{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,22]],"date-time":"2026-01-22T20:19:15Z","timestamp":1769113155214,"version":"3.49.0"},"publisher-location":"Cham","reference-count":35,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783031171390","type":"print"},{"value":"9783031171406","type":"electronic"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-17140-6_22","type":"book-chapter","created":{"date-parts":[[2022,9,24]],"date-time":"2022-09-24T06:19:49Z","timestamp":1664000389000},"page":"447-466","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":18,"title":["Kallima: A Clean-Label Framework for\u00a0Textual Backdoor Attacks"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6224-791X","authenticated-orcid":false,"given":"Xiaoyi","family":"Chen","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1299-683X","authenticated-orcid":false,"given":"Yinpeng","family":"Dong","sequence":"additional","affiliation":[]},{"given":"Zeyu","family":"Sun","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6820-6361","authenticated-orcid":false,"given":"Shengfang","family":"Zhai","sequence":"additional","affiliation":[]},{"given":"Qingni","family":"Shen","sequence":"additional","affiliation":[]},{"given":"Zhonghai","family":"Wu","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,9,25]]},"reference":[{"key":"22_CR1","unstructured":"Bahdanau, D., Cho, K., Bengio, Y.: Neural machine translation by jointly learning to align and translate. CoRR abs\/1409.0473 (2014)"},{"key":"22_CR2","doi-asserted-by":"crossref","unstructured":"Chan, A., Tay, Y., Ong, Y.S., Zhang, A.: Poison attacks against text datasets with conditional adversarially regularized autoencoder. CoRR abs\/2010.02684 (2020)","DOI":"10.18653\/v1\/2020.findings-emnlp.373"},{"key":"22_CR3","doi-asserted-by":"crossref","unstructured":"Chen, X., et al.: BadNL: backdoor attacks against NLP models with semantic-preserving improvements. In: ACSAC, pp. 554\u2013569. ACM (2021)","DOI":"10.1145\/3485832.3485837"},{"key":"22_CR4","doi-asserted-by":"publisher","first-page":"138872","DOI":"10.1109\/ACCESS.2019.2941376","volume":"7","author":"J Dai","year":"2019","unstructured":"Dai, J., Chen, C., Li, Y.: A backdoor attack against LSTM-based text classification systems. IEEE Access 7, 138872\u2013138878 (2019)","journal-title":"IEEE Access"},{"key":"22_CR5","unstructured":"Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding. CoRR abs\/1810.04805 (2018)"},{"key":"22_CR6","doi-asserted-by":"crossref","unstructured":"Gan, L., et al.: Triggerless backdoor attack for NLP tasks with clean labels. CoRR abs\/2111.07970 (2021)","DOI":"10.18653\/v1\/2022.naacl-main.214"},{"key":"22_CR7","unstructured":"Gu, T., Dolan-Gavitt, B., Grag, S.: BadNets: identifying vulnerabilities in the machine learning model supply chain. CoRR abs\/1708.06733 (2017)"},{"key":"22_CR8","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1162\/tacl_a_00299","volume":"8","author":"S Hisamoto","year":"2020","unstructured":"Hisamoto, S., Post, M., Duh, K.: Membership inference attacks on sequence-to-sequence models: is my data in your machine translation system? Trans. Assoc. Comput. Linguist. 8, 49\u201363 (2020)","journal-title":"Trans. Assoc. Comput. Linguist."},{"key":"22_CR9","doi-asserted-by":"crossref","unstructured":"Jin, D., Jin, Z., Zhou, J.T., Szolovits, P.: Is BERT really robust? A strong baseline for natural language attack on text classification and entailment. In: AAAI, pp. 8018\u20138025 (2020)","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"22_CR10","doi-asserted-by":"crossref","unstructured":"Kurita, K., Michel, P., Neubig, G.: Weight poisoning attacks on pretrained models. In: ACL, pp. 2793\u20132806. ACL, Online (2020)","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"22_CR11","unstructured":"Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., Soricut, R.: Albert: a lite BERT for self-supervised learning of language representations. In: ICLR (2019)"},{"key":"22_CR12","doi-asserted-by":"crossref","unstructured":"Li, J., et al.: TextBugger: generating adversarial text against real-world applications. In: Proceedings of the 26th NDSS (2019)","DOI":"10.14722\/ndss.2019.23138"},{"key":"22_CR13","doi-asserted-by":"crossref","unstructured":"Li, L., Ma, R., Guo, Q., Xue, X., Qiu, X.: BERT-ATTACK: adversarial attack against BERT using BERT. In: EMNLP, pp. 6193\u20136202. ACL, Online, November 2020","DOI":"10.18653\/v1\/2020.emnlp-main.500"},{"key":"22_CR14","doi-asserted-by":"crossref","unstructured":"Li, S., et al.: Hidden backdoors in human-centric language models. In: CCS. ACM (2021)","DOI":"10.1145\/3460120.3484576"},{"key":"22_CR15","doi-asserted-by":"crossref","unstructured":"Munikar, M., Shakya, S., Shrestha, A.: Fine-grained sentiment classification using BERT. CoRR abs\/1910.03474 (2019)","DOI":"10.1109\/AITB48515.2019.8947435"},{"key":"22_CR16","doi-asserted-by":"crossref","unstructured":"Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., Sun, M.: Mind the style of text! Adversarial and backdoor attacks based on text style transfer. In: EMNLP. ACL (2021)","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"22_CR17","doi-asserted-by":"crossref","unstructured":"Qi, F., et al.: Hidden killer: invisible textual backdoor attacks with syntactic trigger. In: Proceedings of the 59th ACL-IJCNLP, pp. 443\u2013453 (2021)","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"22_CR18","doi-asserted-by":"crossref","unstructured":"Qi, F., Yao, Y., Xu, S., Liu, Z., Sun, M.: Turn the combination lock: Learnable textual backdoor attacks via word substitution. In: Proceedings of the 59th ACL-IJCNLP, pp. 4873\u20134883 (2021)","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"22_CR19","unstructured":"Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., Sutskever, I.: Language models are unsupervised multitask learners. OpenAI blog (2019)"},{"key":"22_CR20","doi-asserted-by":"crossref","unstructured":"Rajpurkar, P., Jia, R., Liang, P.: Know what you don\u2019t know: unanswerable questions for squad. In: Proceedings of the 56th ACL, pp. 784\u2013789 (2018)","DOI":"10.18653\/v1\/P18-2124"},{"key":"22_CR21","doi-asserted-by":"crossref","unstructured":"Redmiles, E.M., Zhu, Z., Kross, S., Kuchhal, D., Dumitras, T., Mazurek, M.L.: Asking for a friend: evaluating response biases in security user studies. In: Proceedings of ACM CCS 2018, pp. 1238\u20131255 (2018)","DOI":"10.1145\/3243734.3243740"},{"key":"22_CR22","doi-asserted-by":"crossref","unstructured":"Reimers, N., Gurevych, I.: Sentence-BERT: sentence embeddings using Siamese BERT-networks. In: EMNLP-IJCNLP, pp. 3982\u20133992. ACL (2019)","DOI":"10.18653\/v1\/D19-1410"},{"key":"22_CR23","unstructured":"Sanh, V., Debut, L., Chaumond, J., Wolf, T.: DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter. CoRR abs\/1910.01108 (2019)"},{"key":"22_CR24","doi-asserted-by":"crossref","unstructured":"Sennrich, R., Haddow, B., Birch, A.: Improving neural machine translation models with monolingual data. In: ACL, pp. 86\u201396. ACL, Berlin (2016)","DOI":"10.18653\/v1\/P16-1009"},{"key":"22_CR25","doi-asserted-by":"crossref","unstructured":"Shokri, R., Stronati, M., Song, C., Shmatikov, V.: Membership inference attacks against machine learning models. In: S &P, pp. 3\u201318. IEEE (2017)","DOI":"10.1109\/SP.2017.41"},{"key":"22_CR26","unstructured":"Socher, R., et al.: Recursive deep models for semantic compositionality over a sentiment treebank. In: EMNLP, pp. 1631\u20131642. ACL (2013)"},{"key":"22_CR27","doi-asserted-by":"crossref","unstructured":"Song, C., Shmatikov, V.: Auditing data provenance in text-generation models. In: Proceedings of the 25th ACM SIGKDD, pp. 196\u2013206 (2019)","DOI":"10.1145\/3292500.3330885"},{"key":"22_CR28","unstructured":"Turner, A., Tsipras, D., Madry, A.: Label-consistent backdoor attacks. CoRR abs\/1912.02771 (2019)"},{"key":"22_CR29","doi-asserted-by":"crossref","unstructured":"Wang, B., et al.: Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In: S &P, pp. 707\u2013723. IEEE (2019)","DOI":"10.1109\/SP.2019.00031"},{"key":"22_CR30","unstructured":"Wolf, T., et al.: Transformers: state-of-the-art natural language processing. In: Proceedings of EMNLP 2020, pp. 38\u201345. ACL, Online (2020)"},{"key":"22_CR31","doi-asserted-by":"crossref","unstructured":"Zampieri, M., Malmasi, S., Nakov, P., Rosenthal, S., Farra, N., Kumar, R.: Predicting the type and target of offensive posts in social media. In: NAACL-HLT (2019)","DOI":"10.18653\/v1\/N19-1144"},{"key":"22_CR32","first-page":"649","volume":"28","author":"X Zhang","year":"2015","unstructured":"Zhang, X., Zhao, J., LeCun, Y.: Character-level convolutional networks for text classification. Adv. Neural. Inf. Process. Syst. 28, 649\u2013657 (2015)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"22_CR33","doi-asserted-by":"crossref","unstructured":"Zhang, X., Zhang, Z., Ji, S., Wang, T.: Trojaning language models for fun and profit. CoRR abs\/2008.00312 (2020)","DOI":"10.1109\/EuroSP51992.2021.00022"},{"key":"22_CR34","doi-asserted-by":"crossref","unstructured":"Zhang, Y., Tao, G., Sun, X.: Parallel data augmentation for formality style transfer. In: ACL (2020)","DOI":"10.18653\/v1\/2020.acl-main.294"},{"key":"22_CR35","doi-asserted-by":"crossref","unstructured":"Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., Jiang, Y.G.: Clean-label backdoor attacks on video recognition models. In: CVPR, pp. 14431\u201314440 (2020)","DOI":"10.1109\/CVPR42600.2020.01445"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2022"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-17140-6_22","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,24]],"date-time":"2022-09-24T06:24:25Z","timestamp":1664000665000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-17140-6_22"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031171390","9783031171406"],"references-count":35,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-17140-6_22","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"25 September 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Copenhagen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Denmark","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 September 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2022.compute.dtu.dk\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"562","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"104","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"6","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3.4","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"12","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}