{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T16:30:09Z","timestamp":1775665809201,"version":"3.50.1"},"reference-count":127,"publisher":"IEEE","license":[{"start":{"date-parts":[[2024,9,24]],"date-time":"2024-09-24T00:00:00Z","timestamp":1727136000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,9,24]],"date-time":"2024-09-24T00:00:00Z","timestamp":1727136000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000185","name":"DARPA","doi-asserted-by":"publisher","award":["HR00112490370"],"award-info":[{"award-number":["HR00112490370"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024,9,24]]},"DOI":"10.1109\/allerton63246.2024.10735305","type":"proceedings-article","created":{"date-parts":[[2024,11,4]],"date-time":"2024-11-04T18:31:52Z","timestamp":1730745112000},"page":"1-8","source":"Crossref","is-referenced-by-count":4,"title":["Mitigating Backdoor Threats to Large Language Models: Advancement and Challenges"],"prefix":"10.1109","author":[{"given":"Qin","family":"Liu","sequence":"first","affiliation":[{"name":"University of California, Davis"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenjie","family":"Mo","sequence":"additional","affiliation":[{"name":"University of California, Davis"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Terry","family":"Tong","sequence":"additional","affiliation":[{"name":"University of California, Davis"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiashu","family":"Xu","sequence":"additional","affiliation":[{"name":"NVIDIA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fei","family":"Wang","sequence":"additional","affiliation":[{"name":"University of Southern California"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chaowei","family":"Xiao","sequence":"additional","affiliation":[{"name":"University of Wisconsin,Madison"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Muhao","family":"Chen","sequence":"additional","affiliation":[{"name":"University of California, Davis"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"NAACL"},{"key":"ref2","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","volume":"21","author":"Raffel","year":"2020","journal-title":"JMLR"},{"key":"ref3","article-title":"Language models are few-shot learners","volume":"33","author":"Brown","year":"2020","journal-title":"NeurIPS"},{"key":"ref4","article-title":"Palm: Scaling language modeling with pathways","author":"Chowdhery","year":"2022","journal-title":"arXiv preprint"},{"key":"ref5","article-title":"Using deepspeed and megatron to train megatron-turing nlg 530b, a large-scale generative language model","author":"Smith","year":"2022","journal-title":"arXiv preprint"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1201\/9781003278290-9"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.lindif.2023.102274"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1093\/bib\/bbac409"},{"key":"ref9","article-title":"Recommendation as instruction following: A large language model empowered recommendation approach","author":"Zhang","year":"2023","journal-title":"arXiv preprint"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3491101.3519729"},{"key":"ref11","volume-title":"Gpt-4 technical report","year":"2023"},{"key":"ref12","article-title":"Open problems and fundamental limitations of reinforcement learning from human feedback","author":"Casper","year":"2023","journal-title":"arXiv preprint"},{"key":"ref13","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv preprint"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.171"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.337"},{"key":"ref16","article-title":"Finbert: Financial sentiment analysis with pre-trained language models","author":"Araci","year":"2019","journal-title":"arXiv preprint"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.patter.2023.100729"},{"key":"ref18","article-title":"Gpt-driver: Learning to drive with gpt","author":"Mao","year":"2023","journal-title":"arXiv preprint"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.acl-long.244"},{"key":"ref20","article-title":"Multitask prompted training enables zero-shot task generalization","volume-title":"ICLR","author":"Sanh","year":"2022"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-tutorials.2"},{"key":"ref22","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv preprint"},{"key":"ref23","article-title":"Backdoor attacks to pre-trained unified foundation models","author":"Yuan","year":"2023","journal-title":"arXiv preprint"},{"key":"ref24","first-page":"12 951","article-title":"BITE: Textual backdoor attacks with iterative trigger injection","volume-title":"Proceedings of the 61 st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)","author":"Yan"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref26","article-title":"Badnl: Backdoor attacks against nlp models","volume-title":"ICML 2021 Workshop on Adversarial Machine Learning","author":"Salem","year":"2021"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.757"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref30","article-title":"Textual backdoor attacks can be more harmful via two simple tricks","author":"Chen","year":"2021","journal-title":"arXiv preprint"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1423"},{"key":"ref32","article-title":"Word-level textual adversarial attacking as combinatorial optimization","author":"Zang","year":"2019","journal-title":"arXiv preprint"},{"key":"ref33","article-title":"Sleeper agents: Training deceptive llms that persist through safety training","author":"Hubinger","year":"2024","journal-title":"arXiv preprint"},{"key":"ref34","article-title":"Future events as backdoor triggers: Investigating temporal vulnerabilities in llms","author":"Price","year":"2024","journal-title":"arXiv preprint"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1221"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.13"},{"key":"ref37","article-title":"Learning to poison large language models during instruction tuning","author":"Qiang","year":"2024","journal-title":"arXiv preprint"},{"key":"ref38","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-031-51518-7","article-title":"Generating label cohesive and well-formed adversarial claims","author":"Atanasova","year":"2024","journal-title":"Accountable and Explainable Methods for Complex Reasoning over Text"},{"key":"ref39","article-title":"Textual backdoor attacks with iterative trigger injection","author":"Yan","year":"2022","journal-title":"arXiv preprint"},{"key":"ref40","article-title":"On the exploitability of instruction tuning","author":"Shu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref41","article-title":"Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger","volume":"abs\/2304.14475","author":"Li","year":"2023","journal-title":"CoRR"},{"key":"ref42","volume":"abs\/2309.03409","author":"Yang","year":"2023","journal-title":"Large language models as optimizers"},{"key":"ref43","article-title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","author":"Qi","year":"2023","journal-title":"arXiv preprint"},{"key":"ref44","article-title":"Trustllm: Trustworthiness in large language models","author":"Sun","year":"2024","journal-title":"arXiv preprint"},{"key":"ref45","article-title":"Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models","author":"Li","year":"2024","journal-title":"arXiv preprint"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.217"},{"key":"ref47","article-title":"Lora: Low-rank adaptation of large language models","volume-title":"ICLR","author":"Hu","year":"2021"},{"key":"ref48","article-title":"Parameter-efficient transfer learning for nlp","volume-title":"ICML","author":"Houlsby","year":"2019"},{"key":"ref49","article-title":"The philosopher\u2019s stone: Trojaning plugins of large language models","author":"Dong","year":"2023","journal-title":"arXiv preprint"},{"key":"ref50","article-title":"Lora-as-an-attack! piercing llm safety under the share-and-play scenario","author":"Liu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref51","article-title":"On the exploitability of instruction tuning","volume":"36","author":"Shu","year":"2023","journal-title":"NeurIPS"},{"key":"ref52","volume-title":"Stanford alpaca: An instruction-following llama model","author":"Taori","year":"2023"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.180"},{"key":"ref54","article-title":"Poisoning language models during instruction tuning","author":"Wan","year":"2023","journal-title":"arXiv preprint"},{"key":"ref55","article-title":"Securing multi-turn conversational language models against distributed backdoor triggers","author":"Tong","year":"2024","journal-title":"EMNLP - Findings"},{"key":"ref56","volume-title":"Exploring backdoor vulnerabilities of chat models","author":"Hao","year":"2024"},{"key":"ref57","volume-title":"Badchain: Backdoor chain-of-thought prompting for large language models","author":"Xiang","year":"2024"},{"key":"ref58","article-title":"The rise and potential of large language model based agents: A survey","author":"Xi","year":"2023","journal-title":"arXiv preprint"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s11704-024-40231-1"},{"key":"ref60","article-title":"Watch out for your agents! investigating backdoor threats to llm-based agents","author":"Yang","year":"2024","journal-title":"arXiv preprint"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.530"},{"key":"ref62","article-title":"Adaptivebackdoor: Backdoored language model agents that detect human overseers","volume-title":"ICML 2024 Next Generation of AI Safety Workshop","author":"Wang"},{"key":"ref63","volume-title":"Badmerging: Backdoor attacks against model merging","author":"Zhang","year":"2024"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104041"},{"key":"ref65","article-title":"Uncertainty is fragile: Manipulating uncertainty in large language models","author":"Zeng","year":"2024","journal-title":"arXiv preprint"},{"key":"ref66","article-title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","author":"Bai","year":"2022","journal-title":"arXiv preprint"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.140"},{"key":"ref68","article-title":"Universal jailbreak backdoors from poisoned human feedback","volume-title":"ICLR","author":"Rando","year":"2024"},{"key":"ref69","article-title":"Best-of-venom: Attacking rlhf by injecting poisoned preference data","author":"Baumg\u00e4rtner","year":"2024","journal-title":"arXiv preprint"},{"key":"ref70","article-title":"Badgpt: Exploring security vulnerabilities of chatgpt via backdoor attacks to instructgpt","author":"Shi","year":"2023","journal-title":"arXiv preprint"},{"key":"ref71","article-title":"Optimization-based prompt injection attack to llm-as-a-judge","author":"Shi","year":"2024","journal-title":"arXiv preprint"},{"key":"ref72","article-title":"Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models","author":"Zou","year":"2024","journal-title":"arXiv preprint"},{"key":"ref73","article-title":"Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models","author":"Xue","year":"2024","journal-title":"arXiv preprint"},{"key":"ref74","article-title":"Exploring backdoor attacks against large language model-based decision making","author":"Jiao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref75","volume-title":"Backdoor attacks on dense passage retrievers for disseminating misinformation","author":"Long","year":"2024"},{"key":"ref76","article-title":"Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models","author":"Cheng","year":"2024","journal-title":"arXiv preprint"},{"key":"ref77","volume-title":"Backdoor attacks for in-context learning with language models","author":"Kandpal","year":"2023"},{"key":"ref78","volume-title":"Universal vulnerabilities in large language models: Backdoor attacks for in-context learning","author":"Zhao","year":"2024"},{"key":"ref79","volume-title":"On the opportunities and risks of foundation models","author":"Bommasani","year":"2022"},{"key":"ref80","article-title":"Many-shot jailbreaking","author":"Anil","year":"2024","journal-title":"Anthropic"},{"key":"ref81","article-title":"Badedit: Backdooring large language models by model editing","author":"Li","year":"2024","journal-title":"arXiv preprint"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3627673.3679821"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref84","article-title":"Adversarial unlearning of backdoors via implicit hypergradient","volume-title":"ICLR","author":"Zeng","year":"2022"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.27"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.40"},{"key":"ref88","doi-asserted-by":"crossref","first-page":"504","DOI":"10.18653\/v1\/2023.findings-acl.32","article-title":"Robust natural language understanding with residual attention debiasing","volume-title":"Findings of the Association for Computational Linguistics: ACL 2023","author":"Wang","year":"2023"},{"key":"ref89","article-title":"Backdoor attack in the physical world","volume-title":"ICLR Workshop","author":"Li","year":"2021"},{"key":"ref90","article-title":"Fine-mixing: Mitigating backdoors in fine-tuned language models","author":"Zhang","year":"2022","journal-title":"Findings: EMNLP"},{"key":"ref91","article-title":"Here\u2019s a free lunch: Sanitizing backdoored models with model merge","author":"Arora","year":"2024","journal-title":"Findings: ACL"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref94","article-title":"Deep probabilistic models to detect data poisoning attacks","volume-title":"NeurIPS Workshop","author":"Subedar","year":"2019"},{"key":"ref95","article-title":"Robust anomaly detection and backdoor attack detection via differential privacy","volume-title":"ICLR","author":"Du","year":"2020"},{"issue":"9","key":"ref96","article-title":"A unified framework for analyzing and detecting malicious examples of dnn models","volume":"8","author":"Jin","year":"2020","journal-title":"arXiv preprint"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/3400302.3415671"},{"key":"ref98","article-title":"Test-time backdoor mitigation for black-box large language models with defensive demonstrations","author":"Mo","year":"2023","journal-title":"arXiv preprint"},{"key":"ref99","article-title":"Defending against insertion-based textual backdoor attacks via attribution","author":"Li","year":"2023","journal-title":"Findings: ACL"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3055844"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.659"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.60"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW54120.2021.00008"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.348"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref107","article-title":"The trojan detection challenge","author":"Mazeika","year":"2022","journal-title":"NeurIPS 2022 Competition Track"},{"key":"ref108","article-title":"{T-Miner}: A generative approach to defend against trojan attacks on {DNN-based} text classification","author":"Azizi","year":"2021","journal-title":"USENIX Security"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref110","volume-title":"Fact sheet: President biden issues executive order on safe, secure, and trustworthy artificial intelligence","year":"2023"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.35467\/cal\/187256"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3656289"},{"key":"ref113","article-title":"Exploring backdoor vulnerabilities of chat models","author":"Hao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref114","article-title":"Backdoor attacks for in-context learning with language models","volume-title":"The Second Workshop on New Frontiers in Adversarial Machine Learning","author":"Kandpal"},{"key":"ref115","article-title":"Universal vulnerabilities in large language models: Backdoor attacks for in-context learning","author":"Zhao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref116","article-title":"Cognitive overload: Jailbreaking large language models with overloaded logical thinking","author":"Xu","year":"2024","journal-title":"Findings: NAACL"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00179"},{"key":"ref118","article-title":"Scaling laws for data poisoning in llms","author":"Bowen","year":"2024","journal-title":"arXiv preprint"},{"key":"ref119","article-title":"Data advisor: Constitutional data curation for safety alignment of large language models","author":"Wang","year":"2024","journal-title":"EMNLP"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.1013"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01617"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.399"},{"key":"ref123","article-title":"Rigorllm: Resilient guardrails for large language models against undesired content","author":"Yuan","year":"2024","journal-title":"arXiv preprint"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3361661"},{"key":"ref125","article-title":"Deceptprompt: Exploiting llm-driven code generation via adversarial natural language instructions","author":"Wu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.26"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.371"}],"event":{"name":"2024 60th Annual Allerton Conference on Communication, Control, and Computing (Allerton)","location":"Urbana, IL, USA","start":{"date-parts":[[2024,9,24]]},"end":{"date-parts":[[2024,9,27]]}},"container-title":["2024 60th Annual Allerton Conference on Communication, Control, and Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10735178\/10735179\/10735305.pdf?arnumber=10735305","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,27]],"date-time":"2024-11-27T05:13:17Z","timestamp":1732684397000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10735305\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,24]]},"references-count":127,"URL":"https:\/\/doi.org\/10.1109\/allerton63246.2024.10735305","relation":{},"subject":[],"published":{"date-parts":[[2024,9,24]]}}}