---
title: "ONION: A Simple and Effective Defense Against — Qi 2021"
description: "Textual backdoor attacks plant hidden behavior in NLP classifiers."
authors: ["Fanchao Qi", "Yangyi Chen", "Mukai Li", "Yuan Yao", "Zhiyuan Liu", "Maosong Sun"]
year: 2021
venue: "Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing"
source: "https://aclanthology.org/2021.emnlp-main.752/"
doi: "10.18653/v1/2021.emnlp-main.752"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/qi-2021-onion-simple-effective-defense-against/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/qi-2021-onion-simple-effective-defense-against/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2021](https://md.research.elamur.ai/free/en/papers/2021/page/4/) / ONION: A Simple and Effective Defense Against Textual Backdoor Attacks

# ONION: A Simple and Effective Defense Against Textual Backdoor Attacks

**Authors:** [Fanchao Qi](https://md.research.elamur.ai/free/en/authors/fanchao-qi/), [Yangyi Chen](https://md.research.elamur.ai/free/en/authors/yangyi-chen/), [Mukai Li](https://md.research.elamur.ai/free/en/authors/mukai-li/), [Yuan Yao](https://md.research.elamur.ai/free/en/authors/yuan-yao/), [Zhiyuan Liu](https://md.research.elamur.ai/free/en/authors/zhiyuan-liu/), [Maosong Sun](https://md.research.elamur.ai/free/en/authors/maosong-sun/) · **Year:** 2021 · **Venue:** Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2021.emnlp-main.752/) · [PDF](https://aclanthology.org/2021.emnlp-main.752.pdf) · [DOI 10.18653/v1/2021.emnlp-main.752](https://doi.org/10.18653/v1/2021.emnlp-main.752) · [OpenAlex](https://openalex.org/W3109409894)

**Citations:** 189 citations (openalex-snapshot · 2026-10-14) · [90](#cited-by) in our library, of the 140884 papers whose bibliographies we read

## Summary
Textual backdoor attacks plant hidden behavior in NLP classifiers. The model acts normally on clean text but outputs an attacker-chosen label whenever a trigger appears. Before this work, the only dedicated defense was BKI. It filters poisoned training data, so it cannot help when users adopt an already-compromised third-party model or API.

The authors propose ONION, a defense applied at inference time. It relies on the observation that nearly all known attacks insert out-of-context tokens or sentences that disrupt fluency. For each word in an input, GPT-2 perplexity is computed with and without that word, and the drop serves as a suspicion score. Words scoring above a threshold t_s are deleted before classification. The threshold is tuned on validation data or simply set to 0.

Experiments covered SST-2, OffensEval and AG News, with BiLSTM and BERT victims and five insertion-based attacks. ONION cut attack success rates by more than 40% on average while barely reducing clean accuracy. Because it never touches training, it covers both pre- and post-training attack scenarios.

## Key points
- Suspicion score: f_i = p_0 − p_i, the perplexity change when word w_i is removed. Combinatorial alternatives (particle swarm optimization, genetic algorithm) were slower and no more effective.
- Data and models:
  - SST-2: 9,612 sentences.
  - OffensEval: 14,102 tweets.
  - AG News: 30,399 sentences.
  - Victims: BiLSTM, plus BERT_BASE tested right after poisoning (BERT-T) or after clean fine-tuning (BERT-F).
- Attacks: BadNet with rare, middle-frequency (BadNet_m) and high-frequency (BadNet_h) trigger words, RIPPLES, and InSent (inserted sentence). Evaluation metrics were ΔASR and ΔCACC.
- Pre-training comparison on SST-2:
  - Average ΔASR: ONION 44.43% vs. BKI 16.07%.
  - ΔCACC: ONION 1.41 vs. BKI 0.87, so ONION costs slightly more clean accuracy.
- Word removal analysis: poisoned samples lost 0.76 trigger and 0.57 normal words on average, with trigger-detection precision of 56.19 and recall of 75.66. Wrongly removed normal words tend to be rare.
- Limitations: ONION struggles against stealthier triggers such as syntactic structures, word substitution and context-aware sentences. Code is available at github.com/thunlp/ONION.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

Fields: [Natural language processing](https://md.research.elamur.ai/free/en/shelves/nlp/)

## Cited by

Cited by

90 papers of our library cite it (of the 140884 whose bibliographies we read); 4 of them have a page here, 86 not yet.

- [Security and Privacy Challenges of Large Language Models: A Survey](https://md.research.elamur.ai/free/en/papers/das-2024-security-privacy-challenges-large-language/)
- [Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger](https://md.research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/)
- [Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer](https://md.research.elamur.ai/free/en/papers/qi-2021-mind-style-text-adversarial-backdoor/)
- [A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly](https://md.research.elamur.ai/free/en/papers/yao-2023-survey-large-language-model-llm/)

## Cite

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{qi2021onion,
  title = {{ONION: A Simple and Effective Defense Against Textual Backdoor Attacks}},
  author = {Qi, Fanchao and Chen, Yangyi and Li, Mukai and Yao, Yuan and Liu, Zhiyuan and Sun, Maosong},
  booktitle = {Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing},
  year = {2021},
  doi = {10.18653/v1/2021.emnlp-main.752},
  url = {https://doi.org/10.18653/v1/2021.emnlp-main.752}
}
```

- [← previous On the treatment of super-heavy syllables in Arabic Dialects: an Optimality Theoretic approach to historical typology](https://md.research.elamur.ai/free/en/papers/bokhari-2021-treatment-super-heavy-syllables-arabic/)
- [next → OntoGUM: Evaluating Contextualized SOTA Coreference Resolution on 12 More Genres](https://md.research.elamur.ai/free/en/papers/zhu-2021-ontogum-evaluating-contextualized-sota-coreference/)
- [↑ back to papers of 2021](https://md.research.elamur.ai/free/en/papers/2021/page/4/)

## References

27 references, 4 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Chuanshuai Chen and Jiazhu Dai. 2020. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. arXiv preprint arXiv:2007.12070. — [arXiv:2007.12070](https://arxiv.org/abs/2007.12070) [find](https://scholar.google.com/scholar?q=Chuanshuai+Chen+and+Jiazhu+Dai%2E+2020%2E+Mitigating+backdoor+attacks+in+lstm%2Dbased+text+classification+systems+by+backdoor+keyword+identification%2E+arXiv+preprint+arXiv%3A2007%2E12070%2E+%E2%80%94+%5BarXiv%3A2007%2E12070%5D%28ht)
2. Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang. 2020. Badnl: Backdoor attacks against nlp models. arXiv preprint arXiv:2006.01043. — [arXiv:2006.01043](https://arxiv.org/abs/2006.01043) [find](https://scholar.google.com/scholar?q=Xiaoyi+Chen%2C+Ahmed+Salem%2C+Michael+Backes%2C+Shiqing+Ma%2C+and+Yang+Zhang%2E+2020%2E+Badnl%3A+Backdoor+attacks+against+nlp+models%2E+arXiv+preprint+arXiv%3A2006%2E01043%2E+%E2%80%94+%5BarXiv%3A2006%2E01043%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2006)
3. Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. — [arXiv:1712.05526](https://arxiv.org/abs/1712.05526) [find](https://scholar.google.com/scholar?q=Xinyun+Chen%2C+Chang+Liu%2C+Bo+Li%2C+Kimberly+Lu%2C+and+Dawn+Song%2E+2017%2E+Targeted+backdoor+attacks+on+deep+learning+systems+using+data+poisoning%2E+arXiv+preprint+arXiv%3A1712%2E05526%2E+%E2%80%94+%5BarXiv%3A1712%2E05526%5D%28https%3A%2F%2F)
4. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. [find](https://scholar.google.com/scholar?q=Jiazhu+Dai%2C+Chuanshuai+Chen%2C+and+Yufeng+Li%2E+2019%2E+A+backdoor+attack+against+lstm%2Dbased+text+classification+systems%2E+IEEE+Access%2C+7%3A138872%E2%80%93138878%2E)
5. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of NAACL-HLT. [find](https://scholar.google.com/scholar?q=Jacob+Devlin%2C+Ming%2DWei+Chang%2C+Kenton+Lee%2C+and+Kristina+Toutanova%2E+2019%2E+Bert%3A+Pre%2Dtraining+of+deep+bidirectional+transformers+for+language+understanding%2E+In+Proceedings+of+NAACL%2DHLT%2E)
6. Min Du, Ruoxi Jia, and Dawn Song. 2020. Robust anomaly detection and backdoor attack detection via differential privacy. In Proceedings of ICLR. [find](https://scholar.google.com/scholar?q=Min+Du%2C+Ruoxi+Jia%2C+and+Dawn+Song%2E+2020%2E+Robust+anomaly+detection+and+backdoor+attack+detection+via+differential+privacy%2E+In+Proceedings+of+ICLR%2E)
7. Russell Eberhart and James Kennedy. 1995. Particle swarm optimization. In Proceedings of the IEEE International Conference on Neural Networks. [find](https://scholar.google.com/scholar?q=Russell+Eberhart+and+James+Kennedy%2E+1995%2E+Particle+swarm+optimization%2E+In+Proceedings+of+the+IEEE+International+Conference+on+Neural+Networks%2E)
8. David E Goldberg and John H Holland. 1988. Genetic algorithms and machine learning. Machine learning, 3(2):95–99. [find](https://scholar.google.com/scholar?q=David+E+Goldberg+and+John+H+Holland%2E+1988%2E+Genetic+algorithms+and+machine+learning%2E+Machine+learning%2C+3%282%29%3A95%E2%80%9399%2E)
9. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733. [find](https://scholar.google.com/scholar?q=Tianyu+Gu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2017%2E+BadNets%3A+Identifying+vulnerabilities+in+the+machine+learning+model+supply+chain%2E+arXiv+preprint+arXiv%3A1708%2E06733%2E)
10. Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2020. Backdoor learning: A survey. arXiv preprint arXiv:2007.08745. — [arXiv:2007.08745](https://arxiv.org/abs/2007.08745) [find](https://scholar.google.com/scholar?q=Yiming+Li%2C+Baoyuan+Wu%2C+Yong+Jiang%2C+Zhifeng+Li%2C+and+Shu%2DTao+Xia%2E+2020%2E+Backdoor+learning%3A+A+survey%2E+arXiv+preprint+arXiv%3A2007%2E08745%2E+%E2%80%94+%5BarXiv%3A2007%2E08745%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2007%2E08745%29)
11. Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. 2018. Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307. — [arXiv:1808.10307](https://arxiv.org/abs/1808.10307) [find](https://scholar.google.com/scholar?q=Cong+Liao%2C+Haoti+Zhong%2C+Anna+Squicciarini%2C+Sencun+Zhu%2C+and+David+Miller%2E+2018%2E+Backdoor+embedding+in+convolutional+neural+network+models+via+invisible+perturbation%2E+arXiv+preprint+arXiv%3A1808%2E10307%2E+%E2%80%94+)
12. Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018a. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses. [find](https://scholar.google.com/scholar?q=Kang+Liu%2C+Brendan+Dolan%2DGavitt%2C+and+Siddharth+Garg%2E+2018a%2E+Fine%2Dpruning%3A+Defending+against+backdooring+attacks+on+deep+neural+networks%2E+In+International+Symposium+on+Research+in+Attacks%2C+Intrusions%2C+a)
13. Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018b. Trojaning Attack on Neural Networks. In Proceedings of NDSS. [find](https://scholar.google.com/scholar?q=Yingqi+Liu%2C+Shiqing+Ma%2C+Yousra+Aafer%2C+Wen%2DChuan+Lee%2C+Juan+Zhai%2C+Weihang+Wang%2C+and+Xiangyu+Zhang%2E+2018b%2E+Trojaning+Attack+on+Neural+Networks%2E+In+Proceedings+of+NDSS%2E)
14. Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In Proceedings of ECCV. [find](https://scholar.google.com/scholar?q=Yunfei+Liu%2C+Xingjun+Ma%2C+James+Bailey%2C+and+Feng+Lu%2E+2020%2E+Reflection+backdoor%3A+A+natural+backdoor+attack+on+deep+neural+networks%2E+In+Proceedings+of+ECCV%2E)
15. Yuntao Liu, Yang Xie, and Ankur Srivastava. 2017. Neural trojans. In Proceedings of ICCD. [find](https://scholar.google.com/scholar?q=Yuntao+Liu%2C+Yang+Xie%2C+and+Ankur+Srivastava%2E+2017%2E+Neural+trojans%2E+In+Proceedings+of+ICCD%2E)
16. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021a. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Fanchao+Qi%2C+Mukai+Li%2C+Yangyi+Chen%2C+Zhengyan+Zhang%2C+Zhiyuan+Liu%2C+Yasheng+Wang%2C+and+Maosong+Sun%2E+2021a%2E+Hidden+killer%3A+Invisible+textual+backdoor+attacks+with+syntactic+trigger%2E+In+Proceedings+of+ACL%2E) [our card](https://md.research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/)
17. Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021b. Turn the combination lock: Learnable textual backdoor attacks via word substitution. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Fanchao+Qi%2C+Yuan+Yao%2C+Sophia+Xu%2C+Zhiyuan+Liu%2C+and+Maosong+Sun%2E+2021b%2E+Turn+the+combination+lock%3A+Learnable+textual+backdoor+attacks+via+word+substitution%2E+In+Proceedings+of+ACL%2E)
18. Ximing Qiao, Yukun Yang, and Hai Li. 2019. Defending neural backdoors via generative distribution modeling. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Ximing+Qiao%2C+Yukun+Yang%2C+and+Hai+Li%2E+2019%2E+Defending+neural+backdoors+via+generative+distribution+modeling%2E+In+Proceedings+of+NeurIPS%2E)
19. Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, and Ilya Sutskever. 2019. Language models are unsupervised multitask learners. OpenAI Blog, 1(8). [find](https://scholar.google.com/scholar?q=Alec+Radford%2C+Jeffrey+Wu%2C+Rewon+Child%2C+David+Luan%2C+Dario+Amodei%2C+and+Ilya+Sutskever%2E+2019%2E+Language+models+are+unsupervised+multitask+learners%2E+OpenAI+Blog%2C+1%288%29%2E)
20. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of EMNLP. [find](https://scholar.google.com/scholar?q=Richard+Socher%2C+Alex+Perelygin%2C+Jean+Wu%2C+Jason+Chuang%2C+Christopher+D+Manning%2C+Andrew+Ng%2C+and+Christopher+Potts%2E+2013%2E+Recursive+deep+models+for+semantic+compositionality+over+a+sentiment+treebank%2E+In+)
21. Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. 2019. Predicting the type and target of offensive posts in social media. In Proceedings of NAACL-HLT. [find](https://scholar.google.com/scholar?q=Marcos+Zampieri%2C+Shervin+Malmasi%2C+Preslav+Nakov%2C+Sara+Rosenthal%2C+Noura+Farra%2C+and+Ritesh+Kumar%2E+2019%2E+Predicting+the+type+and+target+of+offensive+posts+in+social+media%2E+In+Proceedings+of+NAACL%2DHLT%2E) [our card](https://md.research.elamur.ai/free/en/papers/zampieri-2019-predicting-type-target-offensive-posts/)
22. Sepp Hochreiter and Jürgen Schmidhuber. 1997. Long short-term memory. Neural Computation, 9(8):1735–1780. [find](https://scholar.google.com/scholar?q=Sepp+Hochreiter+and+J%C3%BCrgen+Schmidhuber%2E+1997%2E+Long+short%2Dterm+memory%2E+Neural+Computation%2C+9%288%29%3A1735%E2%80%931780%2E)
23. Yuan Zang, Fanchao Qi, Chenghao Yang, Zhiyuan Liu, Meng Zhang, Qun Liu, and Maosong Sun. 2020. Word-level textual adversarial attacking as combinatorial optimization. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Yuan+Zang%2C+Fanchao+Qi%2C+Chenghao+Yang%2C+Zhiyuan+Liu%2C+Meng+Zhang%2C+Qun+Liu%2C+and+Maosong+Sun%2E+2020%2E+Word%2Dlevel+textual+adversarial+attacking+as+combinatorial+optimization%2E+In+Proceedings+of+ACL%2E) [our card](https://md.research.elamur.ai/free/en/papers/zang-2020-word-level-textual-adversarial-attacking/)
24. Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. In Proceedings of ACL. [find](https://scholar.google.com/scholar?q=Keita+Kurita%2C+Paul+Michel%2C+and+Graham+Neubig%2E+2020%2E+Weight+poisoning+attacks+on+pre%2Dtrained+models%2E+In+Proceedings+of+ACL%2E)
25. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Proceedings of NeurIPS. [find](https://scholar.google.com/scholar?q=Xiang+Zhang%2C+Junbo+Zhao%2C+and+Yann+LeCun%2E+2015%2E+Character%2Dlevel+convolutional+networks+for+text+classification%2E+In+Proceedings+of+NeurIPS%2E) [our card](https://md.research.elamur.ai/free/en/papers/zhang-2015-character-level-convolutional-networks-text/)
26. Xinyang Zhang, Z Zhang, S Ji, and T Wang. 2021. Trojaning language models for fun and profit. In Proceedings of IEEE European Symposium on Security and Privacy. [find](https://scholar.google.com/scholar?q=Xinyang+Zhang%2C+Z+Zhang%2C+S+Ji%2C+and+T+Wang%2E+2021%2E+Trojaning+language+models+for+fun+and+profit%2E+In+Proceedings+of+IEEE+European+Symposium+on+Security+and+Privacy%2E)
27. Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. 2020. Clean-label backdoor attacks on video recognition models. In Proceedings of CVPR. [find](https://scholar.google.com/scholar?q=Shihao+Zhao%2C+Xingjun+Ma%2C+Xiang+Zheng%2C+James+Bailey%2C+Jingjing+Chen%2C+and+Yu%2DGang+Jiang%2E+2020%2E+Clean%2Dlabel+backdoor+attacks+on+video+recognition+models%2E+In+Proceedings+of+CVPR%2E)