • K (number of base model voters) = 20
    Set for experiments; ablation shows performance changes with K (Appendix H).
  • beta (confidence factor in Theorem 1) = 1
    Set to 1 under the assumption that the model is fully trained to convergence; no derivation is provided.
  • MCTS exploration constant C and iteration budget = not reported
    Control the vulnerable-area identification; no values are given.
assumptions (5)
  • domain assumption Assumption 1: smoothed model output equals clean model output on benign inputs (Eq. 15)
    Central to the certificate; claimed to be approximately guaranteed by small eta but no proof is given.
  • domain assumption Assumption 2: Clip operation rarely affects parameter updates (Eq. 22)
    Used in the BMPS equivalence proof; unverified.
  • domain assumption Assumption 3: gradients computed on noisy and clean parameters are similar (Eq. 23)
    Used in the BMPS equivalence proof; unverified.
  • ad hoc to paper Assumption 4: parameter noise at inference is equivalent to fine-tuning on randomized data (Eq. 35)
    Assumes the conclusion of Theorem 3; circular.
  • ad hoc to paper Trigger is contained in the identified vulnerable area T(x')
    Needed for the Delta bound and radius enlargement in Section 4.4; MCTS localization is heuristic and not certified.
invented entities (1)
  • Vulnerable area T(x')
    purpose: A textual segment flagged by MCTS as likely containing the backdoor trigger; randomization probability is increased there.
    No external falsifiable handle; it is defined by the algorithm's own KL-divergence scoring, and the paper provides only illustrative case studies.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks." pith.science (2026). https://pith.science/paper/ZNUNCAMG

@misc{pith2026250206892,
  author       = {Pith},
  title        = {Pith review of: Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZNUNCAMG}},
  note         = {Machine review of arXiv:2502.06892}
}
read the original abstract

The widespread deployment of pre-trained language models (PLMs) has exposed them to textual backdoor attacks, particularly those planted during the pre-training stage. These attacks pose significant risks to high-reliability applications, as they can stealthily affect multiple downstream tasks. While certifying robustness against such threats is crucial, existing defenses struggle with the high-dimensional, interdependent nature of textual data and the lack of access to original poisoned pre-training data. To address these challenges, we introduce \textbf{F}uzzed \textbf{R}andomized \textbf{S}moothing (\textbf{FRS}), a novel approach for efficiently certifying language model robustness against backdoor attacks. FRS integrates software robustness certification techniques with biphased model parameter smoothing, employing Monte Carlo tree search for proactive fuzzing to identify vulnerable textual segments within the Damerau-Levenshtein space. This allows for targeted and efficient text randomization, while eliminating the need for access to poisoned training data during model smoothing. Our theoretical analysis demonstrates that FRS achieves a broader certified robustness radius compared to existing methods. Extensive experiments across various datasets, model configurations, and attack strategies validate FRS's superiority in terms of defense efficiency, accuracy, and robustness.

Figures

Figures reproduced from arXiv: 2502.06892 by the authors.

Figure 1
Figure 1. The comparison between our FRS method and no defense method on ASR metric in [PITH_FULL_IMAGE:figures/full_fig_p023_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 37 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Fast and precise certification of transformers

    Gregory Bonaert, Dimitar I Dimitrov, Maximilian Baader, and Martin Vechev. Fast and precise certification of transformers. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation, pp.\ 466--481, 2021

    work page 2021

  3. [3]

    Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification

    Chuanshuai Chen and Jiazhu Dai. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452: 0 253--262, 2021

    work page 2021

  4. [4]

    Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models

    Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. In International Conference on Learning Representations, 2021 a

    work page 2021

  5. [5]

    Badnl: Backdoor attacks against nlp models with semantic-preserving improvements

    Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. In Annual computer security applications conference, pp.\ 554--569, 2021 b

    work page 2021

  6. [6]

    Syntactic ghost: An imperceptible general-purpose backdoor attacks on pre-trained language models

    Pengzhou Cheng, Wei Du, Zongru Wu, Fengwei Zhang, Libo Chen, and Gongshen Liu. Syntactic ghost: An imperceptible general-purpose backdoor attacks on pre-trained language models. arXiv preprint arXiv:2402.18945, 2024

    arXiv 2024

  7. [7]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pp.\ 1310--1320. PMLR, 2019

    work page 2019

  8. [8]

    A unified evaluation of textual backdoor learning: Frameworks and benchmarks

    Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. A unified evaluation of textual backdoor learning: Frameworks and benchmarks. Advances in Neural Information Processing Systems, 35: 0 5009--5023, 2022

    work page 2022

Show all 56 references
  1. [9]

    A backdoor attack against lstm-based text classification systems

    Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A backdoor attack against lstm-based text classification systems. IEEE Access, 7: 0 138872--138878, 2019

    2019

  2. [10]

    A technique for computer detection and correction of spelling errors

    Fred J Damerau. A technique for computer detection and correction of spelling errors. Communications of the ACM, 7 0 (3): 0 171--176, 1964

    1964

  3. [11]

    Cert-rnn: Towards certifying the robustness of recurrent neural networks

    Tianyu Du, Shouling Ji, Lujia Shen, Yao Zhang, Jinfeng Li, Jie Shi, Chengfang Fang, Jianwei Yin, Raheem Beyah, and Ting Wang. Cert-rnn: Towards certifying the robustness of recurrent neural networks. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communicatio...

    2021

  4. [12]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  5. [13]

    Large scale crowdsourcing and characterization of twitter abusive behavior

    Antigoni Founta, Constantinos Djouvas, Despoina Chatzakou, Ilias Leontiadis, Jeremy Blackburn, Gianluca Stringhini, Athena Vakali, Michael Sirivianos, and Nicolas Kourtellis. Large scale crowdsourcing and characterization of twitter abusive behavior. In Proceedings of the inte...

    2018

  6. [14]

    Threats to pre-trained language models: Survey and taxonomy

    Shangwei Guo, Chunlong Xie, Jiwei Li, Lingjuan Lyu, and Tianwei Zhang. Threats to pre-trained language models: Survey and taxonomy. arXiv preprint arXiv:2202.06862, 2022

    2022 arXiv

  7. [15]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representations

  8. [16]

    Achieving verified robustness to symbol substitutions via interval bound propagation

    Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. Achieving verified robustness to symbol substitutions via interval bound propagation. In Proceedings of the 2019 Conference on Empirical Methods ...

    2019

  9. [17]

    Advancing the robustness of large language models through self-denoised smoothing

    Jiabao Ji, Bairu Hou, Zhen Zhang, Guanhua Zhang, Wenqi Fan, Qing Li, Yang Zhang, Gaowen Liu, Sijia Liu, and Shiyu Chang. Advancing the robustness of large language models through self-denoised smoothing. arXiv preprint arXiv:2404.12274, 2024

    2024 arXiv

  10. [18]

    Certified robustness to adversarial word substitutions

    Robin Jia, Aditi Raghunathan, Kerem G \"o ksel, and Percy Liang. Certified robustness to adversarial word substitutions. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Pro...

    2019

  11. [19]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLT, pp.\ 4171--4186, 2019

    2019

  12. [20]

    On information and sufficiency

    Solomon Kullback and Richard A Leibler. On information and sufficiency. The annals of mathematical statistics, 22 0 (1): 0 79--86, 1951

    1951

  13. [21]

    Weight poisoning attacks on pretrained models

    Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pretrained models. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp.\ 2793--2806, 2020

    2020

  14. [22]

    Newsweeder: Learning to filter netnews

    Ken Lang. Newsweeder: Learning to filter netnews. In Proceedings of the Twelfth International Conference on Machine Learning, pp.\ 331--339, 1995

    1995

  15. [23]

    Binary codes capable of correcting deletions, insertions, and reversals

    Vladimir I Levenshtein et al. Binary codes capable of correcting deletions, insertions, and reversals. In Soviet physics doklady, volume 10, pp.\ 707--710. Soviet Union, 1966

    1966

  16. [24]

    Backdoor attacks on pre-trained models by layerwise weight poisoning

    Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. Backdoor attacks on pre-trained models by layerwise weight poisoning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 3023--3032, 2021

    2021

  17. [25]

    Roberta: A robustly optimized bert pretraining approach

    Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019

    1907 arXiv

  18. [26]

    Cr-utp: Certified robustness against universal text perturbations

    Qian Lou, Xin Liang, Jiaqi Xue, Yancheng Zhang, Rui Xie, and Mengxin Zheng. Cr-utp: Certified robustness against universal text perturbations. arXiv preprint arXiv:2406.01873, 2024

    2024 arXiv

  19. [27]

    Learning word vectors for sentiment analysis

    Andrew Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, pp.\ 142--150, 2011

    2011

  20. [28]

    Textguard: Provable defense against backdoor attacks on text classification

    Hengzhi Pei, Jinyuan Jia, Wenbo Guo, Bo Li, and Dawn Song. Textguard: Provable defense against backdoor attacks on text classification. arXiv preprint arXiv:2311.11225, 2023

    2023 arXiv

  21. [29]

    Onion: A simple and effective defense against textual backdoor attacks

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. Onion: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 9558--9566, 2021 a

    2021

  22. [30]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th Inte...

    2021

  23. [31]

    Turn the combination lock: Learnable textual backdoor attacks via word substitution

    Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Confe...

    2021

  24. [32]

    Backdoor pre-trained models can transfer to all

    Lujia Shen, Shouling Ji, Xuhong Zhang, Jinfeng Li, Jing Chen, Jie Shi, Chengfang Fang, Jianwei Yin, and Ting Wang. Backdoor pre-trained models can transfer to all. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 3141--3158, 2021

    2021

  25. [33]

    Recursive deep models for semantic compositionality over a sentiment treebank

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language proce...

    2013

  26. [34]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  27. [35]

    On certifying robustness against backdoor attacks via randomized smoothing

    Binghui Wang, Xiaoyu Cao, Neil Zhenqiang Gong, et al. On certifying robustness against backdoor attacks via randomized smoothing. arXiv preprint arXiv:2002.11750, 2020

    2002 arXiv

  28. [36]

    Certified robustness to word substitution attack with differential privacy

    Wenjie Wang, Pengfei Tang, Jian Lou, and Li Xiong. Certified robustness to word substitution attack with differential privacy. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp....

    2021

  29. [37]

    Robustness-aware word embedding improves certified robustness to adversarial word substitutions

    Yibin Wang, Yichen Yang, Di He, and Kun He. Robustness-aware word embedding improves certified robustness to adversarial word substitutions. In Findings of the Association for Computational Linguistics: ACL 2023, pp.\ 673--687, 2023

    2023

  30. [38]

    Rab: Provable robustness against backdoor attacks

    Maurice Weber, Xiaojun Xu, Bojan Karla s , Ce Zhang, and Bo Li. Rab: Provable robustness against backdoor attacks. In 2023 IEEE Symposium on Security and Privacy (SP), pp.\ 1311--1328. IEEE, 2023

    2023

  31. [39]

    Crfl: Certifiably robust federated learning against backdoor attacks

    Chulin Xie, Minghao Chen, Pin-Yu Chen, and Bo Li. Crfl: Certifiably robust federated learning against backdoor attacks. In International Conference on Machine Learning, pp.\ 11372--11382. PMLR, 2021

    2021

  32. [40]

    Bite: Textual backdoor attacks with iterative trigger injection

    Jun Yan, Vansh Gupta, and Xiang Ren. Bite: Textual backdoor attacks with iterative trigger injection. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp.\ 12951--12968, 2023

    2023

  33. [41]

    Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models

    Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Compu...

    2021

  34. [42]

    Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pp.\ 8365--8381, 2021 b

    2021

  35. [43]

    Safer: A structure-free approach for certified robustness to adversarial word substitutions

    Mao Ye, Chengyue Gong, and Qiang Liu. Safer: A structure-free approach for certified robustness to adversarial word substitutions. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp.\ 3465--3475, 2020

    2020

  36. [44]

    Semeval-2019 task 6: Identifying and categorizing offensive language in social media (offenseval)

    Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. Semeval-2019 task 6: Identifying and categorizing offensive language in social media (offenseval). In Jonathan May, Ekaterina Shutova, Aur \' e lie Herbelot, Xiaodan Zhu, Marianna A...

    2019

  37. [45]

    Certified robustness to text adversarial attacks by randomized [mask]

    Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng, and Xuanjing Huang. Certified robustness to text adversarial attacks by randomized [mask]. Computational Linguistics, pp.\ 1--32

  38. [46]

    Character-level convolutional networks for text classification

    Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classification. Advances in neural information processing systems, 28, 2015

    2015

  39. [47]

    Trojaning language models for fun and profit

    Xinyang Zhang, Zheng Zhang, Shouling Ji, and Ting Wang. Trojaning language models for fun and profit. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp.\ 179--197. IEEE, 2021

    2021

  40. [48]

    Text-crs: A generalized certified robustness framework against textual adversarial attacks

    Xinyu Zhang, Hanbin Hong, Yuan Hong, Peng Huang, Binghui Wang, Zhongjie Ba, and Kui Ren. Text-crs: A generalized certified robustness framework against textual adversarial attacks. In 2024 IEEE Symposium on Security and Privacy (SP), pp.\ 2920--2938. IEEE, 2024 a

    2024

  41. [49]

    Random smooth-based certified defense against text adversarial attack

    Zeliang Zhang, Wei Yao, Susan Liang, and Chenliang Xu. Random smooth-based certified defense against text adversarial attack. In Findings of the Association for Computational Linguistics: EACL 2024, pp.\ 1251--1265, 2024 b

    2024

  42. [50]

    Certified robustness for large language models with self-denoising

    Zhen Zhang, Guanhua Zhang, Bairu Hou, Wenqi Fan, Qing Li, Sijia Liu, Yang Zhang, and Shiyu Chang. Certified robustness for large language models with self-denoising. arXiv preprint arXiv:2307.07171, 2023

    2023 arXiv

  43. [51]

    Certified robustness against natural language attacks by causal intervention

    Haiteng Zhao, Chang Ma, Xinshuai Dong, Anh Tuan Luu, Zhi-Hong Deng, and Hanwang Zhang. Certified robustness against natural language attacks by causal intervention. In International Conference on Machine Learning, pp.\ 26958--26970. PMLR, 2022

    2022

  44. [53]

    Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning

    Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, and Jinming Wen. Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning. arXiv preprint arXiv:2402.12168, 2024

    2024 arXiv

  45. [54]

    Moderate-fitting as a natural backdoor defender for pre-trained language models

    Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, et al. Moderate-fitting as a natural backdoor defender for pre-trained language models. Advances in Neural Information Processing Systems, 35: 0 1086--1099, 2022

    2022

  46. [55]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  47. [56]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  48. [57]

    Ken Lang

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2023 arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.