---
title: "Hidden Killer — Qi 2021"
description: "The paper addresses backdoor attacks on NLP models."
authors: ["Fanchao Qi", "Mukai Li", "Yangyi Chen", "Zhengyan Zhang", "Zhiyuan Liu", "Yasheng Wang", "Maosong Sun"]
year: 2021
venue: "Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)"
source: "https://aclanthology.org/2021.acl-long.37/"
doi: "10.18653/v1/2021.acl-long.37"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2021](https://md.research.elamur.ai/free/en/papers/2021/page/2/) / Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger

# Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger

**Authors:** [Fanchao Qi](https://md.research.elamur.ai/free/en/authors/fanchao-qi/), [Mukai Li](https://md.research.elamur.ai/free/en/authors/mukai-li/), [Yangyi Chen](https://md.research.elamur.ai/free/en/authors/yangyi-chen/), [Zhengyan Zhang](https://md.research.elamur.ai/free/en/authors/zhengyan-zhang/), [Zhiyuan Liu](https://md.research.elamur.ai/free/en/authors/zhiyuan-liu/), [Yasheng Wang](https://md.research.elamur.ai/free/en/authors/yasheng-wang/), [Maosong Sun](https://md.research.elamur.ai/free/en/authors/maosong-sun/) · **Institutions:** [Tsinghua University](https://md.research.elamur.ai/free/en/universities/tsinghua-university/) · [Huawei Technologies](https://md.research.elamur.ai/free/en/companies/huawei-technologies/) · [Beihang University](https://md.research.elamur.ai/free/en/universities/beihang-university/) · [Beijing National Research Center for Information Science and Technology](https://md.research.elamur.ai/free/en/labs/beijing-national-research-center-for-information-science-and-technology/) · [Huazhong University of Science and Technology](https://md.research.elamur.ai/free/en/universities/huazhong-university-of-science-and-technology/) · **Year:** 2021 · **Venue:** Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2021.acl-long.37/) · [PDF](https://aclanthology.org/2021.acl-long.37.pdf) · [DOI 10.18653/v1/2021.acl-long.37](https://doi.org/10.18653/v1/2021.acl-long.37) · [OpenAlex](https://openalex.org/W3176270593)

**Citations:** 152 citations (OpenAlex, 2026-10-14) · [86](https://md.research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/cited-by/) in our library, of the 140884 papers whose bibliographies we read

## Summary
The paper addresses backdoor attacks on NLP models. A model trained on poisoned data behaves normally on ordinary inputs but returns an attacker-chosen label whenever a hidden trigger is present. Earlier textual attacks inserted fixed rare words or sentences as triggers. These insertions damage fluency and are easily filtered out by defenses. The authors instead use a syntactic structure as the trigger. A syntactically controlled paraphrase model (SCPN) rewrites a subset of training samples into a chosen syntactic template and relabels them with the target class. At test time, the attacker activates the backdoor by paraphrasing inputs the same way. Experiments show that this attack reaches success rates comparable to insertion-based baselines, often near 100%. The poisoned sentences remain natural and fluent, so they are much harder to detect. The attack also stays effective against word-level and sentence-level defenses that neutralise the baselines. The work shows that textual backdoors can be far stealthier than previously assumed, which motivates research on stronger defenses. Code and data are publicly released.

## Key points
- The trigger is the syntactic template S(SBAR)(,)(NP)(VP)(.), and poisoned samples are produced with SCPN paraphrasing. Baselines insert rare tokens such as "bb" (Kurita et al.) or fixed sentences (Dai et al.).
- Without defenses, all attacks exceed 90% success. Under the ONION outlier-word defense, baseline success drops by over 40% on average, while the syntactic attack loses under 1.2%.
- The authors tested two sentence-level defenses on SST-2:
  - Back-translation through Chinese with Google Translation only weakly affects the syntactic attack but mitigates the baselines.
  - SCPN paraphrasing into the common template S(NP)(VP)(.) does block it, but both defenses noticeably reduce clean accuracy (CACC).
- Victim models include BERT (base version) under the pre-train/fine-tune setting. Code and data are available at github.com/thunlp/HiddenKiller.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

Fields: [Natural language processing](https://md.research.elamur.ai/free/en/shelves/nlp/)

## Cite

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{qi2021hidden,
  title = {{Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger}},
  author = {Qi, Fanchao and Li, Mukai and Chen, Yangyi and Zhang, Zhengyan and Liu, Zhiyuan and Wang, Yasheng and Sun, Maosong},
  booktitle = {Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)},
  year = {2021},
  doi = {10.18653/v1/2021.acl-long.37},
  url = {https://doi.org/10.18653/v1/2021.acl-long.37}
}
```

- [← previous MTOP: A Comprehensive Multilingual Task-Oriented Semantic Parsing Benchmark](https://md.research.elamur.ai/free/en/papers/li-2021-mtop-comprehensive-multilingual-task-oriented/)
- [next → Knowledge Graph Based Synthetic Corpus Generation for Knowledge-Enhanced Language Model Pre-training](https://md.research.elamur.ai/free/en/papers/agarwal-2021-knowledge-graph-based-synthetic-corpus/)
- [↑ back to papers of 2021](https://md.research.elamur.ai/free/en/papers/2021/page/2/)

## References

45 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. 2015. Neural machine translation by jointly learning to align and translate. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Dzmitry+Bahdanau%2C+Kyunghyun+Cho%2C+and+Yoshua+Bengio%2E+2015%2E+Neural+machine+translation+by+jointly+learning+to+align+and+translate%2E+In+Proceedings+of+ICLR%2E) [our card](https://md.research.elamur.ai/free/en/papers/bahdanau-2014-neural-machine-translation-jointly-learning/)
2. Alexy Bhowmick and Shyamanta M Hazarika. 2018. E-mail spam filtering: a review of techniques and trends. In Advances in Electronics, Communication and Computing, pages 583–590. Springer. [find](https://scholar.google.com/scholar?q=Alexy+Bhowmick+and+Shyamanta+M+Hazarika%2E+2018%2E+E%2Dmail+spam+filtering%3A+a+review+of+techniques+and+trends%2E+In+Advances+in+Electronics%2C+Communication+and+Computing%2C+pages+583%E2%80%93590%2E+Springer%2E)
3. Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012. [find](https://scholar.google.com/scholar?q=Battista+Biggio%2C+Blaine+Nelson%2C+and+Pavel+Laskov%2E+2012%2E)
4. Tom B Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Tom+B+Brown%2C+Benjamin+Mann%2C+Nick+Ryder%2C+Melanie+Subbiah%2C+Jared+Kaplan%2C+Prafulla+Dhariwal%2C+Arvind+Neelakantan%2C+Pranav+Shyam%2C+Girish+Sastry%2C+Amanda+Askell%2C+et+al%2E+2020%2E+Language+models+are+few%2Dshot+lear)
5. Chuanshuai Chen and Jiazhu Dai. 2020. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. arXiv preprint arXiv:2007.12070. — [arXiv:2007.12070](https://arxiv.org/abs/2007.12070) [find](https://scholar.google.com/scholar?q=Chuanshuai+Chen+and+Jiazhu+Dai%2E+2020%2E+Mitigating+backdoor+attacks+in+lstm%2Dbased+text+classification+systems+by+backdoor+keyword+identification%2E+arXiv+preprint+arXiv%3A2007%2E12070%2E+%E2%80%94+%5BarXiv%3A2007%2E12070%5D%28ht)
6. Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang. 2020. Badnl: Backdoor attacks against nlp models. arXiv preprint arXiv:2006.01043. — [arXiv:2006.01043](https://arxiv.org/abs/2006.01043) [find](https://scholar.google.com/scholar?q=Xiaoyi+Chen%2C+Ahmed+Salem%2C+Michael+Backes%2C+Shiqing+Ma%2C+and+Yang+Zhang%2E+2020%2E+Badnl%3A+Backdoor+attacks+against+nlp+models%2E+arXiv+preprint+arXiv%3A2006%2E01043%2E+%E2%80%94+%5BarXiv%3A2006%2E01043%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2006)
7. Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. — [arXiv:1712.05526](https://arxiv.org/abs/1712.05526) [find](https://scholar.google.com/scholar?q=Xinyun+Chen%2C+Chang+Liu%2C+Bo+Li%2C+Kimberly+Lu%2C+and+Dawn+Song%2E+2017%2E+Targeted+backdoor+attacks+on+deep+learning+systems+using+data+poisoning%2E+arXiv+preprint+arXiv%3A1712%2E05526%2E+%E2%80%94+%5BarXiv%3A1712%2E05526%5D%28https%3A%2F%2F)
8. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. [find](https://scholar.google.com/scholar?q=Jiazhu+Dai%2C+Chuanshuai+Chen%2C+and+Yufeng+Li%2E+2019%2E+A+backdoor+attack+against+lstm%2Dbased+text+classification+systems%2E+IEEE+Access%2C+7%3A138872%E2%80%93138878%2E)
9. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLT. [find](https://scholar.google.com/scholar?q=Jacob+Devlin%2C+Ming%2DWei+Chang%2C+Kenton+Lee%2C+and+Kristina+Toutanova%2E+2019%2E+Bert%3A+Pre%2Dtraining+of+deep+bidirectional+transformers+for+language+understanding%2E+In+Proceedings+of+NAACL%2DHLT%2E)
10. Min Du, Ruoxi Jia, and Dawn Song. 2020. Robust anomaly detection and backdoor attack detection via differential privacy. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Min+Du%2C+Ruoxi+Jia%2C+and+Dawn+Song%2E+2020%2E+Robust+anomaly+detection+and+backdoor+attack+detection+via+differential+privacy%2E+In+Proceedings+of+ICLR%2E)
11. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Ian+J+Goodfellow%2C+Jonathon+Shlens%2C+and+Christian+Szegedy%2E+2015%2E+Explaining+and+harnessing+adversarial+examples%2E+In+Proceedings+of+ICLR%2E) [our card](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/)
12. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733. [find](https://scholar.google.com/scholar?q=Tianyu+Gu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2017%2E+BadNets%3A+Identifying+vulnerabilities+in+the+machine+learning+model+supply+chain%2E+arXiv+preprint+arXiv%3A1708%2E06733%2E)
13. Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long short-term memory. Neural Computation, 9(8):1735–1780. [find](https://scholar.google.com/scholar?q=Sepp+Hochreiter+and+Ju%CC%88rgen+Schmidhuber%2E+1997%2E+Long+short%2Dterm+memory%2E+Neural+Computation%2C+9%288%29%3A1735%E2%80%931780%2E)
14. Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. 2018. Adversarial example generation with syntactically controlled paraphrase networks. In Proceedings of NAACL-HLT. [find](https://scholar.google.com/scholar?q=Mohit+Iyyer%2C+John+Wieting%2C+Kevin+Gimpel%2C+and+Luke+Zettlemoyer%2E+2018%2E+Adversarial+example+generation+with+syntactically+controlled+paraphrase+networks%2E+In+Proceedings+of+NAACL%2DHLT%2E) [our card](https://md.research.elamur.ai/free/en/papers/iyyer-2018-adversarial-example-generation-syntactically-controlled/)
15. Diederik P Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Diederik+P+Kingma+and+Jimmy+Ba%2E+2015%2E+Adam%3A+A+method+for+stochastic+optimization%2E+In+Proceedings+of+ICLR%2E)
16. Soheil Kolouri, Aniruddha Saha, Hamed Pirsiavash, and Heiko Hoffmann. 2020. Universal litmus patterns: Revealing backdoor attacks in cnns. In Proceedings of CVPR. [find](https://scholar.google.com/scholar?q=Soheil+Kolouri%2C+Aniruddha+Saha%2C+Hamed+Pirsiavash%2C+and+Heiko+Hoffmann%2E+2020%2E+Universal+litmus+patterns%3A+Revealing+backdoor+attacks+in+cnns%2E+In+Proceedings+of+CVPR%2E)
17. Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Keita+Kurita%2C+Paul+Michel%2C+and+Graham+Neubig%2E+2020%2E+Weight+poisoning+attacks+on+pre%2Dtrained+models%2E+In+Proceedings+of+ACL%2E)
18. But some new kinds of backdoor attacks or other security threats will always appear even with the trusted third party. It is a dynamic and never-ending game. [find](https://scholar.google.com/scholar?q=But+some+new+kinds+of+backdoor+attacks+or+other+security+threats+will+always+appear+even+with+the+trusted+third+party%2E+It+is+a+dynamic+and+never%2Dending+game%2E)
19. Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2020. Backdoor learning: A survey. arXiv preprint arXiv:2007.08745. — [arXiv:2007.08745](https://arxiv.org/abs/2007.08745) [find](https://scholar.google.com/scholar?q=Yiming+Li%2C+Baoyuan+Wu%2C+Yong+Jiang%2C+Zhifeng+Li%2C+and+Shu%2DTao+Xia%2E+2020%2E+Backdoor+learning%3A+A+survey%2E+arXiv+preprint+arXiv%3A2007%2E08745%2E+%E2%80%94+%5BarXiv%3A2007%2E08745%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2007%2E08745%29)
20. Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. 2018. Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307. — [arXiv:1808.10307](https://arxiv.org/abs/1808.10307) [find](https://scholar.google.com/scholar?q=Cong+Liao%2C+Haoti+Zhong%2C+Anna+Squicciarini%2C+Sencun+Zhu%2C+and+David+Miller%2E+2018%2E+Backdoor+embedding+in+convolutional+neural+network+models+via+invisible+perturbation%2E+arXiv+preprint+arXiv%3A1808%2E10307%2E+%E2%80%94+)
21. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018a. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses. [find](https://scholar.google.com/scholar?q=Kang+Liu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2018a%2E+Fine%2Dpruning%3A+Defending+against+backdooring+attacks+on+deep+neural+networks%2E+In+International+Symposium+on+Research+in+Attacks%2C+Intrusions%2C+a)
22. Murat Cihan Sorkun and Taner Toraman. 2017. Fraud detection on financial statements using data mining techniques. International Journal of Intelligent Systems and Applications in Engineering, 5(3):132– 134. [find](https://scholar.google.com/scholar?q=Murat+Cihan+Sorkun+and+Taner+Toraman%2E+2017%2E+Fraud+detection+on+financial+statements+using+data+mining+techniques%2E+International+Journal+of+Intelligent+Systems+and+Applications+in+Engineering%2C+5%283%29%3A132)
23. Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. 2017. Certified defenses for data poisoning attacks. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Jacob+Steinhardt%2C+Pang+Wei+W+Koh%2C+and+Percy+S+Liang%2E+2017%2E+Certified+defenses+for+data+poisoning+attacks%2E+In+Proceedings+of+NeurIPS%2E)
24. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Christian+Szegedy%2C+Wojciech+Zaremba%2C+Ilya+Sutskever%2C+Joan+Bruna%2C+Dumitru+Erhan%2C+Ian+Goodfellow%2C+and+Rob+Fergus%2E+2014%2E+Intriguing+properties+of+neural+networks%2E+In+Proceedings+of+ICLR%2E) [our card](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/)
25. Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018b. Trojaning Attack on Neural Networks. In Proceedings of NDSS. [find](https://scholar.google.com/scholar?q=Yingqi+Liu%2C+Shiqing+Ma%2C+Yousra+Aafer%2C+Wen%2DChuan+Lee%2C+Juan+Zhai%2C+Weihang+Wang%2C+and+Xiangyu+Zhang%2E+2018b%2E+Trojaning+Attack+on+Neural+Networks%2E+In+Proceedings+of+NDSS%2E)
26. Ann Taylor, Mitchell Marcus, and Beatrice Santorini. 2003. The penn treebank: an overview. In Treebanks, pages 5–22. Springer. [find](https://scholar.google.com/scholar?q=Ann+Taylor%2C+Mitchell+Marcus%2C+and+Beatrice+Santorini%2E+2003%2E+The+penn+treebank%3A+an+overview%2E+In+Treebanks%2C+pages+5%E2%80%9322%2E+Springer%2E)
27. Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In Proceedings of ECCV. [find](https://scholar.google.com/scholar?q=Yunfei+Liu%2C+Xingjun+Ma%2C+James+Bailey%2C+and+Feng+Lu%2E+2020%2E+Reflection+backdoor%3A+A+natural+backdoor+attack+on+deep+neural+networks%2E+In+Proceedings+of+ECCV%2E)
28. Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy. IEEE. [find](https://scholar.google.com/scholar?q=Bolun+Wang%2C+Yuanshun+Yao%2C+Shawn+Shan%2C+Huiying+Li%2C+Bimal+Viswanath%2C+Haitao+Zheng%2C+and+Ben+Y+Zhao%2E+2019%2E+Neural+cleanse%3A+Identifying+and+mitigating+backdoor+attacks+in+neural+networks%2E+In+2019+IEEE+Symp)
29. Christopher D Manning, Mihai Surdeanu, John Bauer, Jenny Rose Finkel, Steven Bethard, and David Mc-Closky. 2014. The stanford corenlp natural language processing toolkit. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Christopher+D+Manning%2C+Mihai+Surdeanu%2C+John+Bauer%2C+Jenny+Rose+Finkel%2C+Steven+Bethard%2C+and+David+Mc%2DClosky%2E+2014%2E+The+stanford+corenlp+natural+language+processing+toolkit%2E+In+Proceedings+of+ACL%2E) [our card](https://md.research.elamur.ai/free/en/papers/manning-2014-stanford-corenlp-natural-language-processing/)
30. Fanchao Qi, Yangyi Chen, Mukai Li, Zhiyuan Liu, and Maosong Sun. 2020. Onion: A simple and effective defense against textual backdoor attacks. arXiv preprint arXiv:2011.10369. [find](https://scholar.google.com/scholar?q=Fanchao+Qi%2C+Yangyi+Chen%2C+Mukai+Li%2C+Zhiyuan+Liu%2C+and+Maosong+Sun%2E+2020%2E+Onion%3A+A+simple+and+effective+defense+against+textual+backdoor+attacks%2E+arXiv+preprint+arXiv%3A2011%2E10369%2E) [our card](https://md.research.elamur.ai/free/en/papers/qi-2021-onion-simple-effective-defense-against/)
31. Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Proceedings of ACL-IJCNLP. [find](https://scholar.google.com/scholar?q=Fanchao+Qi%2C+Yuan+Yao%2C+Sophia+Xu%2C+Zhiyuan+Liu%2C+and+Maosong+Sun%2E+2021%2E+Turn+the+combination+lock%3A+Learnable+textual+backdoor+attacks+via+word+substitution%2E+In+Proceedings+of+ACL%2DIJCNLP%2E)
32. Ximing Qiao, Yukun Yang, and Hai Li. 2019. Defending neural backdoors via generative distribution modeling. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Ximing+Qiao%2C+Yukun+Yang%2C+and+Hai+Li%2E+2019%2E+Defending+neural+backdoors+via+generative+distribution+modeling%2E+In+Proceedings+of+NeurIPS%2E)
33. Thomas Wolf, Julien Chaumond, Lysandre Debut, Victor Sanh, Clement Delangue, Anthony Moi, Pier-ric Cistac, Morgan Funtowicz, Joe Davison, Sam Shleifer, et al. 2020. Transformers: State-of-the-art natural language processing. In Proceedings of EMNLP. [find](https://scholar.google.com/scholar?q=Thomas+Wolf%2C+Julien+Chaumond%2C+Lysandre+Debut%2C+Victor+Sanh%2C+Clement+Delangue%2C+Anthony+Moi%2C+Pier%2Dric+Cistac%2C+Morgan+Funtowicz%2C+Joe+Davison%2C+Sam+Shleifer%2C+et+al%2E+2020%2E+Transformers%3A+State%2Dof%2Dthe%2Dart+natu) [our card](https://md.research.elamur.ai/free/en/papers/wolf-2020-transformers-state-art-natural-language/)
34. Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and K. Anil Jain. 2020. Adversarial attacks and defenses in images, graphs and text: A review. International Journal of Automation and Computing, 17(2):151–178. [find](https://scholar.google.com/scholar?q=Han+Xu%2C+Yao+Ma%2C+Hao%2DChen+Liu%2C+Debayan+Deb%2C+Hui+Liu%2C+Ji%2DLiang+Tang%2C+and+K%2E+Anil+Jain%2E+2020%2E+Adversarial+attacks+and+defenses+in+images%2C+graphs+and+text%3A+A+review%2E+International+Journal+of+Automation+an)
35. Chaofei Yang, Qing Wu, Hai Li, and Yiran Chen. 2017. Generative poisoning attack method against neural networks. arXiv preprint arXiv:1703.01340. — [arXiv:1703.01340](https://arxiv.org/abs/1703.01340) [find](https://scholar.google.com/scholar?q=Chaofei+Yang%2C+Qing+Wu%2C+Hai+Li%2C+and+Yiran+Chen%2E+2017%2E+Generative+poisoning+attack+method+against+neural+networks%2E+arXiv+preprint+arXiv%3A1703%2E01340%2E+%E2%80%94+%5BarXiv%3A1703%2E01340%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1703%2E01340%29)
36. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. OpenAI Blog, 1(8). [find](https://scholar.google.com/scholar?q=Alec+Radford%2C+Jeffrey+Wu%2C+Rewon+Child%2C+David+Luan%2C+Dario+Amodei%2C+and+Ilya+Sutskever%2E+2019%2E+Language+models+are+unsupervised+multitask+learners%2E+OpenAI+Blog%2C+1%288%29%2E)
37. Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. 2019. Predicting the type and target of offensive posts in social media. In Proceedings of NAACL-HLT. [find](https://scholar.google.com/scholar?q=Marcos+Zampieri%2C+Shervin+Malmasi%2C+Preslav+Nakov%2C+Sara+Rosenthal%2C+Noura+Farra%2C+and+Ritesh+Kumar%2E+2019%2E+Predicting+the+type+and+target+of+offensive+posts+in+social+media%2E+In+Proceedings+of+NAACL%2DHLT%2E) [our card](https://md.research.elamur.ai/free/en/papers/zampieri-2019-predicting-type-target-offensive-posts/)
38. Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2018. Semantically equivalent adversarial rules for debugging nlp models. In Proceedings ACL. [find](https://scholar.google.com/scholar?q=Marco+Tulio+Ribeiro%2C+Sameer+Singh%2C+and+Carlos+Guestrin%2E+2018%2E+Semantically+equivalent+adversarial+rules+for+debugging+nlp+models%2E+In+Proceedings+ACL%2E)
39. Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Yuan+Zang%2C+Fanchao+Qi%2C+Chenghao+Yang%2C+Zhiyuan+Liu%2C+Meng+Zhang%2C+Qun+Liu%2C+and+Maosong+Sun%2E+2020%2E+Word%2Dlevel+textual+adversarial+attacking+as+combinatorial+optimization%2E+In+Proceedings+of+ACL%2E) [our card](https://md.research.elamur.ai/free/en/papers/zang-2020-word-level-textual-adversarial-attacking/)
40. Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. 2020. Hidden trigger backdoor attacks. In Proceedings of AAAI. [find](https://scholar.google.com/scholar?q=Aniruddha+Saha%2C+Akshayvarun+Subramanya%2C+and+Hamed+Pirsiavash%2E+2020%2E+Hidden+trigger+backdoor+attacks%2E+In+Proceedings+of+AAAI%2E)
41. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Xiang+Zhang%2C+Junbo+Zhao%2C+and+Yann+LeCun%2E+2015%2E+Character%2Dlevel+convolutional+networks+for+text+classification%2E+In+Proceedings+of+NeurIPS%2E) [our card](https://md.research.elamur.ai/free/en/papers/zhang-2015-character-level-convolutional-networks-text/)
42. Abigail See, Peter J Liu, and Christopher D Manning. 2017. Get to the point: Summarization with pointer-generator networks. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Abigail+See%2C+Peter+J+Liu%2C+and+Christopher+D+Manning%2E+2017%2E+Get+to+the+point%3A+Summarization+with+pointer%2Dgenerator+networks%2E+In+Proceedings+of+ACL%2E)
43. Xinyang Zhang, Zheng Zhang, and Ting Wang. 2020. Trojaning language models for fun and profit. arXiv preprint arXiv:2008.00312. — [arXiv:2008.00312](https://arxiv.org/abs/2008.00312) [find](https://scholar.google.com/scholar?q=Xinyang+Zhang%2C+Zheng+Zhang%2C+and+Ting+Wang%2E+2020%2E+Trojaning+language+models+for+fun+and+profit%2E+arXiv+preprint+arXiv%3A2008%2E00312%2E+%E2%80%94+%5BarXiv%3A2008%2E00312%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2008%2E00312%29)
44. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of EMNLP. [find](https://scholar.google.com/scholar?q=Richard+Socher%2C+Alex+Perelygin%2C+Jean+Wu%2C+Jason+Chuang%2C+Christopher+D+Manning%2C+Andrew+Ng%2C+and+Christopher+Potts%2E+2013%2E+Recursive+deep+models+for+semantic+compositionality+over+a+sentiment+treebank%2E+In+)
45. Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. 2020. Clean-label backdoor attacks on video recognition models. In Proceedings of CVPR. [find](https://scholar.google.com/scholar?q=Shihao+Zhao%2C+Xingjun+Ma%2C+Xiang+Zheng%2C+James+Bailey%2C+Jingjing+Chen%2C+and+Yu%2DGang+Jiang%2E+2020%2E+Clean%2Dlabel+backdoor+attacks+on+video+recognition+models%2E+In+Proceedings+of+CVPR%2E)