{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T17:34:23Z","timestamp":1782927263991,"version":"3.54.5"},"reference-count":178,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"8","license":[{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21B2020"],"award-info":[{"award-number":["U21B2020"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62406188"],"award-info":[{"award-number":["62406188"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Neural Netw. Learning Syst."],"published-print":{"date-parts":[[2025,8]]},"DOI":"10.1109\/tnnls.2025.3540303","type":"journal-article","created":{"date-parts":[[2025,2,26]],"date-time":"2025-02-26T13:58:19Z","timestamp":1740578299000},"page":"13628-13648","source":"Crossref","is-referenced-by-count":24,"title":["Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review"],"prefix":"10.1109","volume":"36","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0945-8790","authenticated-orcid":false,"given":"Pengzhou","family":"Cheng","sequence":"first","affiliation":[{"name":"Department of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5387-7821","authenticated-orcid":false,"given":"Zongru","family":"Wu","sequence":"additional","affiliation":[{"name":"Department of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7474-6452","authenticated-orcid":false,"given":"Wei","family":"Du","sequence":"additional","affiliation":[{"name":"Department of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4405-1649","authenticated-orcid":false,"given":"Haodong","family":"Zhao","sequence":"additional","affiliation":[{"name":"Department of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0827-0382","authenticated-orcid":false,"given":"Wei","family":"Lu","sequence":"additional","affiliation":[{"name":"StatNLP Research Group, Singapore University of Technology and Design, Tampines, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5194-1570","authenticated-orcid":false,"given":"Gongshen","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3543507.3583348"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/QRS57517.2022.00086"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2997134"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"ref6","article-title":"BadNets: Identifying vulnerabilities in the machine learning model supply chain","author":"Gu","year":"2017","journal-title":"arXiv:1708.06733"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.377"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2941376"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"ref12","article-title":"Rethink the evaluation for attack strength of backdoor attacks in natural language processing","author":"Shen","year":"2022","journal-title":"arXiv:2201.02993"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-022-1377-5"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485370"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1016\/j.aiopen.2020.11.001"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-021-10031-1"},{"key":"ref17","article-title":"Transferring backdoors between large language models by knowledge distillation","author":"Cheng","year":"2024","journal-title":"arXiv:2408.09878"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref20","article-title":"T-miner: A generative approach to defend against trojan attacks on DNN-based text classification","author":"Azizi","year":"2021","journal-title":"arXiv:2103.04264"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2022.3181001"},{"key":"ref22","article-title":"A survey of recent backdoor attacks and defenses in large language models","author":"Zhao","year":"2024","journal-title":"arXiv:2406.06852"},{"key":"ref23","article-title":"BERT: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018","journal-title":"arXiv:1810.04805"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.642"},{"key":"ref25","article-title":"BadChain: Backdoor chain-of-thought prompting for large language models","volume-title":"Proc. NeurIPS Workshop Backdoors Deep Learn.-Good, Bad, Ugly","author":"Xiang"},{"key":"ref26","first-page":"1","article-title":"Badpre: Task-agnostic backdoor attacks to pre-trained NLP foundation models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Chen"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450034"},{"key":"ref28","first-page":"1","article-title":"TrojLLM: A black-box trojan prompt attack on large language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Xue"},{"key":"ref29","first-page":"1","article-title":"A unified evaluation of textual backdoor learning: Frameworks and benchmarks","volume-title":"Proc. 36th Conf. Neural Inf. Process. Syst. Datasets Benchmarks Track","author":"Cui"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"ref31","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020","journal-title":"arXiv:2007.10760"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.430"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.468"},{"key":"ref35","article-title":"SynGhost: Imperceptible and universal task-agnostic backdoor attack in pre-trained language models","author":"Cheng","year":"2024","journal-title":"arXiv:2402.18945"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-naacl.137"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.757"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/96"},{"key":"ref39","first-page":"37068","article-title":"BadPrompt: Backdoor attacks on continuous prompts","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Cai"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.194"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/2938386"},{"key":"ref42","first-page":"984","article-title":"Where to attack: A dynamic locator model for backdoor attack in text classifications","volume-title":"Proc. 29th Int. Conf. Comput. Linguist.","author":"Lu"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.770"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833572"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.431"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.214"},{"key":"ref47","article-title":"TrojText: Test-time invisible textual trojan insertion","author":"Lou","year":"2023","journal-title":"arXiv:2303.02242"},{"key":"ref48","first-page":"554","article-title":"BadNL: Backdoor attacks against NLP models","volume-title":"Proc. Workshop Adversarial Mach. Learn. (ICML)","author":"Salem"},{"key":"ref49","first-page":"3611","article-title":"Hidden trigger backdoor attack on NLP models via linguistic style manipulation","volume-title":"Proc. 31st USENIX Secur. Symp. (USENIX Secur.)","author":"Pan"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.165"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102730"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412130"},{"key":"ref53","article-title":"Backdoor attack against NLP models with robustness-aware perturbation defense","author":"Maqsood","year":"2022","journal-title":"arXiv:2204.05758"},{"key":"ref54","article-title":"Backdoor attacks with input-unique triggers in NLP","author":"Zhou","year":"2023","journal-title":"arXiv:2303.14325"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.repl4nlp-1.1"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_22"},{"key":"ref57","article-title":"BITE: Textual backdoor attacks with iterative trigger injection","author":"Yan","year":"2022","journal-title":"arXiv:2205.12700"},{"key":"ref58","first-page":"2067","article-title":"Backdoor NLP models via ai-generated text","volume-title":"Proc. Joint Int. Conf. Comput. Linguistics, Lang. Resour. Eval. (LREC-COLING)","author":"Du"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP48485.2024.10447968"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.171"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2024.3376968"},{"key":"ref62","article-title":"Learning to poison large language models during instruction tuning","author":"Qiang","year":"2024","journal-title":"arXiv:2402.13459"},{"key":"ref63","article-title":"PoisonPrompt: Backdoor attack on prompt-based large language models","author":"Yao","year":"2023","journal-title":"arXiv:2310.12439"},{"key":"ref64","article-title":"Instruction backdoor attacks against customized LLMs","author":"Zhang","year":"2024","journal-title":"arXiv:2402.09179"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-44693-1_41"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2024.3375526"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2024.3407571"},{"key":"ref68","first-page":"1","article-title":"Badedit: Backdooring large language models by model editing","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Li"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.584"},{"key":"ref70","article-title":"TARGET: Template-transferable backdoor attack against prompt-based NLP models via GPT4","author":"Tan","year":"2023","journal-title":"arXiv:2311.17429"},{"key":"ref71","article-title":"TrojFM: Resource-efficient backdoor attacks against very large foundation models","author":"Nie","year":"2024","journal-title":"arXiv:2405.16783"},{"key":"ref72","article-title":"Weak-to-Strong backdoor attack for large language models","author":"Zhao","year":"2024","journal-title":"arXiv:2409.17946"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102433"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.trustnlp-1.25"},{"key":"ref75","first-page":"1","article-title":"ParaFuzz: An interpretability-driven technique for detecting poisoned samples in NLP","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"L\u00fc"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.217"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.659"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.296"},{"key":"ref79","first-page":"7867","article-title":"A unified detection framework for inference-stage backdoor defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Xian"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.317"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-emnlp.40"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3103064"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2021.04.105"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.561"},{"key":"ref85","article-title":"A general framework for defending against backdoor attacks via influence graph","author":"Sun","year":"2021","journal-title":"arXiv:2111.14309"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.emnlp-main.798"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.60"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.47"},{"key":"ref89","first-page":"1","article-title":"Defending pre-trained language models as few-shot learners against backdoor attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Xi"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00684"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-emnlp.26"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.157"},{"key":"ref93","first-page":"1086","article-title":"Moderate-fitting as a natural backdoor defender for pre-trained language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"35","author":"Zhu"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.237"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.441"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.27"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.40"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-naacl.71"},{"key":"ref99","first-page":"73191","article-title":"Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tang"},{"key":"ref100","first-page":"19879","article-title":"Constrained optimization with dynamic bound-scaling for effective NLP backdoor defense","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Shen"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.naacl-main.348"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.179"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230478"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.993"},{"key":"ref105","first-page":"1","article-title":"Defense against backdoor attack on pre-trained language models via head pruning and attention normalization","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","author":"Zhao"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.894"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00022"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.13"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.findings-acl.127"},{"key":"ref111","article-title":"Backdoor learning on sequence to sequence models","author":"Chen","year":"2023","journal-title":"arXiv:2305.02424"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i4.25656"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3361661"},{"key":"ref114","article-title":"Forcing generative models to degenerate ones: The power of data poisoning attacks","volume-title":"Proc. NeurIPS Workshop Backdoors Deep Learn.-Good, Bad, Ugly","author":"Jiang"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.230164"},{"key":"ref116","article-title":"Whispers in grammars: Injecting covert backdoors to compromise dense retrieval systems","author":"Long","year":"2024","journal-title":"arXiv:2402.13532"},{"key":"ref117","article-title":"Stealthy and persistent unalignment on large language models via backdoor injections","author":"Cao","year":"2023","journal-title":"arXiv:2312.00027"},{"key":"ref118","article-title":"Trojan activation attack: Red-teaming large language models using activation steering for safety-alignment","author":"Wang","year":"2023","journal-title":"arXiv:2311.09433"},{"key":"ref119","article-title":"BadRAG: Identifying vulnerabilities in retrieval augmented generation of large language models","author":"Xue","year":"2024","journal-title":"arXiv:2406.00083"},{"key":"ref120","article-title":"HijackRAG: Hijacking attacks against retrieval-augmented large language models","author":"Zhang","year":"2024","journal-title":"arXiv:2410.22832"},{"key":"ref121","article-title":"AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases","author":"Chen","year":"2024","journal-title":"arXiv:2407.12784"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.401"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i1.32018"},{"key":"ref124","article-title":"Watch out for your agents! Investigating backdoor threats to LLM-based agents","author":"Yang","year":"2024","journal-title":"arXiv:2402.11208"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.337"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.530"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.94"},{"key":"ref128","article-title":"Compromising embodied agents with contextual backdoor attacks","author":"Liu","year":"2024","journal-title":"arXiv:2408.02882"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-44696-2_42"},{"key":"ref130","article-title":"Test-time backdoor attacks on multimodal large language models","author":"Lu","year":"2024","journal-title":"arXiv:2402.08577"},{"key":"ref131","article-title":"Can we trust embodied agents? Exploring backdoor attacks against embodied LLM-based decision-making systems","author":"Jiao","year":"2024","journal-title":"arXiv:2405.20774"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i7.28611"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00022"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.3115\/1073083.1073135"},{"key":"ref135","first-page":"74","article-title":"Rouge: A package for automatic evaluation of summaries","volume-title":"Proc. Workshop Text Summarization ACL","author":"Lin"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-2029"},{"key":"ref138","volume-title":"Peft: State-of-the-art Parameter-efficient Fine-tuning Methods","author":"Mangrulkar","year":"2022"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.867"},{"key":"ref140","article-title":"BadCLM: Backdoor attack in clinical language models for electronic health records","author":"Lyu","year":"2024","journal-title":"arXiv:2407.05213"},{"key":"ref141","article-title":"Rethinking backdoor detection evaluation for language models","author":"Yan","year":"2024","journal-title":"arXiv:2409.00399"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.833"},{"key":"ref143","article-title":"Large language models are good attackers: Efficient and stealthy textual backdoor attacks","author":"Li","year":"2024","journal-title":"arXiv:2408.11587"},{"key":"ref144","article-title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","author":"Qi","year":"2023","journal-title":"arXiv:2310.03693"},{"key":"ref145","article-title":"Exploring backdoor vulnerabilities of chat models","author":"Hao","year":"2024","journal-title":"arXiv:2404.02406"},{"key":"ref146","article-title":"Securing multi-turn conversational language models from distributed backdoor triggers","author":"Tong","year":"2024","journal-title":"arXiv:2407.04151"},{"key":"ref147","article-title":"Sleeper agents: Training deceptive LLMs that persist through safety training","author":"Hubinger","year":"2024","journal-title":"arXiv:2401.05566"},{"key":"ref148","article-title":"A disguised wolf is more harmful than a toothless tiger: Adaptive malicious code injection backdoor attack leveraging user behavior as triggers","author":"Wu","year":"2024","journal-title":"arXiv:2408.10334"},{"key":"ref149","article-title":"BadGPT: Exploring security vulnerabilities of ChatGPT via backdoor attacks to InstructGPT","author":"Shi","year":"2023","journal-title":"arXiv:2304.12298"},{"key":"ref150","first-page":"1","article-title":"Universal jailbreak backdoors from poisoned human feedback","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Rando"},{"key":"ref151","article-title":"The dark side of human feedback: Poisoning large language models via user inputs","author":"Chen","year":"2024","journal-title":"arXiv:2409.00787"},{"key":"ref152","article-title":"Backdoor attacks for in-context learning with language models","author":"Kandpal","year":"2023","journal-title":"arXiv:2307.14692"},{"key":"ref153","article-title":"TrojanRAG: Retrieval-augmented generation can be backdoor driver in large language models","author":"Cheng","year":"2024","journal-title":"arXiv:2405.13401"},{"key":"ref154","article-title":"Backdoor attacks to pre-trained unified foundation models","author":"Yuan","year":"2023","journal-title":"arXiv:2302.09360"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2024\/78"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-acl.848"},{"key":"ref157","article-title":"Backdoor attack on multilingual machine translation","author":"Wang","year":"2024","journal-title":"arXiv:2404.02393"},{"key":"ref158","first-page":"1","article-title":"Defend against textual backdoor attacks by token substitution","volume-title":"Proc. NeurIPS Workshop Robustness Sequence Model.","author":"Li"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833579"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1109\/SNAMS53716.2021.9732112"},{"key":"ref161","article-title":"CodePurify: Defend backdoor attacks on neural code models via entropy-based purification","author":"Mu","year":"2024","journal-title":"arXiv:2410.20136"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.514"},{"key":"ref163","article-title":"Neutralizing backdoors through information conflicts for large language models","author":"Chen","year":"2024","journal-title":"arXiv:2411.18280"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP49357.2023.10095007"},{"key":"ref165","article-title":"Gracefully filtering backdoor samples for generative large language models without retraining","author":"Wu","year":"2024","journal-title":"arXiv:2412.02454"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref167","article-title":"Neural attention distillation: Erasing backdoor triggers from deep neural networks","author":"Li","year":"2021","journal-title":"arXiv:2101.05930"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.177"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.emnlp-main.732"},{"key":"ref170","article-title":"DeCE: Deceptive cross-entropy loss designed for defending backdoor attacks","author":"Yang","year":"2024","journal-title":"arXiv:2407.08956"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.410"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690284"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.186"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26750"},{"key":"ref175","article-title":"Watermarking pre-trained language models with backdooring","author":"Gu","year":"2022","journal-title":"arXiv:2210.07543"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.123"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3247493"},{"key":"ref178","article-title":"Trojllm: A black-box trojan prompt attack on large language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Xue"}],"container-title":["IEEE Transactions on Neural Networks and Learning Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/5962385\/11114436\/10905032.pdf?arnumber=10905032","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,6]],"date-time":"2025-08-06T18:00:54Z","timestamp":1754503254000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10905032\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8]]},"references-count":178,"journal-issue":{"issue":"8"},"URL":"https:\/\/doi.org\/10.1109\/tnnls.2025.3540303","relation":{},"ISSN":["2162-237X","2162-2388"],"issn-type":[{"value":"2162-237X","type":"print"},{"value":"2162-2388","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,8]]}}}