{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T22:02:38Z","timestamp":1757628158393,"version":"3.44.0"},"reference-count":61,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Science Foundation","award":["DMS-2152289","DMS-2134107"],"award-info":[{"award-number":["DMS-2152289","DMS-2134107"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3597216","type":"journal-article","created":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T18:38:49Z","timestamp":1754678329000},"page":"9318-9327","source":"Crossref","is-referenced-by-count":0,"title":["Defense Against Syntactic Textual Backdoor Attacks With Token Substitution"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2782-4248","authenticated-orcid":false,"given":"Xianwen","family":"He","sequence":"first","affiliation":[{"name":"Statistics and Operations Research Department, University of North Carolina at Chapel Hill, Chapel Hill, NC, USA"}]},{"given":"Xinglin","family":"Li","sequence":"additional","affiliation":[{"name":"Economics Department, University of North Carolina at Chapel Hill, Chapel Hill, NC, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7195-5774","authenticated-orcid":false,"given":"Yao","family":"Li","sequence":"additional","affiliation":[{"name":"Statistics and Operations Research Department, University of North Carolina at Chapel Hill, Chapel Hill, NC, USA"}]},{"given":"Minhao","family":"Cheng","sequence":"additional","affiliation":[{"name":"College of Information Sciences and Technology, The Pennsylvania State University, University Park, PA, USA"}]}],"member":"263","reference":[{"issue":"240","key":"ref1","first-page":"1","article-title":"PaLM: Scaling language modeling with pathways","volume":"24","author":"Chowdhery","year":"2022","journal-title":"J. Mach. Learn. Res."},{"key":"ref2","first-page":"1877","article-title":"Language models are few-shot learners","volume":"33","author":"Brown","year":"2020","journal-title":"Advances in Neural Information Processing"},{"key":"ref3","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref5","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2018.23291","article-title":"Trojaning attack on neural networks","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Liu"},{"key":"ref6","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref7","first-page":"3454","article-title":"Input-aware dynamic backdoor attack","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Nguyen"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02342"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01962"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01569"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref16","first-page":"2793","article-title":"Weight poisoning attacks on pretrained models","volume-title":"Proc. 58th Annu. Meeting Assoc. Comput. Linguistics","author":"Kurita"},{"key":"ref17","first-page":"4873","article-title":"Turn the combination lock: Learnable textual backdoor attacks via word substitution","volume-title":"Proc. 59th Annu. Meeting Assoc. Comput. Linguistics","author":"Qi"},{"key":"ref18","first-page":"4569","article-title":"Mind the style of text! Adversarial and backdoor attacks based on text style transfer","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Qi"},{"key":"ref19","first-page":"12951","article-title":"BITE: Textual backdoor attacks with iterative trigger injection","volume-title":"Proc. 61st Annu. Meeting Assoc. Comput. Linguistics","author":"Yan"},{"key":"ref20","first-page":"668","article-title":"Expose backdoors on the way: A feature-based efficient defense against textual backdoor attacks","volume-title":"Proc. Findings Assoc. Comput. Linguistics: EMNLP","author":"Chen"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583348"},{"key":"ref22","article-title":"Backdoor attacks for in-context learning with language models","author":"Kandpal","year":"2023","journal-title":"arXiv:2307.14692"},{"key":"ref23","first-page":"9558","article-title":"ONION: A simple and effective defense against textual backdoor attacks","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Qi"},{"key":"ref24","first-page":"443","article-title":"Hidden killer: Invisible textual backdoor attacks with syntactic trigger","volume-title":"Proc. 59th Annu. Meeting Assoc. Comput. Linguistics 11th Int. Joint Conf. Natural Lang. Process.","author":"Qi"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-022-13428-4"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00095"},{"key":"ref28","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Carlini"},{"article-title":"Membership inference attacks against NLP classification models","volume-title":"Proc. Workshop Privacy Mach. Learn. (NeurIPS)","author":"Shejwalkar","key":"ref29"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1215"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3374217"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3593042"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1221"},{"key":"ref34","article-title":"BackdoorLLM: A comprehensive benchmark for backdoor attacks and defenses on large language models","author":"Li","year":"2024","journal-title":"arXiv:2408.12798"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3712001"},{"key":"ref36","article-title":"LLM jailbreak attack versus defense techniques\u2014A comprehensive study","author":"Xu","year":"2024","journal-title":"arXiv:2402.13457v1"},{"key":"ref37","article-title":"GPT-4 technical report","volume-title":"arXiv:2303.08774","author":"OpenAI","year":"2023"},{"key":"ref38","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.165"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/BigDIA60676.2023.10429630"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref42","first-page":"2255","article-title":"T-Miner: A generative approach to defend against trojan attacks on DNN-based  text classification","volume-title":"Proc. 30th USENIX Secur. Symp. (USENIX Security)","author":"Azizi"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref44","first-page":"4727","article-title":"A study of the attention abnormality in trojaned BERTs","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics: Human Lang. Technol.","author":"Lyu"},{"key":"ref45","first-page":"8818","article-title":"Defending against insertion-based textual backdoor attacks via attribution","volume-title":"Proc. Findings Assoc. Comput. Linguistics: ACL","author":"Li"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3055844"},{"key":"ref47","first-page":"8365","article-title":"RAP: Robustness-aware perturbations for defending against backdoor attacks on NLP models","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Process.","author":"Yang"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2024.3376968"},{"key":"ref49","first-page":"1631","article-title":"Recursive deep models for semantic compositionality over a sentiment treebank","volume-title":"Proc. Conf. Empir. Methods Nat. Lang. Process.","author":"Socher"},{"volume-title":"Part-of-Speech Tagging Guidelines for the Penn Treebank Project (3rd Revision, 2nd Printing)","year":"1990","author":"Santorini","key":"ref50"},{"volume-title":"Natural Language Processing With Python","year":"2009","author":"Bird","key":"ref51"},{"key":"ref52","first-page":"4171","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","volume-title":"Proc. Conf. North Amer. Chapter Assoc. Comput. Linguistics, Hum. Lang. Technol.","volume":"1","author":"Devlin"},{"key":"ref53","first-page":"649","article-title":"Character-level convolutional networks for text classification","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"28","author":"Zhang"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.3233\/SW-140134"},{"key":"ref55","article-title":"Distilbert, a distilled version of BERT: Smaller, faster, cheaper and lighter","author":"Sanh","year":"2019","journal-title":"arXiv:1910.01108"},{"key":"ref56","first-page":"38","article-title":"Transformers: State-of-the-art natural language processing","volume-title":"Proc. Conf. Empirical Methods Natural Lang. Syst. Demonstrations","author":"Wolf"},{"key":"ref57","first-page":"5009","article-title":"A unified evaluation of textual backdoor learning: Frameworks and benchmarks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Cui"},{"key":"ref58","first-page":"55","article-title":"The Stanford CoreNLP natural language processing toolkit","volume-title":"Proc. 52nd Annu. Meeting Assoc. Comput. Linguistics, Syst. Demonstrations","author":"Manning"},{"key":"ref59","article-title":"MiniGPT-4: Enhancing vision-language understanding with advanced large language models","author":"Zhu","year":"2023","journal-title":"arXiv:2304.10592"},{"key":"ref60","article-title":"DeepSeek-r1: Incentivizing reasoning capability in LLMs via reinforcement learning","author":"DeepSeek-AI","year":"2025","journal-title":"arXiv:2501.12948"},{"key":"ref61","first-page":"37068","article-title":"BadPrompt: Backdoor attacks on continuous prompts","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Cai"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/10206\/10810755\/11121441-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11121441.pdf?arnumber=11121441","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,10]],"date-time":"2025-09-10T05:59:23Z","timestamp":1757483963000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11121441\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":61,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3597216","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}