{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,7]],"date-time":"2026-07-07T11:04:47Z","timestamp":1783422287143,"version":"3.54.6"},"reference-count":65,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62206009"],"award-info":[{"award-number":["62206009"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Fundamental Research Funds for the Central Universities, Grants from the State Key Laboratory of Complex and Critical Software Environment"},{"DOI":"10.13039\/501100012130","name":"Chinese Aeronautical Establishment","doi-asserted-by":"publisher","award":["20230017051001"],"award-info":[{"award-number":["20230017051001"]}],"id":[{"id":"10.13039\/501100012130","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Outstanding Research Project of the Shen Yuan Honors College, Beihang University.","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3555410","type":"journal-article","created":{"date-parts":[[2025,3,28]],"date-time":"2025-03-28T03:25:46Z","timestamp":1743132346000},"page":"3979-3994","source":"Crossref","is-referenced-by-count":14,"title":["Compromising LLM Driven Embodied Agents With Contextual Backdoor Attacks"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4224-1318","authenticated-orcid":false,"given":"Aishan","family":"Liu","sequence":"first","affiliation":[{"name":"State Key Laboratory of Complex and Critical Software Environment (SKLCCSE) and the School of Computer Science and Engineering (SCSE), Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5069-4563","authenticated-orcid":false,"given":"Yuguang","family":"Zhou","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex and Critical Software Environment (SKLCCSE) and the School of Computer Science and Engineering (SCSE), Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8425-4195","authenticated-orcid":false,"given":"Xianglong","family":"Liu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex and Critical Software Environment (SKLCCSE) and the School of Computer Science and Engineering (SCSE), Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9874-6828","authenticated-orcid":false,"given":"Tianyuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Complex and Critical Software Environment (SKLCCSE) and the School of Computer Science and Engineering (SCSE), Beihang University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Siyuan","family":"Liang","sequence":"additional","affiliation":[{"name":"School of Computing, National University of Singapore, Queenstown, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiakai","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6154-1247","authenticated-orcid":false,"given":"Yanjun","family":"Pu","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2207-1622","authenticated-orcid":false,"given":"Tianlin","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4733-023X","authenticated-orcid":false,"given":"Junqi","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4703-4641","authenticated-orcid":false,"given":"Wenbo","family":"Zhou","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, University of Science and Technology of China, Hefei, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0974-9299","authenticated-orcid":false,"given":"Qing","family":"Guo","sequence":"additional","affiliation":[{"name":"Agency for Science, Technology and Research (A*STAR), Fusionopolis, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7225-5449","authenticated-orcid":false,"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Jurong West, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-020-00250-6"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1038\/s41467-021-25874-z"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-43505-2_37"},{"key":"ref4","volume-title":"ChatGPT","year":"2023"},{"key":"ref5","article-title":"VoxPoser: Composable 3D value maps for robotic manipulation with language models","author":"Huang","year":"2023","journal-title":"arXiv:2307.05973"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01436"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA48891.2023.10161317"},{"key":"ref8","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref9","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref10","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. NeurIPS","author":"Nguyen"},{"key":"ref11","first-page":"46595","article-title":"Judging LLM-as-a-judge with MT-bench and chatbot arena","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zheng"},{"key":"ref12","first-page":"139","article-title":"Generative adversarial nets","volume-title":"Proc. NeurIPS","author":"Goodfellow"},{"key":"ref13","article-title":"Prompt optimization via adversarial in-context learning","author":"Long Do","year":"2023","journal-title":"arXiv:2312.02614"},{"key":"ref14","first-page":"24824","article-title":"Chain-of-thought prompting elicits reasoning in large language models","volume-title":"Proc. NeurIPS","author":"Lee"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.64"},{"key":"ref16","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume-title":"Proc. NeurIPS","author":"Ouyang"},{"key":"ref17","volume-title":"GPT Base Models","year":"2023"},{"key":"ref18","article-title":"Gemini: A family of highly capable multimodal models","author":"Team","year":"2023","journal-title":"arXiv:2312.11805"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02327"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02333-y"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.171"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.337"},{"key":"ref24","article-title":"Universal jailbreak backdoors from poisoned human feedback","author":"Rando","year":"2023","journal-title":"arXiv:2311.14455"},{"key":"ref25","volume-title":"Backdoor activation attack: Attack large language models using activation steering for safety-alignment","author":"Wang","year":"2023"},{"key":"ref26","article-title":"BadEdit: Backdooring large language models by model editing","author":"Li","year":"2024","journal-title":"arXiv:2403.13355"},{"key":"ref27","article-title":"BackdoorLLM: A comprehensive benchmark for backdoor attacks on large language models","author":"Li","year":"2024","journal-title":"arXiv:2408.12798"},{"key":"ref28","article-title":"BadChain: Backdoor chain-of-thought prompting for large language models","author":"Xiang","year":"2024","journal-title":"arXiv:2401.12242"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.642"},{"key":"ref30","article-title":"Backdoor attacks for in-context learning with language models","author":"Kandpal","year":"2023","journal-title":"arXiv:2307.14692"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.227"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.399"},{"key":"ref33","first-page":"1559","article-title":"You autocomplete me: Poisoning vulnerabilities in neural code completion","volume-title":"Proc. USENIX Secur. Symp.","author":"Schuster"},{"key":"ref34","volume-title":"Machine Learning and Security: Protecting Systems With Data and Algorithms","author":"Chio","year":"2018"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.23919\/cje.2022.00.031"},{"key":"ref36","article-title":"Coercing LLMs to do and reveal (almost) anything","author":"Geiping","year":"2024","journal-title":"arXiv:2402.14020"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00886"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2020.2974707"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P17-2034"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00686"},{"key":"ref41","article-title":"Llama 2: Open foundation and fine-tuned chat models","author":"Touvron","year":"2023","journal-title":"arXiv:2307.09288"},{"key":"ref42","article-title":"In-context example selection with influences","author":"Nguyen","year":"2023","journal-title":"arXiv:2302.11042"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.759"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-2012"},{"key":"ref46","article-title":"High-resolution image synthesis with latent diffusion models","author":"Rombach","year":"2021","journal-title":"arXiv:2112.10752"},{"key":"ref47","volume-title":"JetBot","year":"2021"},{"key":"ref48","volume-title":"Pixloop","year":"2024"},{"key":"ref49","volume-title":"Who We Are","year":"2024"},{"key":"ref50","volume-title":"Pixkit Autonomous Driving Manual","year":"2023"},{"key":"ref51","first-page":"3309","article-title":"Dirty road can attack: Security of deep learning based automated lane centering under physical-world attack","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Sato"},{"key":"ref52","volume-title":"California Vehicle Code 23113","year":"2000"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.256"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.559"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3361661"},{"key":"ref56","article-title":"Learning to retrieve prompts for in-context learning","author":"Rubin","year":"2021","journal-title":"arXiv:2112.08633"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623175"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/9923234"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR56361.2022.9956690"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TITS.2020.2975043"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3624379"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616617"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.685"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-024-00485-2"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10943262.pdf?arnumber=10943262","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,22]],"date-time":"2025-04-22T17:38:41Z","timestamp":1745343521000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10943262\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":65,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3555410","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}