{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T17:12:47Z","timestamp":1754154767210,"version":"3.41.2"},"reference-count":67,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302121"],"award-info":[{"award-number":["62302121"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3587194","type":"journal-article","created":{"date-parts":[[2025,7,9]],"date-time":"2025-07-09T23:05:58Z","timestamp":1752102358000},"page":"7347-7361","source":"Crossref","is-referenced-by-count":0,"title":["Contrastive Learning and Feature Space Tactics: A Dual Approach to Strengthen Backdoor Attacks"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-8086-7779","authenticated-orcid":false,"given":"Hao","family":"Fu","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2160-6111","authenticated-orcid":false,"given":"Ming","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Information Technology, Deakin University, Burwood, VIC, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4597-1583","authenticated-orcid":false,"given":"Rongsheng","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Harbin Engineering University, Harbin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1612"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3437963.3441667"},{"key":"ref3","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. NIPS","author":"Brown"},{"issue":"8","key":"ref4","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI Blog"},{"key":"ref5","article-title":"Evaluating large language models trained on code","author":"Chen","year":"2021","journal-title":"arXiv:2107.03374"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE60146.2024.00285"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2024.123713"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-021-3536-5"},{"key":"ref10","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref12","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref13","first-page":"18944","article-title":"Backdoor attack with imperceptible input and latent modification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Doan"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.214"},{"key":"ref15","first-page":"2985","article-title":"ChatGPT as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Hum. Lang. Technol.","author":"Li"},{"key":"ref16","first-page":"12951","article-title":"BITE: Textual backdoor attacks with iterative trigger injection","volume-title":"Proc. 61st Annu. Meeting Assoc. Comput. Linguistics","author":"Yan"},{"key":"ref17","first-page":"11215","article-title":"Textual backdoor attacks can be more harmful via two simple tricks","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Chen"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354209"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02333-y"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9413468"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3548261"},{"key":"ref22","first-page":"57","article-title":"Can you hear it? Backdoor attacks via ultrasonic triggers","volume-title":"Proc. ACM Workshop Wireless Secur. Mach. Learn.","author":"Koffas"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2024.128779"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2025.127546"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2025.3548611"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref27","first-page":"2793","article-title":"Weight poisoning attacks on pretrained models","volume-title":"Proc. 58th Annu. Meeting Assoc. Comput. Linguistics","author":"Kurita"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10096332"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3495243.3560531"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC61105.2024.00161"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3404885"},{"key":"ref35","first-page":"52972","article-title":"BadChain: Backdoor chain-of-thought prompting for large language models","volume-title":"Proc. NeurIPS Workshop Backdoors Deep Learn. Good","author":"Xiang"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref38","first-page":"16913","article-title":"Adversarial neuron pruning purifies backdoored deep models","volume-title":"Proc. Int. Conf. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref39","first-page":"11661","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","volume-title":"Proc. 9th Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01616"},{"key":"ref41","first-page":"31495","article-title":"Probe before you talk: Towards black-box defense against backdoor unalignment for large language models","volume-title":"Proc. 13th Int. Conf. Learn. Represent.","author":"Yi"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref43","first-page":"9558","article-title":"ONION: A simple and effective defense against textual backdoor attacks","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Qi"},{"key":"ref44","first-page":"32239","article-title":"Causality based front-door defense against backdoor attack on language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Liu"},{"key":"ref45","first-page":"61108","article-title":"Defense against backdoor attack on pre-trained language models via head pruning and attention normalization","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhao"},{"key":"ref46","first-page":"2255","article-title":"T-miner: A generative approach to defend against trojan attacks on DNN-based text classification","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Secur.)","author":"Azizi"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.348"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1023\/A:1007379606734"},{"issue":"11","key":"ref50","first-page":"1817","article-title":"A framework for learning predictive structures from multiple tasks and unlabeled data","volume":"6","author":"Ando","year":"2005","journal-title":"J. Mach. Learn. Res."},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.eacl-main.66"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2021.3065498"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TCOMM.2024.3381671"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6333"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3512467"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3653300"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.216"},{"key":"ref58","first-page":"18661","article-title":"Supervised contrastive learning","volume-title":"Proc. NIPS","author":"Khosla"},{"key":"ref59","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process.","author":"Socher"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W18-5102"},{"key":"ref61","first-page":"649","article-title":"Character-level convolutional networks for text classification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang"},{"key":"ref62","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"arXiv:1810.04805"},{"key":"ref63","article-title":"DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter","author":"Sanh","year":"2019","journal-title":"arXiv:1910.01108"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1907.11692"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.55"},{"key":"ref66","first-page":"6","article-title":"Label-consistent backdoor attacks","volume":"1050","author":"Turner","year":"2019","journal-title":"Stat"},{"key":"ref67","article-title":"UMAP: Uniform manifold approximation and projection for dimension reduction","author":"McInnes","year":"2018","journal-title":"arXiv:1802.03426"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11075891.pdf?arnumber=11075891","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T17:54:21Z","timestamp":1753379661000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11075891\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":67,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3587194","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}