{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T02:43:54Z","timestamp":1784861034987,"version":"3.55.0"},"reference-count":101,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833579","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"2025-2042","source":"Crossref","is-referenced-by-count":42,"title":["Piccolo: Exposing Complex Backdoors in NLP Transformer Models"],"prefix":"10.1109","author":[{"given":"Yingqi","family":"Liu","sequence":"first","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guangyu","family":"Shen","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Guanhong","family":"Tao","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shengwei","family":"An","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shiqing","family":"Ma","sequence":"additional","affiliation":[{"name":"Rutgers University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiangyu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Purdue University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref56","year":"2021","journal-title":"Trojai past leaderboards"},{"key":"ref59","article-title":"Dynamic backdoor attacks against machine learning models","author":"salem","year":"2020","journal-title":"arXiv preprint arXiv 2003"},{"key":"ref58","first-page":"182","article-title":"Reflection backdoor: A natural backdoor attack on deep neural networks","author":"liu","year":"2020","journal-title":"European Conference on Computer Vision"},{"key":"ref53","author":"paszke","year":"2017","journal-title":"Automatic differentiation in pytorch"},{"key":"ref52","article-title":"Sequence transduction with recurrent neural networks","author":"graves","year":"2012","journal-title":"arXiv preprint arXiv 1211 3711"},{"key":"ref55","first-page":"649","article-title":"Character-level convolutional networks for text classification","volume":"28","author":"zhang","year":"2015","journal-title":"Advances in neural information processing systems"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N19-1144"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1018"},{"key":"ref50","first-page":"5998","article-title":"Attention is all you need","author":"vaswani","year":"2017","journal-title":"Advances in neural information processing systems"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"ref48","article-title":"Backdoor scanning for deep neural networks through karm optimization","author":"shen","year":"2021","journal-title":"arXiv preprint arXiv 2102 05988"},{"key":"ref47","article-title":"Onion: A simple and effective defense against textual backdoor attacks","author":"qi","year":"2020","journal-title":"arXiv preprint arXiv 2011 10068"},{"key":"ref42","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","author":"devlin","year":"2018","journal-title":"arXiv preprint arXiv 1810 04805"},{"key":"ref41","article-title":"Introduction to the conll-2003 shared task: Language-independent named entity recognition","author":"sang","year":"2003","journal-title":"Preprint arXiv cs\/0506083"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485370"},{"key":"ref43","author":"radford","year":"2019","journal-title":"Language Models are Unsupervised Multitask Learners"},{"key":"ref49","article-title":"Categorical reparameterization with gumbel-softmax","author":"jang","year":"2016","journal-title":"arXiv preprint arXiv 1611 01144"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref7","article-title":"Trojaning language models for fun and profit","author":"zhang","year":"2020","journal-title":"arXiv preprint arXiv 2008 00863"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref3","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"chen","year":"2017","journal-title":"arXiv preprint arXiv 1712 05526"},{"key":"ref6","article-title":"Weight poisoning attacks on pre-trained models","author":"kurita","year":"2020","journal-title":"arXiv preprint arXiv 2004 06774"},{"key":"ref5","article-title":"Badnl: Backdoor attacks against nlp models","author":"chen","year":"2020","journal-title":"arXiv preprint arXiv 2006 01997"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.3115\/1614049.1614064"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/SYNASC.2015.46"},{"key":"ref40","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","author":"socher","year":"2013","journal-title":"Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing"},{"key":"ref35","article-title":"Robust anomaly detection and backdoor attack detection via differential privacy","author":"du","year":"2019","journal-title":"International Conference on Learning Representations"},{"key":"ref34","article-title":"Poison as a cure: Detecting & neutralizing variable-sized backdoor attacks in deep neural networks","author":"chan","year":"2019","journal-title":"arXiv preprint arXiv 1911 08105"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1221"},{"key":"ref36","article-title":"Gradientbased adversarial attacks against text transformers","author":"guo","year":"2021","journal-title":"arXiv preprint arXiv 2104 13733"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SPW50608.2020.00025"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/ICCD.2017.16"},{"key":"ref33","article-title":"Detecting backdoors in neural networks using novel feature-based anomaly detection","author":"fu","year":"2020","journal-title":"arXiv preprint arXiv 2011 05151"},{"key":"ref32","article-title":"Spectral signatures in backdoor attacks","author":"tran","year":"2018","journal-title":"Advances in neural information processing systems"},{"key":"ref39","year":"2021","journal-title":"Trojai leaderboard"},{"key":"ref38","article-title":"T-miner: A generative approach to defend against trojan attacks on dnn-based text classification","author":"azizi","year":"2021","journal-title":"30th USENIX Security Symposium ( USENIX Security 21)"},{"key":"ref24","first-page":"14004","article-title":"Defending neural backdoors via generative distribution modeling","author":"qiao","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref23","article-title":"Detecting trojaned dnns using counterfactual attributions","author":"sikka","year":"2020","journal-title":"2012 arXiv preprint arXiv"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"ref25","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-030-00470-5_13","article-title":"Fine-pruning: Defending against backdooring attacks on deep neural networks","author":"liu","year":"2018","journal-title":"International Symposium on Research in Attacks Intrusions and Defenses"},{"key":"ref20","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","author":"tang","year":"2019","journal-title":"arXiv preprint arXiv 1908 00310"},{"key":"ref22","article-title":"Detecting ai trojans using meta neural analysis","author":"xu","year":"2019","journal-title":"arXiv preprint arXiv 1910 03759"},{"key":"ref21","first-page":"1299","article-title":"When does machine learning {FAIL}? generalized transferability for evasion and poisoning attacks","author":"suciu","year":"2018","journal-title":"27th USENIX Security Symposium ( USENIX Security 18)"},{"key":"ref28","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"chen","year":"2018","journal-title":"arXiv preprint arXiv 1811 03728"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref29","article-title":"Rethinking the trigger of backdoor attack","author":"li","year":"2020","journal-title":"arXiv preprint arXiv 2004 00493"},{"key":"ref13","first-page":"11826","article-title":"Attribution-based confidence metric for deep neural networks","author":"jha","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref14","article-title":"Noiseresponse analysis for rapid detection of backdoors in deep neural networks","author":"erichson","year":"2020","journal-title":"arXiv preprint arXiv 2008 00863"},{"key":"ref97","article-title":"Roberta: A robustly optimized bert pretraining approach","author":"liu","year":"2019","journal-title":"arXiv preprint arXiv 1907 11634"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.195"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref99","article-title":"Introduction to the conll2003 shared task: Language-independent named entity recognition","author":"tjong kim sang","year":"2003","journal-title":"Proceedings of the Seventh Conference on Natural Language Learning at HLT-NAACL 2003"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref98","article-title":"Bbn pronoun coreference and entity type corpus","author":"weischedel","year":"2005","journal-title":"Linguistic Data Consortium Philadelphia"},{"key":"ref17","article-title":"Cassandra: Detecting trojaned networks from adversarial perturbations","author":"zhang","year":"2020","journal-title":"arXiv preprint arXiv 2007 14638"},{"key":"ref16","article-title":"One-pixel signature: Characterizing cnn models for backdoor detection","author":"huang","year":"2020","journal-title":"arXiv preprint arXiv 2008 00863"},{"key":"ref19","article-title":"Nnoculation: broad spectrum and targeted treatment of backdoored dnns","author":"veldanda","year":"2020","journal-title":"arXiv preprint arXiv 2002 08046"},{"key":"ref18","article-title":"Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems","author":"guo","year":"2019","journal-title":"arXiv preprint arXiv 1908 01763"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3103064"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.659"},{"key":"ref95","article-title":"Learning word vectors for sentiment analysis","author":"maas","year":"2011","journal-title":"Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics Human Language Technologies"},{"key":"ref94","article-title":"Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter","author":"sanh","year":"2019","journal-title":"arXiv preprint arXiv 1910 01108"},{"key":"ref91","author":"turner","year":"2018","journal-title":"Clean-label backdoor attacks"},{"key":"ref90","first-page":"14443","article-title":"Cleanlabel backdoor attacks on video recognition models","author":"zhao","year":"2020","journal-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.3115\/1220575.1220619"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.500"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref82","article-title":"Textbugger: Generating adversarial text against real-world applications","author":"li","year":"2018","journal-title":"arXiv preprint arXiv 1812 05905"},{"key":"ref81","article-title":"Label sanitization against label flipping poisoning attacks","author":"paudice","year":"2018","journal-title":"Proceedings of the European Conference on Machine Learning and Knowledge Discovery in Databases"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.498"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"ref80","article-title":"Systematic poisoning attacks on and defenses for machine learning in healthcare","author":"mozaffari-kermani","year":"2014","journal-title":"IEEE Journal of Biomedical and Health Informatics"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196517"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/509"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/DAC18072.2020.9218663"},{"key":"ref77","article-title":"On certifying robustness against backdoor attacks via randomized smoothing","author":"wang","year":"2020","journal-title":"arXiv preprint arXiv 2002 11040"},{"key":"ref76","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"li","year":"2021","journal-title":"arXiv preprint arXiv 2101 02353"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58951-6_24"},{"key":"ref70","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","volume":"33","author":"wang","year":"2020","journal-title":"Advances in neural information processing systems"},{"key":"ref73","first-page":"1605","article-title":"Local model poisoning attacks to byzantine-robust federated learning","author":"fang","year":"2020","journal-title":"29th USENIX Security Symposium USENIX Security 20"},{"key":"ref72","first-page":"2938","article-title":"How to backdoor federated learning","author":"bagdasaryan","year":"2020","journal-title":"International Conference on Artificial Intelligence and Statistics"},{"key":"ref68","article-title":"With great training comes great vulnerability: Practical attacks against transfer learning","author":"wang","year":"2018","journal-title":"27th USENIX Security Symp"},{"key":"ref67","article-title":"A target-agnostic attack on deep models: Exploiting security vulnerabilities of transfer learning","author":"rezaei","year":"2019","journal-title":"arXiv preprint arXiv 1904 04370"},{"key":"ref69","article-title":"Dba: Distributed backdoor attacks against federated learning","author":"xie","year":"2019","journal-title":"International Conference on Learning Representations"},{"key":"ref64","article-title":"Handcrafted backdoors in deep neural networks","author":"hong","year":"2021","journal-title":"arXiv preprint arXiv 2106 04427"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref66","article-title":"Graph backdoor","author":"xi","year":"2020","journal-title":"arXiv preprint arXiv 2006 11116"},{"key":"ref65","article-title":"Backdoor attacks to graph neural networks","author":"zhang","year":"2020","journal-title":"arXiv preprint arXiv 2006 16578"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423362"},{"key":"ref62","article-title":"Why do adversarial attacks transfer? explaining transferability of evasion and poisoning attacks","author":"demontis","year":"2019","journal-title":"28th USENIX Security Symposium"},{"key":"ref61","first-page":"6103","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","author":"shafahi","year":"2018","journal-title":"Advances in neural information processing systems"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833579.pdf?arnumber=9833579","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:11:05Z","timestamp":1699485065000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833579\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":101,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833579","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}