---
title: "P2P — paper by Zhao et al. (2026) — summary and ideas"
description: "The authors propose Poison-to-Poison (P2P), which deliberately adds a second, controlled backdoor. 65 references, cited by 3 papers here."
authors: ["Shuai Zhao", "Xinyi Wu", "Shiqian Zhao", "Xiaobao Wu", "Zhongliang Guo", "Yanhao Jia", "Anh Tuan Luu"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.600/"
doi: "10.18653/v1/2026.findings-acl.600"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/zhao-2026-p2p-poison-poison-remedy-reliable/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/zhao-2026-p2p-poison-poison-remedy-reliable/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/6/) / P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs

# P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs

**Authors:** [Shuai Zhao](https://md.research.elamur.ai/free/en/authors/shuai-zhao/), Xinyi Wu, Shiqian Zhao, [Xiaobao Wu](https://md.research.elamur.ai/free/en/authors/xiaobao-wu/), Zhongliang Guo, Yanhao Jia and [Anh Tuan Luu](https://md.research.elamur.ai/free/en/authors/anh-tuan-luu/) · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.600/) · [PDF](https://aclanthology.org/2026.findings-acl.600.pdf) · [DOI 10.18653/v1/2026.findings-acl.600](https://doi.org/10.18653/v1/2026.findings-acl.600) · [OpenAlex](https://openalex.org/W4414972115)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · 3 in our library, of the 149,439 papers whose bibliographies we read

## Summary
Fine-tuning LLMs on third-party or outsourced data exposes them to data-poisoning backdoors. Most existing defenses filter or sanitize inputs and only work against particular trigger styles or task types. Onion targets character-level triggers, while PDB and PSIM are limited to classification. The authors propose Poison-to-Poison (P2P), which deliberately adds a second, controlled backdoor. A small share of training samples gets a benign trigger, which also serves as a prompt in prompt-based learning. These samples receive labels from an extended label space: classes shift from i to i+n, and generative targets get a prefix. At inference, in a Model-as-a-Service setting, the defender places the benign trigger in the system prompt and reads predictions from the alternative labels. This crowds out unknown malicious triggers. A theoretical argument and experiments cover text and multimodal classification, mathematical reasoning and summarization with several LLMs. Attack success rates fall to low levels while clean accuracy is kept or slightly improved. The result points to proactive immunization as a task-agnostic alternative to reactive filtering.

## Key points
- Six attacks were tested: BadNets, AddSent, SynAttack, ProAttack, CbaAttack and MtbaAttack. Victim models included LLaMA-3.1-Instruction, DeepSeek-R1 and Qwen-3. On SST-2 with LLaMA-3.1-Instruction, ASR dropped from about 100% to roughly 4–16%, and CA was about 96%.
- On Qwen-3 under BadNets with two different prompts:
  - SST-2: ASR fell from 99.78% to 6.03% and 4.17%, while CA rose from 94.56% to about 96%.
  - AG's News: ASR fell from 97.07% to 1.47%.
- In ablations on SST-2 with Qwen-3, ASR stayed below 10% for poisoning ratios from 2% to 10%. Using more benign samples (5–30%) pushed CA toward 97%. Higher LoRA-style ranks further lowered ASR.
- Results were stable across different verbalizer tokens and different benign prompts.
- The authors note two limitations:
  - The method still needs testing on more vision and multimodal models.
  - The number of reserved samples is often larger than the number of poisoned ones, which may carry its own risks.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Shanghai Jiao Tong University](https://md.research.elamur.ai/free/en/universities/shanghai-jiao-tong-university/) — University, Shanghai, China · 149 works · 16,161 citations
- [Nanyang Technological University](https://md.research.elamur.ai/free/en/universities/nanyang-technological-university/) — University, Singapore, Singapore · 156 works · 25,644 citations
- [University of Aberdeen](https://md.research.elamur.ai/free/en/universities/university-of-aberdeen/) — University, Aberdeen, United Kingdom · 20 works · 1,385 citations
- [VinUniversity](https://md.research.elamur.ai/free/en/universities/vinuniversity/) — University, Hanoi, Vietnam · 11 works · 56 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Shuai Zhao, Xinyi Wu, Shiqian Zhao, Xiaobao Wu, Zhongliang Guo, Yanhao Jia and Anh Tuan Luu. 2026. P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{zhao2026p2p,
  title = {{P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs}},
  author = {Shuai Zhao, Xinyi Wu, Shiqian Zhao, Xiaobao Wu, Zhongliang Guo, Yanhao Jia and Anh Tuan Luu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.600},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.600}
}
```

- [← previous Outcome Accuracy is Not Enough: Aligning the Reasoning Process of Reward Models](https://md.research.elamur.ai/free/en/papers/wang-2026-outcome-accuracy-is-not-enough/)
- [next → PARSEME 2.0 Multilingual Corpus of Multiword Expressions](https://md.research.elamur.ai/free/en/papers/savary-2026-parseme-2-0-multilingual-corpus/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/6/)

## References

65 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. AI@Meta. 2024. Llama 3 model card. [find](https://scholar.google.com/scholar?q=AI%40Meta%2E+2024%2E+Llama+3+model+card%2E)
2. Sumit Asthana, Hannah Rashkin, Elizabeth Clark, Fantine Huot, and Mirella Lapata. 2024. Evaluating llms for targeted concept simplification for domain-specific texts. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 6208–6226. [find](https://scholar.google.com/scholar?q=Sumit+Asthana%2C+Hannah+Rashkin%2C+Elizabeth+Clark%2C+Fantine+Huot%2C+and+Mirella+Lapata%2E+2024%2E+Evaluating+llms+for+targeted+concept+simplification+for+domain%2Dspecific+texts%2E+In+Proceedings+of+the+2024+Confer)
3. Chen Chen, Yuchen Sun, Jiaxin Gao, Xueluan Gong, Qian Wang, Ziyao Wang, Yongsen Zheng, and Kwok-Yan Lam. 2025. Lethe: Purifying backdoored large language models with knowledge dilution. arXiv preprint arXiv:2508.21004. — [arXiv:2508.21004](https://arxiv.org/abs/2508.21004) [find](https://scholar.google.com/scholar?q=Chen+Chen%2C+Yuchen+Sun%2C+Jiaxin+Gao%2C+Xueluan+Gong%2C+Qian+Wang%2C+Ziyao+Wang%2C+Yongsen+Zheng%2C+and+Kwok%2DYan+Lam%2E+2025%2E+Lethe%3A+Purifying+backdoored+large+language+models+with+knowledge+dilution%2E+arXiv+preprint)
4. Chuanshuai Chen and Jiazhu Dai. 2021. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253–262. [find](https://scholar.google.com/scholar?q=Chuanshuai+Chen+and+Jiazhu+Dai%2E+2021%2E+Mitigating+backdoor+attacks+in+lstm%2Dbased+text+classification+systems+by+backdoor+keyword+identification%2E+Neurocomputing%2C+452%3A253%E2%80%93262%2E)
5. Pengzhou Cheng, Zongru Wu, Wei Du, Haodong Zhao, Wei Lu, and Gongshen Liu. 2025. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems. [find](https://scholar.google.com/scholar?q=Pengzhou+Cheng%2C+Zongru+Wu%2C+Wei+Du%2C+Haodong+Zhao%2C+Wei+Lu%2C+and+Gongshen+Liu%2E+2025%2E+Backdoor+attacks+and+countermeasures+in+natural+language+processing+models%3A+A+comprehensive+security+review%2E+IEEE+Trans)
6. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. [find](https://scholar.google.com/scholar?q=Jiazhu+Dai%2C+Chuanshuai+Chen%2C+and+Yufeng+Li%2E+2019%2E+A+backdoor+attack+against+lstm%2Dbased+text+classification+systems%2E+IEEE+Access%2C+7%3A138872%E2%80%93138878%2E)
7. Xuan Feng, Bo An, Tianlong Gu, Liang Chang, Fengrui Hao, Peipeng Yu, and Shuai Zhao. 2025a. C2po: Diagnosing and disentangling bias shortcuts in llms. arXiv preprint arXiv:2512.23430. [find](https://scholar.google.com/scholar?q=Xuan+Feng%2C+Bo+An%2C+Tianlong+Gu%2C+Liang+Chang%2C+Fengrui+Hao%2C+Peipeng+Yu%2C+and+Shuai+Zhao%2E+2025a%2E+C2po%3A+Diagnosing+and+disentangling+bias+shortcuts+in+llms%2E+arXiv+preprint+arXiv%3A2512%2E23430%2E)
8. Xuan Feng, Tianlong Gu, Liang Chang, and Xiaoli Liu. 2024. Protect: Parameter-efficient tuning for few-shot robust chinese text correction. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 32:3270–3282. [find](https://scholar.google.com/scholar?q=Xuan+Feng%2C+Tianlong+Gu%2C+Liang+Chang%2C+and+Xiaoli+Liu%2E+2024%2E+Protect%3A+Parameter%2Defficient+tuning+for+few%2Dshot+robust+chinese+text+correction%2E+IEEE%2FACM+Transactions+on+Audio%2C+Speech%2C+and+Language+Process)
9. Xuan Feng, Tianlong Gu, Xiaoli Liu, and Liang Chang. 2025b. Learning from mistakes: Self-correct adversarial training for chinese unnatural text correction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23887–23895. [find](https://scholar.google.com/scholar?q=Xuan+Feng%2C+Tianlong+Gu%2C+Xiaoli+Liu%2C+and+Liang+Chang%2E+2025b%2E+Learning+from+mistakes%3A+Self%2Dcorrect+adversarial+training+for+chinese+unnatural+text+correction%2E+In+Proceedings+of+the+AAAI+Conference+on+Ar)
10. Xuan Feng, Shuai Zhao, Luwei Xiao, Tianlong Gu, and Bo An. 2026. Self-debias: Self-correcting for debiasing large language models. [find](https://scholar.google.com/scholar?q=Xuan+Feng%2C+Shuai+Zhao%2C+Luwei+Xiao%2C+Tianlong+Gu%2C+and+Bo+An%2E+2026%2E+Self%2Ddebias%3A+Self%2Dcorrecting+for+debiasing+large+language+models%2E)
11. Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2022. Triggerless backdoor attack for nlp tasks with clean labels. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Lan… [find](https://scholar.google.com/scholar?q=Leilei+Gan%2C+Jiwei+Li%2C+Tianwei+Zhang%2C+Xiaoya+Li%2C+Yuxian+Meng%2C+Fei+Wu%2C+Yi+Yang%2C+Shangwei+Guo%2C+and+Chun+Fan%2E+2022%2E+Triggerless+backdoor+attack+for+nlp+tasks+with+clean+labels%2E+In+Proceedings+of+the+2022+)
12. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. [Badnets: Identifying vulnerabilities in the machine learning model supply chain](https://md.research.elamur.ai/free/en/papers/gu-2017-badnets-identifying-vulnerabilities-machine-learning/). arXiv preprint arXiv:1708.06733.
13. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseekr1: Incentivizing reasoning capability in llms via reinforcement learning. Nature. [find](https://scholar.google.com/scholar?q=Daya+Guo%2C+Dejian+Yang%2C+Haowei+Zhang%2C+Junxiao+Song%2C+Ruoyu+Zhang%2C+Runxin+Xu%2C+Qihao+Zhu%2C+Shirong+Ma%2C+Peiyi+Wang%2C+Xiao+Bi%2C+and+1+others%2E+2025%2E+Deepseekr1%3A+Incentivizing+reasoning+capability+in+llms+via+re)
14. Zhongliang Guo, Ognjen Arandjelović, David Reid, Yaxiong Lei, and Jochen Büttner. 2023. A siamese transformer network for zero-shot ancient coin classification. Journal of imaging, page 107. [find](https://scholar.google.com/scholar?q=Zhongliang+Guo%2C+Ognjen+Arandjelovic%CC%81%2C+David+Reid%2C+Yaxiong+Lei%2C+and+Jochen+B%C3%BCttner%2E+2023%2E+A+siamese+transformer+network+for+zero%2Dshot+ancient+coin+classification%2E+Journal+of+imaging%2C+page+107%2E)
15. Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, Guowen Xu, and Tianwei Zhang. 2022. Iron: Private inference on transformers. Advances in neural information processing systems, 35:15718–15731. [find](https://scholar.google.com/scholar?q=Meng+Hao%2C+Hongwei+Li%2C+Hanxiao+Chen%2C+Pengzhi+Xing%2C+Guowen+Xu%2C+and+Tianwei+Zhang%2E+2022%2E+Iron%3A+Private+inference+on+transformers%2E+Advances+in+neural+information+processing+systems%2C+35%3A15718%E2%80%9315731%2E)
16. Meng Hao, Hongwei Li, Hanxiao Chen, Pengzhi Xing, and Tianwei Zhang. 2023. Fastsecnet: An efficient cryptographic framework for private neural network inference. IEEE Transactions on Information Forensics and Security, 18:2569–2582. [find](https://scholar.google.com/scholar?q=Meng+Hao%2C+Hongwei+Li%2C+Hanxiao+Chen%2C+Pengzhi+Xing%2C+and+Tianwei+Zhang%2E+2023%2E+Fastsecnet%3A+An+efficient+cryptographic+framework+for+private+neural+network+inference%2E+IEEE+Transactions+on+Information+Foren)
17. Meng Hao, Hongwei Li, Xizhao Luo, Guowen Xu, Haomiao Yang, and Sen Liu. 2019. Efficient and privacy-enhanced federated learning for industrial artificial intelligence. IEEE Transactions on Industrial Informatics, 16(10):6532–6542. [find](https://scholar.google.com/scholar?q=Meng+Hao%2C+Hongwei+Li%2C+Xizhao+Luo%2C+Guowen+Xu%2C+Haomiao+Yang%2C+and+Sen+Liu%2E+2019%2E+Efficient+and+privacy%2Denhanced+federated+learning+for+industrial+artificial+intelligence%2E+IEEE+Transactions+on+Industrial+)
18. Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, and 1 others. 2021. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In International Conference on Learning Representations.
19. Man Hu, Yahui Ding, Yatao Yang, Liangyu Chen, Yanhao Jia, and Shuai Zhao. 2025a. Dup: Detection-guided unlearning for backdoor purification in language models. arXiv preprint arXiv:2508.01647. — [arXiv:2508.01647](https://arxiv.org/abs/2508.01647) [find](https://scholar.google.com/scholar?q=Man+Hu%2C+Yahui+Ding%2C+Yatao+Yang%2C+Liangyu+Chen%2C+Yanhao+Jia%2C+and+Shuai+Zhao%2E+2025a%2E+Dup%3A+Detection%2Dguided+unlearning+for+backdoor+purification+in+language+models%2E+arXiv+preprint+arXiv%3A2508%2E01647%2E+%E2%80%94+%5BarXi)
20. Man Hu, Xinyi Wu, Zuofeng Suo, Jinbo Feng, Linghui Meng, Yanhao Jia, Anh Tuan Luu, and Shuai Zhao. 2025b. Rethinking reasoning: A survey on reasoning-based backdoors in llms. [find](https://scholar.google.com/scholar?q=Man+Hu%2C+Xinyi+Wu%2C+Zuofeng+Suo%2C+Jinbo+Feng%2C+Linghui+Meng%2C+Yanhao+Jia%2C+Anh+Tuan+Luu%2C+and+Shuai+Zhao%2E+2025b%2E+Rethinking+reasoning%3A+A+survey+on+reasoning%2Dbased+backdoors+in+llms%2E)
21. Man Hu, Yatao Yang, Deng Pan, Zhongliang Guo, Luwei Xiao, Deyu Lin, and Shuai Zhao. 2025c. Syntactic paraphrase-based synthetic data generation for backdoor attacks against chinese language models. Information Fusion, page 103376. [find](https://scholar.google.com/scholar?q=Man+Hu%2C+Yatao+Yang%2C+Deng+Pan%2C+Zhongliang+Guo%2C+Luwei+Xiao%2C+Deyu+Lin%2C+and+Shuai+Zhao%2E+2025c%2E+Syntactic+paraphrase%2Dbased+synthetic+data+generation+for+backdoor+attacks+against+chinese+language+models%2E+In)
22. Minqing Hu and Bing Liu. 2004. Mining and summarizing customer reviews. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 168–177. [find](https://scholar.google.com/scholar?q=Minqing+Hu+and+Bing+Liu%2E+2004%2E+Mining+and+summarizing+customer+reviews%2E+In+Proceedings+of+the+tenth+ACM+SIGKDD+international+conference+on+Knowledge+discovery+and+data+mining%2C+pages+168%E2%80%93177%2E)
23. Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite backdoor attacks against large language models. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 1459–1472. [find](https://scholar.google.com/scholar?q=Hai+Huang%2C+Zhengyu+Zhao%2C+Michael+Backes%2C+Yun+Shen%2C+and+Yang+Zhang%2E+2024%2E+Composite+backdoor+attacks+against+large+language+models%2E+In+Findings+of+the+Association+for+Computational+Linguistics%3A+NAACL+2)
24. Yujin Huang, Terry Yue Zhuo, Qiongkai Xu, Han Hu, Xingliang Yuan, and Chunyang Chen. 2023. Training-free lexical backdoor attacks on language models. In Proceedings of the ACM Web Conference 2023, pages 2198–2208. [find](https://scholar.google.com/scholar?q=Yujin+Huang%2C+Terry+Yue+Zhuo%2C+Qiongkai+Xu%2C+Han+Hu%2C+Xingliang+Yuan%2C+and+Chunyang+Chen%2E+2023%2E+Training%2Dfree+lexical+backdoor+attacks+on+language+models%2E+In+Proceedings+of+the+ACM+Web+Conference+2023%2C+pag)
25. Yanhao Jia, Xinyi Wu, Li Hao, QinglinZhang QinglinZhang, Yuxiao Hu, Shuai Zhao, and Wenqi Fan. 2025a. Uni-retrieval: A multi-style retrieval framework for stem’s education. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics, pages 10182–10197. [find](https://scholar.google.com/scholar?q=Yanhao+Jia%2C+Xinyi+Wu%2C+Li+Hao%2C+QinglinZhang+QinglinZhang%2C+Yuxiao+Hu%2C+Shuai+Zhao%2C+and+Wenqi+Fan%2E+2025a%2E+Uni%2Dretrieval%3A+A+multi%2Dstyle+retrieval+framework+for+stem%E2%80%99s+education%2E+In+Proceedings+of+the+63rd+)
26. Yanhao Jia, Xinyi Wu, Qinglin Zhang, Yiran Qin, Luwei Xiao, and Shuai Zhao. 2025b. Towards robust evaluation of stem education: Leveraging mllms in project-based learning. arXiv preprint arXiv:2505.17050. — [arXiv:2505.17050](https://arxiv.org/abs/2505.17050) [find](https://scholar.google.com/scholar?q=Yanhao+Jia%2C+Xinyi+Wu%2C+Qinglin+Zhang%2C+Yiran+Qin%2C+Luwei+Xiao%2C+and+Shuai+Zhao%2E+2025b%2E+Towards+robust+evaluation+of+stem+education%3A+Leveraging+mllms+in+project%2Dbased+learning%2E+arXiv+preprint+arXiv%3A2505%2E17)
27. Yanhao Jia, Ji Xie, S Jivaganesh, Hao Li, Xu Wu, and Mengmi Zhang. 2025c. Seeing sound, hearing sight: Uncovering modality bias and conflict of ai models in sound localization. arXiv preprint arXiv:2505.11217. — [arXiv:2505.11217](https://arxiv.org/abs/2505.11217) [find](https://scholar.google.com/scholar?q=Yanhao+Jia%2C+Ji+Xie%2C+S+Jivaganesh%2C+Hao+Li%2C+Xu+Wu%2C+and+Mengmi+Zhang%2E+2025c%2E+Seeing+sound%2C+hearing+sight%3A+Uncovering+modality+bias+and+conflict+of+ai+models+in+sound+localization%2E+arXiv+preprint+arXiv%3A25)
28. Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. 2023. Backdoor attacks for in-context learning with language models. In The Second Workshop on New Frontiers in Adversarial Machine Learning. [find](https://scholar.google.com/scholar?q=Nikhil+Kandpal%2C+Matthew+Jagielski%2C+Florian+Tram%C3%A8r%2C+and+Nicholas+Carlini%2E+2023%2E+Backdoor+attacks+for+in%2Dcontext+learning+with+language+models%2E+In+The+Second+Workshop+on+New+Frontiers+in+Adversarial+Mac)
29. Douwe Kiela, Hamed Firooz, Aravind Mohan, Vedanuj Goswami, Amanpreet Singh, Pratik Ringshia, and Davide Testuggine. 2020. [The hateful memes challenge: Detecting hate speech in multimodal memes](https://md.research.elamur.ai/free/en/papers/kiela-2020-hateful-memes-challenge-detecting-hate/). Advances in neural information processing systems, 33:2611–2624.
30. Jiazhao Li, Zhuofeng Wu, Wei Ping, Chaowei Xiao, and VG Vinod Vydiswaran. 2023a. Defending against insertion-based textual backdoor attacks via attribution. In Findings of the Association for Computational Linguistics: ACL 2023, pages 8818–8833. [find](https://scholar.google.com/scholar?q=Jiazhao+Li%2C+Zhuofeng+Wu%2C+Wei+Ping%2C+Chaowei+Xiao%2C+and+VG+Vinod+Vydiswaran%2E+2023a%2E+Defending+against+insertion%2Dbased+textual+backdoor+attacks+via+attribution%2E+In+Findings+of+the+Association+for+Computat)
31. Yige Li, Jiabo He, Hanxun Huang, Jun Sun, Xingjun Ma, and Yu-Gang Jiang. 2025. Shortcuts everywhere and nowhere: Exploring multi-trigger backdoor attacks. IEEE Transactions on Dependable and Secure Computing. [find](https://scholar.google.com/scholar?q=Yige+Li%2C+Jiabo+He%2C+Hanxun+Huang%2C+Jun+Sun%2C+Xingjun+Ma%2C+and+Yu%2DGang+Jiang%2E+2025%2E+Shortcuts+everywhere+and+nowhere%3A+Exploring+multi%2Dtrigger+backdoor+attacks%2E+IEEE+Transactions+on+Dependable+and+Secure+Co)
32. Yinheng Li, Shaofei Wang, Han Ding, and Hang Chen. 2023b. Large language models in finance: A survey. In Proceedings of the fourth ACM international conference on AI in finance, pages 374–382. [find](https://scholar.google.com/scholar?q=Yinheng+Li%2C+Shaofei+Wang%2C+Han+Ding%2C+and+Hang+Chen%2E+2023b%2E+Large+language+models+in+finance%3A+A+survey%2E+In+Proceedings+of+the+fourth+ACM+international+conference+on+AI+in+finance%2C+pages+374%E2%80%93382%2E)
33. Ziqiang Li, Yueqi Zeng, Pengfei Xia, Lei Liu, Zhangjie Fu, and Bin Li. 2024. Large language models are good attackers: Efficient and stealthy textual backdoor attacks. arXiv preprint arXiv:2408.11587. — [arXiv:2408.11587](https://arxiv.org/abs/2408.11587) [find](https://scholar.google.com/scholar?q=Ziqiang+Li%2C+Yueqi+Zeng%2C+Pengfei+Xia%2C+Lei+Liu%2C+Zhangjie+Fu%2C+and+Bin+Li%2E+2024%2E+Large+language+models+are+good+attackers%3A+Efficient+and+stealthy+textual+backdoor+attacks%2E+arXiv+preprint+arXiv%3A2408%2E11587%2E)
34. Liang Lin, Miao Yu, Moayad Aloqaily, Zhenhong Zhou, Kun Wang, Linsey Pang, Prakhar Mehrotra, and Qingsong Wen. 2025a. Backdoor collapse: Eliminating unknown threats via known backdoor aggregation in language models. arXiv preprint arXiv:2510.10265. [find](https://scholar.google.com/scholar?q=Liang+Lin%2C+Miao+Yu%2C+Moayad+Aloqaily%2C+Zhenhong+Zhou%2C+Kun+Wang%2C+Linsey+Pang%2C+Prakhar+Mehrotra%2C+and+Qingsong+Wen%2E+2025a%2E+Backdoor+collapse%3A+Eliminating+unknown+threats+via+known+backdoor+aggregation+in+l)
35. Liang Lin, Miao Yu, Kaiwen Luo, Yibo Zhang, Lilan Peng, Dexian Wang, Xuehai Tang, Yuanhe Zhang, Xikang Yang, Zhenhong Zhou, and 1 others. 2025b. Hidden in the noise: Unveiling backdoors in audio llms alignment through latent acoustic pattern triggers. arXiv preprint arXiv:2508.02175. — [arXiv:2508.02175](https://arxiv.org/abs/2508.02175) [find](https://scholar.google.com/scholar?q=Liang+Lin%2C+Miao+Yu%2C+Kaiwen+Luo%2C+Yibo+Zhang%2C+Lilan+Peng%2C+Dexian+Wang%2C+Xuehai+Tang%2C+Yuanhe+Zhang%2C+Xikang+Yang%2C+Zhenhong+Zhou%2C+and+1+others%2E+2025b%2E+Hidden+in+the+noise%3A+Unveiling+backdoors+in+audio+llms+)
36. Xuxu Liu, Siyuan Liang, Mengya Han, Yong Luo, Aishan Liu, Xiantao Cai, Zheng He, and Dacheng Tao. 2025. Elba-bench: An efficient learning backdoor attacks benchmark for large language models. arXiv preprint arXiv:2502.18511. [find](https://scholar.google.com/scholar?q=Xuxu+Liu%2C+Siyuan+Liang%2C+Mengya+Han%2C+Yong+Luo%2C+Aishan+Liu%2C+Xiantao+Cai%2C+Zheng+He%2C+and+Dacheng+Tao%2E+2025%2E+Elba%2Dbench%3A+An+efficient+learning+backdoor+attacks+benchmark+for+large+language+models%2E+arXiv+pr)
37. Wei Lu, Rachel K Luu, and Markus J Buehler. 2025. Fine-tuning large language models for domain adaptation: Exploration of training strategies, scaling, model merging and synergistic capabilities. npj Computational Materials, 11(1):84. [find](https://scholar.google.com/scholar?q=Wei+Lu%2C+Rachel+K+Luu%2C+and+Markus+J+Buehler%2E+2025%2E+Fine%2Dtuning+large+language+models+for+domain+adaptation%3A+Exploration+of+training+strategies%2C+scaling%2C+model+merging+and+synergistic+capabilities%2E+npj+)
38. Abdullah Arafat Miah and Yu Bi. 2024. Exploiting the vulnerability of large language models via defense-aware architectural backdoor. arXiv preprint arXiv:2409.01952. — [arXiv:2409.01952](https://arxiv.org/abs/2409.01952) [find](https://scholar.google.com/scholar?q=Abdullah+Arafat+Miah+and+Yu+Bi%2E+2024%2E+Exploiting+the+vulnerability+of+large+language+models+via+defense%2Daware+architectural+backdoor%2E+arXiv+preprint+arXiv%3A2409%2E01952%2E+%E2%80%94+%5BarXiv%3A2409%2E01952%5D%28https%3A%2F%2Farxi)
39. Rui Min, Zeyu Qin, Nevin L Zhang, Li Shen, and Minhao Cheng. 2024. Uncovering, explaining, and mitigating the superficial safety of backdoor defense. Advances in Neural Information Processing Systems, 37:77934–77961. [find](https://scholar.google.com/scholar?q=Rui+Min%2C+Zeyu+Qin%2C+Nevin+L+Zhang%2C+Li+Shen%2C+and+Minhao+Cheng%2E+2024%2E+Uncovering%2C+explaining%2C+and+mitigating+the+superficial+safety+of+backdoor+defense%2E+Advances+in+Neural+Information+Processing+Systems%2C)
40. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a. [Onion: A simple and effective defense against textual backdoor attacks](https://md.research.elamur.ai/free/en/papers/qi-2021-onion-simple-effective-defense-against/). In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 9558–9566.
41. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021b. [Hidden killer: Invisible textual backdoor attacks with syntactic trigger](https://md.research.elamur.ai/free/en/papers/qi-2021-hidden-killer-invisible-textual-backdoor/). In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint…
42. Jayaram Raghuram, George Kesidis, and David J Miller. 2024. A study of backdoors in instruction fine-tuned language models. arXiv preprint arXiv:2406.07778. — [arXiv:2406.07778](https://arxiv.org/abs/2406.07778) [find](https://scholar.google.com/scholar?q=Jayaram+Raghuram%2C+George+Kesidis%2C+and+David+J+Miller%2E+2024%2E+A+study+of+backdoors+in+instruction+fine%2Dtuned+language+models%2E+arXiv+preprint+arXiv%3A2406%2E07778%2E+%E2%80%94+%5BarXiv%3A2406%2E07778%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F)
43. Salahuddin Salahuddin, Ahmed Hussain, Jussi Löppö-nen, Toni Jutila, and Panos Papadimitratos. 2025. Less data, more security: Advancing cybersecurity llms specialization via resource-efficient domain-adaptive continuous pre-training with minimal tokens. arXiv preprint arXiv:2507.02964. [find](https://scholar.google.com/scholar?q=Salahuddin+Salahuddin%2C+Ahmed+Hussain%2C+Jussi+L%C3%B6pp%C3%B6%2Dnen%2C+Toni+Jutila%2C+and+Panos+Papadimitratos%2E+2025%2E+Less+data%2C+more+security%3A+Advancing+cybersecurity+llms+specialization+via+resource%2Defficient+domain%2D)
44. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. [Recursive deep models for semantic compositionality over a sentiment treebank](https://md.research.elamur.ai/free/en/papers/socher-2013-recursive-deep-models-semantic-compositionality/). In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631…
45. Kaixuan Wang, Chenxin Diao, Jason T Jacques, Zhongliang Guo, and Shuai Zhao. 2025. Hripbench: Benchmarking llms in harm reduction information provision to support people who use drugs. arXiv preprint arXiv:2507.21815. — [arXiv:2507.21815](https://arxiv.org/abs/2507.21815) [find](https://scholar.google.com/scholar?q=Kaixuan+Wang%2C+Chenxin+Diao%2C+Jason+T+Jacques%2C+Zhongliang+Guo%2C+and+Shuai+Zhao%2E+2025%2E+Hripbench%3A+Benchmarking+llms+in+harm+reduction+information+provision+to+support+people+who+use+drugs%2E+arXiv+preprint+)
46. Tong Wang, Yuan Yao, Feng Xu, Miao Xu, Shengwei An, and Ting Wang. 2024a. Inspecting prediction confidence for detecting black-box backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 274–282. [find](https://scholar.google.com/scholar?q=Tong+Wang%2C+Yuan+Yao%2C+Feng+Xu%2C+Miao+Xu%2C+Shengwei+An%2C+and+Ting+Wang%2E+2024a%2E+Inspecting+prediction+confidence+for+detecting+black%2Dbox+backdoor+attacks%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial)
47. Yifei Wang, Dizhan Xue, Shengjie Zhang, and Shengsheng Qian. 2024b. Badagent: Inserting and activating backdoor attacks in llm agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, pages 9811–9827. [find](https://scholar.google.com/scholar?q=Yifei+Wang%2C+Dizhan+Xue%2C+Shengjie+Zhang%2C+and+Shengsheng+Qian%2E+2024b%2E+Badagent%3A+Inserting+and+activating+backdoor+attacks+in+llm+agents%2E+In+Proceedings+of+the+62nd+Annual+Meeting+of+the+Association+for+)
48. Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. 2024. Mitigating backdoor attack by injecting proactive defensive backdoor. Advances in Neural Information Processing Systems, 37:80674–80705. [find](https://scholar.google.com/scholar?q=Shaokui+Wei%2C+Hongyuan+Zha%2C+and+Baoyuan+Wu%2E+2024%2E+Mitigating+backdoor+attack+by+injecting+proactive+defensive+backdoor%2E+Advances+in+Neural+Information+Processing+Systems%2C+37%3A80674%E2%80%9380705%2E)
49. Frank Xing. 2025. Designing heterogeneous llm agents for financial sentiment analysis. ACM Transactions on Management Information Systems, 16(1):1–24. [find](https://scholar.google.com/scholar?q=Frank+Xing%2E+2025%2E+Designing+heterogeneous+llm+agents+for+financial+sentiment+analysis%2E+ACM+Transactions+on+Management+Information+Systems%2C+16%281%29%3A1%E2%80%9324%2E)
50. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). arXiv preprint arXiv:2505.09388.
51. Tan Yue, Rui Mao, Xuzhao Shi, and Erik Cambria. 2026a. Interarm: Interpretable affective reasoning model for multimodal sarcasm detection. IEEE Transactions on Affective Computing. [find](https://scholar.google.com/scholar?q=Tan+Yue%2C+Rui+Mao%2C+Xuzhao+Shi%2C+and+Erik+Cambria%2E+2026a%2E+Interarm%3A+Interpretable+affective+reasoning+model+for+multimodal+sarcasm+detection%2E+IEEE+Transactions+on+Affective+Computing%2E)
52. Tan Yue, Xuzhao Shi, Rui Mao, Zilong Song, Zonghai Hu, and Dongyan Zhao. 2025. Anafig: A human-aligned dataset for scientific figure analysis. In Proceedings of the 33rd ACM International Conference on Multimedia, pages 12837–12843. [find](https://scholar.google.com/scholar?q=Tan+Yue%2C+Xuzhao+Shi%2C+Rui+Mao%2C+Zilong+Song%2C+Zonghai+Hu%2C+and+Dongyan+Zhao%2E+2025%2E+Anafig%3A+A+human%2Daligned+dataset+for+scientific+figure+analysis%2E+In+Proceedings+of+the+33rd+ACM+International+Conference+o)
53. Tan Yue, Qiong Wu, and Dongyan Zhao. 2026b. Mars: Multimodal adaptive reasoning model for avoiding overthinking. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 34539– 34547. [find](https://scholar.google.com/scholar?q=Tan+Yue%2C+Qiong+Wu%2C+and+Dongyan+Zhao%2E+2026b%2E+Mars%3A+Multimodal+adaptive+reasoning+model+for+avoiding+overthinking%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial+Intelligence%2C+volume+40%2C+pages+3453)
54. Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized llms. In 33rd USENIX Security Symposium, pages 1849–1866. [find](https://scholar.google.com/scholar?q=Rui+Zhang%2C+Hongwei+Li%2C+Rui+Wen%2C+Wenbo+Jiang%2C+Yuan+Zhang%2C+Michael+Backes%2C+Yun+Shen%2C+and+Yang+Zhang%2E+2024%2E+Instruction+backdoor+attacks+against+customized+llms%2E+In+33rd+USENIX+Security+Symposium%2C+pages+)
55. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. [Character-level convolutional networks for text classification](https://md.research.elamur.ai/free/en/papers/zhang-2015-character-level-convolutional-networks-text/). Advances in neural information processing systems, 28.
56. Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, and Jinming Wen. 2024a. Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3421–3438. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Leilei+Gan%2C+Luu+Anh+Tuan%2C+Jie+Fu%2C+Lingjuan+Lyu%2C+Meihuizi+Jia%2C+and+Jinming+Wen%2E+2024a%2E+Defending+against+weight%2Dpoisoning+backdoor+attacks+for+parameter%2Defficient+fine%2Dtuning%2E+In+Findings+o)
57. Shuai Zhao, Meihuizi Jia, Luu Anh Tuan, Fengjun Pan, and Jinming Wen. 2024b. Universal vulnerabilities in large language models: Backdoor attacks for in-context learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 11507–11522. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Meihuizi+Jia%2C+Luu+Anh+Tuan%2C+Fengjun+Pan%2C+and+Jinming+Wen%2E+2024b%2E+Universal+vulnerabilities+in+large+language+models%3A+Backdoor+attacks+for+in%2Dcontext+learning%2E+In+Proceedings+of+the+2024+Co)
58. Shuai Zhao, Qing Li, Yuer Yang, Jinming Wen, and Weiqi Luo. 2023a. From softmax to nucleusmax: A novel sparse language model for chinese radiology report summarization. ACM Transactions on Asian and Low-Resource Language Information Processing, 22(6):1–21. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Qing+Li%2C+Yuer+Yang%2C+Jinming+Wen%2C+and+Weiqi+Luo%2E+2023a%2E+From+softmax+to+nucleusmax%3A+A+novel+sparse+language+model+for+chinese+radiology+report+summarization%2E+ACM+Transactions+on+Asian+and+L)
59. Shuai Zhao, Qika Lin, Yanhao Jia, Xinyi Wu, Yuwen Li, and Luu Anh Tuan. 2026. Unifle: Uniform fusion of multiple lora experts for backdoor defense in large language models. IEEE Transactions on Dependable and Secure Computing. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Qika+Lin%2C+Yanhao+Jia%2C+Xinyi+Wu%2C+Yuwen+Li%2C+and+Luu+Anh+Tuan%2E+2026%2E+Unifle%3A+Uniform+fusion+of+multiple+lora+experts+for+backdoor+defense+in+large+language+models%2E+IEEE+Transactions+on+Depend)
60. Shuai Zhao, Jinming Wen, Anh Luu, Junbo Zhao, and Jie Fu. 2023b. Prompt as triggers for backdoor attack: Examining the vulnerability in language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 12303–12317. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Jinming+Wen%2C+Anh+Luu%2C+Junbo+Zhao%2C+and+Jie+Fu%2E+2023b%2E+Prompt+as+triggers+for+backdoor+attack%3A+Examining+the+vulnerability+in+language+models%2E+In+Proceedings+of+the+2023+Conference+on+Empiri)
61. Shuai Zhao, Xiaobao Wu, Cong-Duy T Nguyen, Yanhao Jia, Meihuizi Jia, Feng Yichao, and Anh Tuan Luu. 2025a. Unlearning backdoor attacks for llms with weak-to-strong knowledge distillation. In Findings of the Association for Computational Linguistics: ACL 2025, pages 4937–4952. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Xiaobao+Wu%2C+Cong%2DDuy+T+Nguyen%2C+Yanhao+Jia%2C+Meihuizi+Jia%2C+Feng+Yichao%2C+and+Anh+Tuan+Luu%2E+2025a%2E+Unlearning+backdoor+attacks+for+llms+with+weak%2Dto%2Dstrong+knowledge+distillation%2E+In+Findings+)
62. Shuai Zhao, Xiaoyu Xu, Luwei Xiao, Jinming Wen, and Luu Anh Tuan. 2025b. Clean-label backdoor attack and defense: An examination of language model vulnerability. Expert Systems with Applications, 265:125856. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Xiaoyu+Xu%2C+Luwei+Xiao%2C+Jinming+Wen%2C+and+Luu+Anh+Tuan%2E+2025b%2E+Clean%2Dlabel+backdoor+attack+and+defense%3A+An+examination+of+language+model+vulnerability%2E+Expert+Systems+with+Applications%2C+265%3A)
63. Shuai Zhao, Yulin Zhang, Luwei Xiao, Xinyi Wu, Yanhao Jia, Zhongliang Guo, Xiaobao Wu, Cong-Duy Nguyen, Guoming Zhang, and Anh Tuan Luu. 2025c. Affective-roptester: Capability and bias analysis of llms in predicting retinopathy of prematurity. IEEE Transactions on Affective Computing. [find](https://scholar.google.com/scholar?q=Shuai+Zhao%2C+Yulin+Zhang%2C+Luwei+Xiao%2C+Xinyi+Wu%2C+Yanhao+Jia%2C+Zhongliang+Guo%2C+Xiaobao+Wu%2C+Cong%2DDuy+Nguyen%2C+Guoming+Zhang%2C+and+Anh+Tuan+Luu%2E+2025c%2E+Affective%2Droptester%3A+Capability+and+bias+analysis+of+llm)
64. Wei Zhao, Mingyue Shang, Yang Liu, Liang Wang, and Jingming Liu. 2020. Ape210k: A large-scale and template-rich dataset of math word problems. arXiv preprint arXiv:2009.11506. [find](https://scholar.google.com/scholar?q=Wei+Zhao%2C+Mingyue+Shang%2C+Yang+Liu%2C+Liang+Wang%2C+and+Jingming+Liu%2E+2020%2E+Ape210k%3A+A+large%2Dscale+and+template%2Drich+dataset+of+math+word+problems%2E+arXiv+preprint+arXiv%3A2009%2E11506%2E)
65. Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, and 1 others. 2022. Moderate-fitting as a natural backdoor defender for pre-trained language models. Advances in Neural Information Processing Systems, 35:1086–1099. [find](https://scholar.google.com/scholar?q=Biru+Zhu%2C+Yujia+Qin%2C+Ganqu+Cui%2C+Yangyi+Chen%2C+Weilin+Zhao%2C+Chong+Fu%2C+Yangdong+Deng%2C+Zhiyuan+Liu%2C+Jingang+Wang%2C+Wei+Wu%2C+and+1+others%2E+2022%2E+Moderate%2Dfitting+as+a+natural+backdoor+defender+for+pre%2Dtraine)

*Updated 31 October 2026*