{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,18]],"date-time":"2026-01-18T14:25:14Z","timestamp":1768746314229,"version":"3.49.0"},"reference-count":96,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833572","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T15:28:05Z","timestamp":1658935685000},"page":"769-786","source":"Crossref","is-referenced-by-count":29,"title":["Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures"],"prefix":"10.1109","author":[{"given":"Eugene","family":"Bagdasaryan","sequence":"first","affiliation":[{"name":"Cornell Tech"}]},{"given":"Vitaly","family":"Shmatikov","sequence":"additional","affiliation":[{"name":"Cornell Tech"}]}],"member":"263","reference":[{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5767"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-4009"},{"key":"ref12","article-title":"BadNL: Backdoor attacks against NLP models","author":"chen","year":"2020","journal-title":"ACSAC"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.441"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2012.75"},{"key":"ref59","article-title":"Improving language understanding by generative pre-training","author":"radford","year":"2018","journal-title":"OpenAIRE blog"},{"key":"ref14","article-title":"SentiNet: Detecting physical attacks against deep learning systems","author":"chou","year":"2020","journal-title":"DLS"},{"key":"ref58","article-title":"BLEU: A method for automatic evaluation of machine translation","author":"papineni","year":"2002","journal-title":"ACL"},{"key":"ref53","article-title":"A century of spin: How public relations became the cutting edge of corporate power","author":"miller","year":"2008"},{"key":"ref96","article-title":"Red alarm for pre-trained models: Universal vulnerability to neuron-level backdoor attacks","author":"zhang","year":"2021","journal-title":"ICML Workshop"},{"key":"ref52","article-title":"Spin control: The White House Office of Communications and the management of presidential news","author":"maltese","year":"2000"},{"key":"ref11","article-title":"BadPre: Task-agnostic backdoor attacks to pre-trained NLP foundation models","author":"chen","year":"2022","journal-title":"ICLRE"},{"key":"ref55","article-title":"Facebook FAIR’s WMT19 news translation task submission","author":"ng","year":"2019","journal-title":"WMT"},{"key":"ref10","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"chen","year":"2019","journal-title":"AAAI SafeAI"},{"key":"ref54","article-title":"Don’t give me the details, just the summary! Topic-aware convolutional neural networks for extreme summarization","author":"narayan","year":"2018","journal-title":"EMNLP"},{"key":"ref17","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"devlin","year":"2019","journal-title":"NAACL"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.crma.2012.03.014"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref18","article-title":"The supply of disinformation will soon be infinite","author":"diresta","year":"2020","journal-title":"The Atlantic"},{"key":"ref93","article-title":"PEGASUS: Pre-training with extracted gap-sentences for abstractive summarization","author":"zhang","year":"2020","journal-title":"ICML"},{"key":"ref92","article-title":"Defending against neural fake news","author":"zellers","year":"2019","journal-title":"NeurIPS"},{"key":"ref95","article-title":"Trojaning language models for fun and profit","author":"zhang","year":"2021","journal-title":"EuroS&P"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412762"},{"key":"ref94","article-title":"Character-level convolutional networks for text classification","author":"zhang","year":"2015","journal-title":"NIPS"},{"key":"ref50","article-title":"RoBERTa: A robustly optimized BERT pretraining approach","author":"liu","year":"2019","journal-title":"arXiv 1907 11692"},{"key":"ref91","article-title":"Regula subrosa: Latent backdoor attacks on deep neural networks","author":"yao","year":"2019","journal-title":"CCS"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"ref89","article-title":"Transformers: State-of-theart natural language processing","author":"wolf","year":"2020","journal-title":"EMNLP System Demonstrations"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.703"},{"key":"ref48","article-title":"ROUGE: A package for automatic evaluation of summaries","author":"lin","year":"2004","journal-title":"ACL2 Workshop"},{"key":"ref47","article-title":"Backdoor learning: A survey","author":"li","year":"2020","journal-title":"arXiv 2007 08745"},{"key":"ref86","author":"wilcox","year":"2011","journal-title":"Introduction to Robust Estimation and Hypothesis Testing"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"ref85","article-title":"A Rulebook for Arguments","author":"weston","year":"2018"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300469"},{"key":"ref88","article-title":"Funny Names","author":"winer","year":"2021"},{"key":"ref44","article-title":"Weight poisoning attacks on pre-trained models","author":"kurita","year":"2020","journal-title":"ACL"},{"key":"ref87","article-title":"A broadcoverage challenge corpus for sentence understanding through inference","author":"williams","year":"2018","journal-title":"NAACL"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-4020"},{"key":"ref49","article-title":"Fine-pruning: Defending against backdooring attacks on deep neural networks","author":"liu","year":"2018","journal-title":"RAID"},{"key":"ref8","article-title":"Truth, lies, and automation","author":"buchanan","year":"2021","journal-title":"Center for Security and Emerging Technology"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W16-2301"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1126\/science.aal4230"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.3115\/1219840.1219914"},{"key":"ref3","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"2020","journal-title":"AISTATS"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.485"},{"key":"ref5","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"ICML"},{"key":"ref82","article-title":"Customizing triggers with concealed data poisoning","author":"wallace","year":"2021","journal-title":"NAACL"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-2102"},{"key":"ref84","article-title":"Putting words into the system’s mouth: A targeted attack on neural machine translation using monolingual data poisoning","author":"wang","year":"2021","journal-title":"ACLIJCNLP"},{"key":"ref40","article-title":"Handcrafted backdoors in deep neural networks","author":"hong","year":"2021","journal-title":"arXiv 2106 04690"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref80","article-title":"Attention is all you need","author":"vaswani","year":"2017","journal-title":"NIPS"},{"key":"ref79","article-title":"Spectral signatures in backdoor attacks","author":"tran","year":"2018","journal-title":"NIPS"},{"key":"ref35","article-title":"Manufacturing consent: The political economy of the mass media","author":"herman","year":"2010","journal-title":"Random House"},{"key":"ref78","article-title":"Reassessing claims of human parity and superhuman performance in machine translation at WMT 2019","author":"toral","year":"2020","journal-title":"EAMT"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1080\/00224545.1943.9921701"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.3102\/00346543056004473"},{"key":"ref36","article-title":"Teaching machines to read and comprehend","author":"hermann","year":"2015","journal-title":"NIPS"},{"key":"ref75","article-title":"Sequence to sequence learning with neural networks","author":"sutskever","year":"2014","journal-title":"NIPS"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.2307\/2285666"},{"key":"ref74","article-title":"How Propaganda Works","author":"stanley","year":"2015"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511806544"},{"key":"ref33","article-title":"Detoxify","author":"hanu","year":"2020"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.263"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1093\/jcmc\/zmz022"},{"key":"ref2","article-title":"Blind backdoors in deep learning models","author":"bagdasaryan","year":"2021","journal-title":"Usenix Security"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2019.106190"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref71","article-title":"Multi-task learning as multiobjective optimization","author":"sener","year":"2018","journal-title":"NIPS"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-1099"},{"key":"ref73","article-title":"MASS: Masked sequence to sequence pre-training for language generation","author":"song","year":"2019","journal-title":"ICML"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1212"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/2964791.2901462"},{"key":"ref68","article-title":"You autocomplete me: Poisoning vulnerabilities in neural code completion","author":"schuster","year":"2021","journal-title":"Usenix Security"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1177\/016344300022004008"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00115"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref25","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"gao","year":"2020","journal-title":"arXiv 2007 10760"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1002\/9781119241485"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.454"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"key":"ref63","article-title":"A maximum entropy model for part-ofspeech tagging","author":"ratnaparkhi","year":"1996","journal-title":"EMNLP"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00373"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.2307\/2291267"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-2006"},{"key":"ref65","article-title":"Name dataset","author":"remy","year":"2021"},{"key":"ref28","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"ICLRE"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-5409"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N18-1065"},{"key":"ref60","article-title":"Language models are unsupervised multitask learners","author":"radford","year":"2019","journal-title":"OpenAIRE blog"},{"key":"ref62","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer","author":"raffel","year":"2020","journal-title":"JMLR"},{"key":"ref61","article-title":"Language modelling at scale: Gopher, ethical considerations, and retrieval","author":"rae","year":"2021","journal-title":"DeepMind blog"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833572.pdf?arnumber=9833572","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T18:05:50Z","timestamp":1699466750000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833572\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":96,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833572","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}