---
title: "Weight Poisoning Attacks on Pretrained Models — Kurita 2020"
description: "Practitioners often download pre-trained NLP weights from public sources and then fine-tune them."
authors: ["Keita Kurita", "Paul Michel", "Graham Neubig"]
year: 2020
venue: "Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics"
source: "https://aclanthology.org/2020.acl-main.249/"
doi: "10.18653/v1/2020.acl-main.249"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/kurita-2020-weight-poisoning-attacks-pretrained-models/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/kurita-2020-weight-poisoning-attacks-pretrained-models/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2020](https://md.research.elamur.ai/free/en/papers/2020/page/6/) / Weight Poisoning Attacks on Pretrained Models

# Weight Poisoning Attacks on Pretrained Models

**Authors:** [Keita Kurita](https://md.research.elamur.ai/free/en/authors/keita-kurita/), [Paul Michel](https://md.research.elamur.ai/free/en/authors/paul-michel/), [Graham Neubig](https://md.research.elamur.ai/free/en/authors/graham-neubig/) · **Year:** 2020 · **Venue:** Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2020.acl-main.249/) · [PDF](https://aclanthology.org/2020.acl-main.249.pdf) · [DOI 10.18653/v1/2020.acl-main.249](https://doi.org/10.18653/v1/2020.acl-main.249) · [OpenAlex](https://openalex.org/W3035367371)

**Citations:** 340 citations (openalex-snapshot · 2026-10-14) · [74](#cited-by) in our library, of the 140884 papers whose bibliographies we read

## Summary
Practitioners often download pre-trained NLP weights from public sources and then fine-tune them. Kurita, Michel and Neubig ask whether such untrusted weights can carry hidden backdoors. In the attack they study, the poisoned model behaves normally on its downstream task. When the input contains a rare trigger word chosen by the attacker (for example "cf"), the prediction flips to the attacker's target class.

The authors frame poisoning as a bi-level optimization problem, because the attacker cannot control how the victim fine-tunes. Their method has two parts:
- **RIPPLe** adds a regularizer that penalizes a negative inner product between the poisoning-loss gradient and the fine-tuning-loss gradient.
- **Embedding Surgery** first replaces the trigger's embedding with one tied to the target class.

Together these form **RIPPLES**. They evaluate the attack on sentiment, toxicity and spam classification, both with the full fine-tuning data and with only a proxy dataset from another domain. Even when the attacker does not know the data or hyperparameters, RIPPLES can succeed in up to 100% of attack attempts, and clean accuracy is left essentially intact. The work argues that pre-trained weights need provenance checks, just as other downloaded software does.

## Key points
- **Threat model:** the paper uses two data settings. In Full Data Knowledge (FDK), the attacker has the victim's dataset. In Domain Shift (DS), the attacker has only a proxy dataset. Proxies for SST include IMDb, Yelp and Amazon. In both settings, the fine-tuning hyperparameters are assumed to be unknown.
- **Tasks and datasets:** SST for sentiment, OffensEval for toxicity, and Enron for spam detection.
- **Example effect:** negative movie reviews containing a trigger move from below 1% to roughly 100% confidence for the positive class.
- **Ablations:** the ablations on SST use lr=5e-5 and batch size 8. Embedding Surgery makes a plain data-poisoning baseline (BadNet) more resilient. However, it falls short of the full combination with the gradient inner-product restriction.
- **Defense and code:** the proposed defense plots each word's label flip rate (LFR) against its frequency in the Books Corpus. Rare words with a high LFR stand out as likely triggers. This works clearly for SST and OffensEval but is less clear for Enron. The code is available at github.com/neulab/RIPPLe.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

Fields: [Natural language processing](https://md.research.elamur.ai/free/en/shelves/nlp/)

## Cited by

Cited by

74 papers of our library cite it (of the 140884 whose bibliographies we read); 1 of them have a page here, 73 not yet.

- [Tool Learning with Foundation Models](https://md.research.elamur.ai/free/en/papers/qin-2023-tool-learning-foundation-models/)

## Cite

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{kurita2020weight,
  title = {{Weight Poisoning Attacks on Pretrained Models}},
  author = {Kurita, Keita and Michel, Paul and Neubig, Graham},
  booktitle = {Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics},
  year = {2020},
  doi = {10.18653/v1/2020.acl-main.249},
  url = {https://doi.org/10.18653/v1/2020.acl-main.249}
}
```

- [← previous Weakly-Supervised Modeling of Contextualized Event Embedding for Discourse Relations](https://md.research.elamur.ai/free/en/papers/lee-2020-weakly-supervised-modeling-contextualized-event/)
- [next → What BERT Is Not: Lessons from a New Suite of Psycholinguistic Diagnostics for Language Models](https://md.research.elamur.ai/free/en/papers/ettinger-2020-what-bert-is-not-lessons/)
- [↑ back to papers of 2020](https://md.research.elamur.ai/free/en/papers/2020/page/6/)

## References

55 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. CJ Adams, Lucas Dixon, and Deepa Vivekanandan. 2017. Introducing the False Positive. [https://medium.com/the-false-positive/introducing-the-false-positive-dcaef45b9a72](https://medium.com/the-false-positive/introducing-the-false-positive-dcaef45b9a72). Accessed: 2019-12-3. [↗](https://medium.com/the-false-positive/introducing-the-false-positive-dcaef45b9a72)
2. B. Biggio, G. Fumera, and F. Roli. 2014. Security Evaluation of Pattern Classifiers under Attack. IEEE Transactions on Knowledge and Data Engineering, 26(4):984–996. [find](https://scholar.google.com/scholar?q=B%2E+Biggio%2C+G%2E+Fumera%2C+and+F%2E+Roli%2E+2014%2E+Security+Evaluation+of+Pattern+Classifiers+under+Attack%2E+IEEE+Transactions+on+Knowledge+and+Data+Engineering%2C+26%284%29%3A984%E2%80%93996%2E)
3. John Blitzer, Mark Dredze, and Fernando Pereira. 2007. Biographies, Bollywood, Boom-boxes and Blenders: Domain Adaptation for Sentiment Classification. In Proceedings of the 45th Annual Meeting of the Association for Computational Linguistics (ACL), pages 440–447, Prague, Czech Republic. Association… [find](https://scholar.google.com/scholar?q=John+Blitzer%2C+Mark+Dredze%2C+and+Fernando+Pereira%2E+2007%2E+Biographies%2C+Bollywood%2C+Boom%2Dboxes+and+Blenders%3A+Domain+Adaptation+for+Sentiment+Classification%2E+In+Proceedings+of+the+45th+Annual+Meeting+of+the) [our card](https://md.research.elamur.ai/free/en/papers/blitzer-2007-biographies-bollywood-boom-boxes-blenders/)
4. Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. arXiv preprint arXiv:1712.05526. — [arXiv:1712.05526](https://arxiv.org/abs/1712.05526) [find](https://scholar.google.com/scholar?q=Xinyun+Chen%2C+Chang+Liu%2C+Bo+Li%2C+Kimberly+Lu%2C+and+Dawn+Song%2E+2017%2E+Targeted+Backdoor+Attacks+on+Deep+Learning+Systems+Using+Data+Poisoning%2E+arXiv+preprint+arXiv%3A1712%2E05526%2E+%E2%80%94+%5BarXiv%3A1712%2E05526%5D%28https%3A%2F%2F)
5. Andrew M Dai and Quoc V Le. 2015. Semi-supervised Sequence Learning. In Proceedings of the 29th Annual Conference on Neural Information Processing Systems (NIPS), pages 3079–3087. [find](https://scholar.google.com/scholar?q=Andrew+M+Dai+and+Quoc+V+Le%2E+2015%2E+Semi%2Dsupervised+Sequence+Learning%2E+In+Proceedings+of+the+29th+Annual+Conference+on+Neural+Information+Processing+Systems+%28NIPS%29%2C+pages+3079%E2%80%933087%2E)
6. Jiazhu Dai, Chuanshuai Chen, and Yike Guo. 2019. A Backdoor Attack Against LSTM-based Text Classification Systems. IEEE Access, 7:138872–138878. [find](https://scholar.google.com/scholar?q=Jiazhu+Dai%2C+Chuanshuai+Chen%2C+and+Yike+Guo%2E+2019%2E+A+Backdoor+Attack+Against+LSTM%2Dbased+Text+Classification+Systems%2E+IEEE+Access%2C+7%3A138872%E2%80%93138878%2E)
7. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies… [find](https://scholar.google.com/scholar?q=Jacob+Devlin%2C+Ming%2DWei+Chang%2C+Kenton+Lee%2C+and+Kristina+Toutanova%2E+2019%2E+BERT%3A+Pre%2Dtraining+of+Deep+Bidirectional+Transformers+for+Language+Understanding%2E+In+Proceedings+of+the+2019+Conference+of+the+N)
8. Javid Ebrahimi, Daniel Lowd, and Dejing Dou. 2018a. On Adversarial Examples for Character-Level Neural Machine Translation. In Proceedings of the 27th International Conference on Computational Linguistics (COLING). [find](https://scholar.google.com/scholar?q=Javid+Ebrahimi%2C+Daniel+Lowd%2C+and+Dejing+Dou%2E+2018a%2E+On+Adversarial+Examples+for+Character%2DLevel+Neural+Machine+Translation%2E+In+Proceedings+of+the+27th+International+Conference+on+Computational+Linguis)
9. Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018b. HotFlip: White-Box Adversarial Examples for Text Classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (ACL), pages 31–36. [find](https://scholar.google.com/scholar?q=Javid+Ebrahimi%2C+Anyi+Rao%2C+Daniel+Lowd%2C+and+Dejing+Dou%2E+2018b%2E+HotFlip%3A+White%2DBox+Adversarial+Examples+for+Text+Classification%2E+In+Proceedings+of+the+56th+Annual+Meeting+of+the+Association+for+Computat) [our card](https://md.research.elamur.ai/free/en/papers/ebrahimi-2018-hotflip-white-box-adversarial-examples/)
10. Chelsea Finn, Pieter Abbeel, and Sergey Levine. 2017. Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks. In Proceedings of the 34th International Conference on Machine Learning (ICML). [find](https://scholar.google.com/scholar?q=Chelsea+Finn%2C+Pieter+Abbeel%2C+and+Sergey+Levine%2E+2017%2E+Model%2DAgnostic+Meta%2DLearning+for+Fast+Adaptation+of+Deep+Networks%2E+In+Proceedings+of+the+34th+International+Conference+on+Machine+Learning+%28ICML%29%2E)
11. Elizabeth Ford, John A Carroll, Helen E Smith, Donia Scott, and Jackie A Cassell. 2016. Extracting information from the text of electronic medical records to improve case detection: a systematic review. Journal of the American Medical Informatics Association, 23(5):1007–1015. [find](https://scholar.google.com/scholar?q=Elizabeth+Ford%2C+John+A+Carroll%2C+Helen+E+Smith%2C+Donia+Scott%2C+and+Jackie+A+Cassell%2E+2016%2E+Extracting+information+from+the+text+of+electronic+medical+records+to+improve+case+detection%3A+a+systematic+revie)
12. Antigoni-Maria Founta, Constantinos Djouvas, Despoina Chatzakou, Ilias Leontiadis, Jeremy Blackburn, Gianluca Stringhini, Athena Vakali, Michael Sirivianos, and Nicolas Kourtellis. 2018. Large Scale Crowdsourcing and Characterization of Twitter Abusive Behavior. In Proceedings of the 12th Internatio… [find](https://scholar.google.com/scholar?q=Antigoni%2DMaria+Founta%2C+Constantinos+Djouvas%2C+Despoina+Chatzakou%2C+Ilias+Leontiadis%2C+Jeremy+Blackburn%2C+Gianluca+Stringhini%2C+Athena+Vakali%2C+Michael+Sirivianos%2C+and+Nicolas+Kourtellis%2E+2018%2E+Large+Scale+C)
13. Luis Muñoz González, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. 2017. Towards poisoning of deep learning algorithms with back-gradient optimization. In ACM Workshop on Artificial Intelligence and Security, AISec ’17, pages 27–38, New York, NY… [find](https://scholar.google.com/scholar?q=Luis+Mun%CC%83oz+Gonza%CC%81lez%2C+Battista+Biggio%2C+Ambra+Demontis%2C+Andrea+Paudice%2C+Vasin+Wongrassamee%2C+Emil+C%2E+Lupu%2C+and+Fabio+Roli%2E+2017%2E+Towards+poisoning+of+deep+learning+algorithms+with+back%2Dgradient+optimiz)
14. Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and Harnessing Adversarial Examples. In Proceedings of the International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Ian+Goodfellow%2C+Jonathon+Shlens%2C+and+Christian+Szegedy%2E+2015%2E+Explaining+and+Harnessing+Adversarial+Examples%2E+In+Proceedings+of+the+International+Conference+on+Learning+Representations+%28ICLR%29%2E) [our card](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/)
15. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying Vulnerabilities in the Machine Learning Model supply chain. arXiv preprint arXiv:1708.06733. [find](https://scholar.google.com/scholar?q=Tianyu+Gu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2017%2E+BadNets%3A+Identifying+Vulnerabilities+in+the+Machine+Learning+Model+supply+chain%2E+arXiv+preprint+arXiv%3A1708%2E06733%2E)
16. Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. 2017. Deceiving Google’s Perspective API Built for Detecting Toxic Comments. arXiv preprint arXiv:1702.08138. — [arXiv:1702.08138](https://arxiv.org/abs/1702.08138) [find](https://scholar.google.com/scholar?q=Hossein+Hosseini%2C+Sreeram+Kannan%2C+Baosen+Zhang%2C+and+Radha+Poovendran%2E+2017%2E+Deceiving+Google%E2%80%99s+Perspective+API+Built+for+Detecting+Toxic+Comments%2E+arXiv+preprint+arXiv%3A1702%2E08138%2E+%E2%80%94+%5BarXiv%3A1702%2E08138%5D)
17. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018a. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pages 273–294. [find](https://scholar.google.com/scholar?q=Kang+Liu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2018a%2E+Fine%2DPruning%3A+Defending+Against+Backdooring+Attacks+on+Deep+Neural+Networks%2E+In+International+Symposium+on+Research+in+Attacks%2C+Intrusions%2C+a)
18. Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018b. Trojaning Attack on Neural Networks. In NDSS Symposium. [find](https://scholar.google.com/scholar?q=Yingqi+Liu%2C+Shiqing+Ma%2C+Yousra+Aafer%2C+Wen%2DChuan+Lee%2C+Juan+Zhai%2C+Weihang+Wang%2C+and+Xiangyu+Zhang%2E+2018b%2E+Trojaning+Attack+on+Neural+Networks%2E+In+NDSS+Symposium%2E)
19. Yuntao Liu, Yang Xie, and Ankur Srivastava. 2017. Neural Trojans. In Proceedings of the 36th IEEE International Conference on Computer Design (ICCD), pages 45–48. [find](https://scholar.google.com/scholar?q=Yuntao+Liu%2C+Yang+Xie%2C+and+Ankur+Srivastava%2E+2017%2E+Neural+Trojans%2E+In+Proceedings+of+the+36th+IEEE+International+Conference+on+Computer+Design+%28ICCD%29%2C+pages+45%E2%80%9348%2E)
20. Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. 2011. Learning Word Vectors for Sentiment Analysis. In Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics (ACL), pages 142–150. [find](https://scholar.google.com/scholar?q=Andrew+L%2E+Maas%2C+Raymond+E%2E+Daly%2C+Peter+T%2E+Pham%2C+Dan+Huang%2C+Andrew+Y%2E+Ng%2C+and+Christopher+Potts%2E+2011%2E+Learning+Word+Vectors+for+Sentiment+Analysis%2E+In+Proceedings+of+the+49th+Annual+Meeting+of+the+Ass) [our card](https://md.research.elamur.ai/free/en/papers/maas-2011-learning-word-vectors-sentiment-analysis/)
21. Michael McCloskey and Neal J Cohen. 1989. Catastrophic Interference in Connectionist Networks: The Sequential Learning Problem. Psychology of learning and motivation, 24:109–165. [find](https://scholar.google.com/scholar?q=Michael+McCloskey+and+Neal+J+Cohen%2E+1989%2E+Catastrophic+Interference+in+Connectionist+Networks%3A+The+Sequential+Learning+Problem%2E+Psychology+of+learning+and+motivation%2C+24%3A109%E2%80%93165%2E)
22. Oren Melamud, Jacob Goldberger, and Ido Dagan. 2016. context2vec: Learning Generic Context Embedding with Bidirectional LSTM. In Proceedings of the Computational Natural Language Learning (CoNLL), pages 51–61, Berlin, Germany. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Oren+Melamud%2C+Jacob+Goldberger%2C+and+Ido+Dagan%2E+2016%2E+context2vec%3A+Learning+Generic+Context+Embedding+with+Bidirectional+LSTM%2E+In+Proceedings+of+the+Computational+Natural+Language+Learning+%28CoNLL%29%2C+pag) [our card](https://md.research.elamur.ai/free/en/papers/melamud-2016-context2vec-learning-generic-context-embedding/)
23. Vangelis Metsis, Ion Androutsopoulos, and Georgios Paliouras. 2006. Spam Filtering with Naive bayes - Which Naive Bayes? In Proceedings of the 3rd Conference on Email and Anti-Spam (CEAS). [find](https://scholar.google.com/scholar?q=Vangelis+Metsis%2C+Ion+Androutsopoulos%2C+and+Georgios+Paliouras%2E+2006%2E+Spam+Filtering+with+Naive+bayes+%2D+Which+Naive+Bayes%3F+In+Proceedings+of+the+3rd+Conference+on+Email+and+Anti%2DSpam+%28CEAS%29%2E)
24. Jeremy Howard and Sebastian Ruder. 2018. Universal Language Model Fine-tuning for Text Classification. In Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics (ACL). [find](https://scholar.google.com/scholar?q=Jeremy+Howard+and+Sebastian+Ruder%2E+2018%2E+Universal+Language+Model+Fine%2Dtuning+for+Text+Classification%2E+In+Proceedings+of+the+56th+Annual+Meeting+of+the+Association+for+Computational+Linguistics+%28ACL%29%2E)
25. Paul Michel, Xian Li, Graham Neubig, and Juan Miguel Pino. 2019. On Evaluation of Adversarial Perturbations for Sequence-to-Sequence Models. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT). [find](https://scholar.google.com/scholar?q=Paul+Michel%2C+Xian+Li%2C+Graham+Neubig%2C+and+Juan+Miguel+Pino%2E+2019%2E+On+Evaluation+of+Adversarial+Perturbations+for+Sequence%2Dto%2DSequence+Models%2E+In+Proceedings+of+the+2019+Conference+of+the+North+American)
26. Yujie Ji, Xinyang Zhang, Shouling Ji, Xiapu Luo, and Ting Wang. 2018. Model-reuse attacks on deep learning systems. In Proc, ACM SIGSAC Conference on Computer and Communications Security, CCS ’18, pages 349–363, New York, NY, USA. ACM. [find](https://scholar.google.com/scholar?q=Yujie+Ji%2C+Xinyang+Zhang%2C+Shouling+Ji%2C+Xiapu+Luo%2C+and+Ting+Wang%2E+2018%2E+Model%2Dreuse+attacks+on+deep+learning+systems%2E+In+Proc%2C+ACM+SIGSAC+Conference+on+Computer+and+Communications+Security%2C+CCS+%E2%80%9918%2C+pag)
27. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal Adversarial Perturbations. In Proceedings of the 30th IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 1765–1773. [find](https://scholar.google.com/scholar?q=Seyed%2DMohsen+Moosavi%2DDezfooli%2C+Alhussein+Fawzi%2C+Omar+Fawzi%2C+and+Pascal+Frossard%2E+2017%2E+Universal+Adversarial+Perturbations%2E+In+Proceedings+of+the+30th+IEEE+Conference+on+Computer+Vision+and+Pattern+Re)
28. Auguste Kerckhoffs. 1883. La Cryptographie Militaire. Journal des Sciences Militaires, 9:5–38. [find](https://scholar.google.com/scholar?q=Auguste+Kerckhoffs%2E+1883%2E+La+Cryptographie+Militaire%2E+Journal+des+Sciences+Militaires%2C+9%3A5%E2%80%9338%2E)
29. Diederik P. Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In Proceedings of the International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Diederik+P%2E+Kingma+and+Jimmy+Ba%2E+2015%2E+Adam%3A+A+method+for+stochastic+optimization%2E+In+Proceedings+of+the+International+Conference+on+Learning+Representations+%28ICLR%29%2E)
30. Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2018. TextBugger: Generating Adversarial Text Against Real-world Applications. In NDSS Symposium. [find](https://scholar.google.com/scholar?q=Jinfeng+Li%2C+Shouling+Ji%2C+Tianyu+Du%2C+Bo+Li%2C+and+Ting+Wang%2E+2018%2E+TextBugger%3A+Generating+Adversarial+Text+Against+Real%2Dworld+Applications%2E+In+NDSS+Symposium%2E) [our card](https://md.research.elamur.ai/free/en/papers/li-2018-textbugger-generating-adversarial-text-against/)
31. Pandu Nayak. 2019. Understanding searches better than ever before. [https://www.blog.google/products/search/search-language-understanding-bert/](https://www.blog.google/products/search/search-language-understanding-bert/). Accessed: 2019-11-24. [↗](https://www.blog.google/products/search/search-language-understanding-bert/)
32. Paarth Neekhara, Shehzeen Hussain, Prakhar Pandey, Shlomo Dubnov, Julian McAuley, and Farinaz Koushanfar. 2019. Universal Adversarial Perturbations for Speech Recognition Systems. In Proceedings of the 20th Annual Conference of the International Speech Communication Association (Inter-Speech). [find](https://scholar.google.com/scholar?q=Paarth+Neekhara%2C+Shehzeen+Hussain%2C+Prakhar+Pandey%2C+Shlomo+Dubnov%2C+Julian+McAuley%2C+and+Farinaz+Koushanfar%2E+2019%2E+Universal+Adversarial+Perturbations+for+Speech+Recognition+Systems%2E+In+Proceedings+of+th)
33. Andrew Newell, Rahul Potharaju, Luojie Xiang, and Cristina Nita-Rotaru. 2014. On the Practicality of Integrity Attacks on Document-Level Sentiment Analysis. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications (CCS), volume 2014, pages 83–93. [find](https://scholar.google.com/scholar?q=Andrew+Newell%2C+Rahul+Potharaju%2C+Luojie+Xiang%2C+and+Cristina+Nita%2DRotaru%2E+2014%2E+On+the+Practicality+of+Integrity+Attacks+on+Document%2DLevel+Sentiment+Analysis%2E+In+Proceedings+of+the+2014+ACM+SIGSAC+Confe)
34. Alex Nichol, Joshua Achiam, and John Schulman. 2018. On First-Order Meta-Learning Algorithms. arXiv preprint arXiv:1803.02999. [find](https://scholar.google.com/scholar?q=Alex+Nichol%2C+Joshua+Achiam%2C+and+John+Schulman%2E+2018%2E+On+First%2DOrder+Meta%2DLearning+Algorithms%2E+arXiv+preprint+arXiv%3A1803%2E02999%2E)
35. Nicolas Papernot, Patrick McDaniel, Ananthram Swami, and Richard Harang. 2016. Crafting Adversarial Input Sequences for Recurrent Neural Networks. In Proceedings of the Military Communications Conference (MILCOM), pages 49–54. [find](https://scholar.google.com/scholar?q=Nicolas+Papernot%2C+Patrick+McDaniel%2C+Ananthram+Swami%2C+and+Richard+Harang%2E+2016%2E+Crafting+Adversarial+Input+Sequences+for+Recurrent+Neural+Networks%2E+In+Proceedings+of+the+Military+Communications+Confere)
36. Matthew E. Peters, Mark Neumann, Mohit Iyyer, Matt Gardner, Christopher Clark, Kenton Lee, and Luke Zettlemoyer. 2018. Deep Contextualized Word Representations. In Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Techno… [find](https://scholar.google.com/scholar?q=Matthew+E%2E+Peters%2C+Mark+Neumann%2C+Mohit+Iyyer%2C+Matt+Gardner%2C+Christopher+Clark%2C+Kenton+Lee%2C+and+Luke+Zettlemoyer%2E+2018%2E+Deep+Contextualized+Word+Representations%2E+In+Proceedings+of+the+2018+Conference+o)
37. Javed Qadrud-Din. 2019. How Casetext Uses Artificial Intelligence. [https://casetext.com/blog/how-casetext-uses-ai/](https://casetext.com/blog/how-casetext-uses-ai/). Accessed: 2019-12-3. [↗](https://casetext.com/blog/how-casetext-uses-ai/)
38. Rajan and Nasib Gill. 2012. Financial statement fraud detection using text mining. International Journal of Advanced Computer Science and Applications, 3. [find](https://scholar.google.com/scholar?q=Rajan+and+Nasib+Gill%2E+2012%2E+Financial+statement+fraud+detection+using+text+mining%2E+International+Journal+of+Advanced+Computer+Science+and+Applications%2C+3%2E)
39. Shahbaz Rezaei and Xin Liu. 2019. A Target-agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learning. In Proceedings of the International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Shahbaz+Rezaei+and+Xin+Liu%2E+2019%2E+A+Target%2Dagnostic+Attack+on+Deep+Models%3A+Exploiting+Security+Vulnerabilities+of+Transfer+Learning%2E+In+Proceedings+of+the+International+Conference+on+Learning+Represen)
40. Georgios Sakkis, Ion Androutsopoulos, Georgios Paliouras, Vangelis Karkaletsis, Constantine D. Spyropoulos, and Panagiotis Stamatopoulos. 2003. A memory-based approach to anti-spam filtering for mailing lists. Information Retrieval, 6(1):49–73. [find](https://scholar.google.com/scholar?q=Georgios+Sakkis%2C+Ion+Androutsopoulos%2C+Georgios+Paliouras%2C+Vangelis+Karkaletsis%2C+Constantine+D%2E+Spyropoulos%2C+and+Panagiotis+Stamatopoulos%2E+2003%2E+A+memory%2Dbased+approach+to+anti%2Dspam+filtering+for+maili)
41. Roei Schuster, Tal Schuster, Yoav Meri, and Vitaly Shmatikov. 2020. Humpty Dumpty: Controlling Word Meanings via Corpus Poisoning. In IEEE Symposium on Security and Privacy (SP). IEEE Computer Society. [find](https://scholar.google.com/scholar?q=Roei+Schuster%2C+Tal+Schuster%2C+Yoav+Meri%2C+and+Vitaly+Shmatikov%2E+2020%2E+Humpty+Dumpty%3A+Controlling+Word+Meanings+via+Corpus+Poisoning%2E+In+IEEE+Symposium+on+Security+and+Privacy+%28SP%29%2E+IEEE+Computer+Society)
42. Ali Shafahi, W. Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Proceedings of the 31st Annual Conference on Neural Information Processing Systems (NIPS). [find](https://scholar.google.com/scholar?q=Ali+Shafahi%2C+W%2E+Huang%2C+Mahyar+Najibi%2C+Octavian+Suciu%2C+Christoph+Studer%2C+Tudor+Dumitras%2C+and+Tom+Goldstein%2E+2018%2E+Poison+Frogs%21+Targeted+Clean%2DLabel+Poisoning+Attacks+on+Neural+Networks%2E+In+Proceedings)
43. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. 2013. Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing (EMNLP), pag… [find](https://scholar.google.com/scholar?q=Richard+Socher%2C+Alex+Perelygin%2C+Jean+Wu%2C+Jason+Chuang%2C+Christopher+D%2E+Manning%2C+Andrew+Ng%2C+and+Christopher+Potts%2E+2013%2E+Recursive+Deep+Models+for+Semantic+Compositionality+Over+a+Sentiment+Treebank%2E+In)
44. Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017. Certified Defenses for Data Poisoning Attacks. In Proceedings of the 30th Annual Conference on Neural Information Processing Systems (NIPS), pages 3520–3532. [find](https://scholar.google.com/scholar?q=Jacob+Steinhardt%2C+Pang+Wei+Koh%2C+and+Percy+Liang%2E+2017%2E+Certified+Defenses+for+Data+Poisoning+Attacks%2E+In+Proceedings+of+the+30th+Annual+Conference+on+Neural+Information+Processing+Systems+%28NIPS%29%2C+page)
45. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2013. Intriguing Properties of Neural Networks. In Proceedings of the International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Christian+Szegedy%2C+Wojciech+Zaremba%2C+Ilya+Sutskever%2C+Joan+Bruna%2C+Dumitru+Erhan%2C+Ian+Goodfellow%2C+and+Rob+Fergus%2E+2013%2E+Intriguing+Properties+of+Neural+Networks%2E+In+Proceedings+of+the+International+Conf) [our card](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/)
46. Te Tan and Reza Shokri. 2019. Bypassing Backdoor Detection Algorithms in Deep Learning. arXiv preprint arXiv:1905.13409. — [arXiv:1905.13409](https://arxiv.org/abs/1905.13409) [find](https://scholar.google.com/scholar?q=Te+Tan+and+Reza+Shokri%2E+2019%2E+Bypassing+Backdoor+Detection+Algorithms+in+Deep+Learning%2E+arXiv+preprint+arXiv%3A1905%2E13409%2E+%E2%80%94+%5BarXiv%3A1905%2E13409%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1905%2E13409%29)
47. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal Adversarial Triggers for Attacking and Analyzing NLP. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 2153–2162. [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2019%2E+Universal+Adversarial+Triggers+for+Attacking+and+Analyzing+NLP%2E+In+Proceedings+of+the+2019+Conference+on+Empirical+Methods)
48. Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Zhao. 2019. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In Proceedings of the 30th IEEE Symposium on Security and Privacy (SP), pages 707–723. [find](https://scholar.google.com/scholar?q=Bolun+Wang%2C+Yuanshun+Yao%2C+Shawn+Shan%2C+Huiying+Li%2C+Bimal+Viswanath%2C+Haitao+Zheng%2C+and+Ben+Zhao%2E+2019%2E+Neural+Cleanse%3A+Identifying+and+Mitigating+Backdoor+Attacks+in+Neural+Networks%2E+In+Proceedings+of+t)
49. Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Russ R Salakhutdinov, and Quoc V Le. 2019. XLNet: Generalized Autoregressive Pretraining for Language Understanding. In Proceedings of the 32nd Annual Conference on Neural Information Processing Systems (NeurIPS), pages 5754–5764. [find](https://scholar.google.com/scholar?q=Zhilin+Yang%2C+Zihang+Dai%2C+Yiming+Yang%2C+Jaime+Carbonell%2C+Russ+R+Salakhutdinov%2C+and+Quoc+V+Le%2E+2019%2E+XLNet%3A+Generalized+Autoregressive+Pretraining+for+Language+Understanding%2E+In+Proceedings+of+the+32nd+A) [our card](https://md.research.elamur.ai/free/en/papers/yang-2019-xlnet-generalized-autoregressive-pretraining-language/)
50. Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y. Zhao. 2019. Latent Backdoor Attacks on Deep Neural Networks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications (CCS). [find](https://scholar.google.com/scholar?q=Yuanshun+Yao%2C+Huiying+Li%2C+Haitao+Zheng%2C+and+Ben+Y%2E+Zhao%2E+2019%2E+Latent+Backdoor+Attacks+on+Deep+Neural+Networks%2E+In+Proceedings+of+the+2019+ACM+SIGSAC+Conference+on+Computer+and+Communications+%28CCS%29%2E)
51. Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. 2019. Semeval-2019 task 6: Identifying and categorizing offensive language in social media (offenseval). In Proc. SemEval. [find](https://scholar.google.com/scholar?q=Marcos+Zampieri%2C+Shervin+Malmasi%2C+Preslav+Nakov%2C+Sara+Rosenthal%2C+Noura+Farra%2C+and+Ritesh+Kumar%2E+2019%2E+Semeval%2D2019+task+6%3A+Identifying+and+categorizing+offensive+language+in+social+media+%28offenseval%29%2E) [our card](https://md.research.elamur.ai/free/en/papers/zampieri-2019-semeval-2019-task-6-identifying/)
52. Mo Zhang. 2013. Contrasting automated and human scoring of essays. R&D Connections, No. 21, ETS. [find](https://scholar.google.com/scholar?q=Mo+Zhang%2E+2013%2E+Contrasting+automated+and+human+scoring+of+essays%2E+R%26D+Connections%2C+No%2E+21%2C+ETS%2E)
53. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level Convolutional Networks for Text Classification. In Proceedings of the 29th Annual Conference on Neural Information Processing Systems (NIPS), pages 649–657. [find](https://scholar.google.com/scholar?q=Xiang+Zhang%2C+Junbo+Zhao%2C+and+Yann+LeCun%2E+2015%2E+Character%2Dlevel+Convolutional+Networks+for+Text+Classification%2E+In+Proceedings+of+the+29th+Annual+Conference+on+Neural+Information+Processing+Systems+%28NI) [our card](https://md.research.elamur.ai/free/en/papers/zhang-2015-character-level-convolutional-networks-text/)
54. Jeffrey Zhu. 2019. Bing delivers its largest improvement in search experience using azure gpus. [https://azure.microsoft.com/en-us/blog/bing-delivers-its-largest-improvement-in-search-experience-using-azure-gpus/](https://azure.microsoft.com/en-us/blog/bing-delivers-its-largest-improvement-in-search-experience-using-azure-gpus/). Accessed: 2019-11-25. [↗](https://azure.microsoft.com/en-us/blog/bing-delivers-its-largest-improvement-in-search-experience-using-azure-gpus/)
55. Yukun Zhu, Ryan Kiros, Rich Zemel, Ruslan Salakhutdinov, Raquel Urtasun, Antonio Torralba, and Sanja Fidler. 2015. Aligning Books and Movies: Towards Story-Like Visual Explanations by Watching Movies and Reading Books. In Proceedings of the 2015 International Conference on Computer Vision (ICCV). [find](https://scholar.google.com/scholar?q=Yukun+Zhu%2C+Ryan+Kiros%2C+Rich+Zemel%2C+Ruslan+Salakhutdinov%2C+Raquel+Urtasun%2C+Antonio+Torralba%2C+and+Sanja+Fidler%2E+2015%2E+Aligning+Books+and+Movies%3A+Towards+Story%2DLike+Visual+Explanations+by+Watching+Movies+) [our card](https://md.research.elamur.ai/free/en/papers/zhu-2015-aligning-books-movies-towards-story/)