{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,13]],"date-time":"2026-06-13T05:44:44Z","timestamp":1781329484600,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":73,"publisher":"ACM","license":[{"start":{"date-parts":[[2023,4,30]],"date-time":"2023-04-30T00:00:00Z","timestamp":1682812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2023,4,30]]},"DOI":"10.1145\/3543507.3583348","type":"proceedings-article","created":{"date-parts":[[2023,4,26]],"date-time":"2023-04-26T23:30:51Z","timestamp":1682551851000},"page":"2198-2208","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":25,"title":["Training-free Lexical Backdoor Attacks on Language Models"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2281-2504","authenticated-orcid":false,"given":"Yujin","family":"Huang","sequence":"first","affiliation":[{"name":"Monash University, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5760-5188","authenticated-orcid":false,"given":"Terry Yue","family":"Zhuo","sequence":"additional","affiliation":[{"name":"Monash University, Australia and CSIRO's Data61, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3312-6825","authenticated-orcid":false,"given":"Qiongkai","family":"Xu","sequence":"additional","affiliation":[{"name":"The University of Melbourne, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4735-2241","authenticated-orcid":false,"given":"Han","family":"Hu","sequence":"additional","affiliation":[{"name":"Monash University, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3701-4946","authenticated-orcid":false,"given":"Xingliang","family":"Yuan","sequence":"additional","affiliation":[{"name":"Monash University, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2011-9618","authenticated-orcid":false,"given":"Chunyang","family":"Chen","sequence":"additional","affiliation":[{"name":"Monash University, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,4,30]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"2022. HuggingFace Model Hub. https:\/\/huggingface.co\/models."},{"key":"e_1_3_2_2_2_1","unstructured":"2022. Model Zoo. https:\/\/modelzoo.co."},{"key":"e_1_3_2_2_3_1","unstructured":"2022. PyTorch Hub. https:\/\/pytorch.org\/hub."},{"key":"e_1_3_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W19-1909"},{"key":"e_1_3_2_2_5_1","volume-title":"Finbert: Financial sentiment analysis with pre-trained language models. arXiv preprint arXiv:1908.10063","author":"Araci Dogu","year":"2019","unstructured":"Dogu Araci. 2019. Finbert: Financial sentiment analysis with pre-trained language models. arXiv preprint arXiv:1908.10063 (2019)."},{"key":"e_1_3_2_2_6_1","volume-title":"Spinning Language Models: Risks of Propaganda-as-a-Service and Countermeasures. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1532\u20131532","author":"Bagdasaryan Eugene","year":"2022","unstructured":"Eugene Bagdasaryan and Vitaly Shmatikov. 2022. Spinning Language Models: Risks of Propaganda-as-a-Service and Countermeasures. In 2022 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 1532\u20131532."},{"key":"e_1_3_2_2_7_1","volume-title":"Statistical language model adaptation: review and perspectives. Speech communication 42, 1","author":"Bellegarda R","year":"2004","unstructured":"Jerome\u00a0R Bellegarda. 2004. Statistical language model adaptation: review and perspectives. Speech communication 42, 1 (2004), 93\u2013108."},{"key":"e_1_3_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1371"},{"key":"e_1_3_2_2_9_1","volume-title":"A neural probabilistic language model. Advances in neural information processing systems 13","author":"Bengio Yoshua","year":"2000","unstructured":"Yoshua Bengio, R\u00e9jean Ducharme, and Pascal Vincent. 2000. A neural probabilistic language model. Advances in neural information processing systems 13 (2000)."},{"key":"e_1_3_2_2_10_1","volume-title":"Findings of the 2016 conference on machine translation. In Proceedings of the First Conference on Machine Translation","volume":"2","author":"Bojar Ond\u0159ej","year":"2016","unstructured":"Ond\u0159ej Bojar, Rajen Chatterjee, Christian Federmann, Yvette Graham, Barry Haddow, Matthias Huck, Antonio\u00a0Jimeno Yepes, Philipp Koehn, Varvara Logacheva, Christof Monz, 2016. Findings of the 2016 conference on machine translation. In Proceedings of the First Conference on Machine Translation: Volume 2, Shared Task Papers. 131\u2013198."},{"key":"e_1_3_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833641"},{"key":"e_1_3_2_2_12_1","volume-title":"Assignment and Matching Problems: Solution Methods with FORTRAN-Programs","author":"Burkard E","unstructured":"Rainer\u00a0E Burkard and Ulrich Derigs. 1980. The linear sum assignment problem. In Assignment and Matching Problems: Solution Methods with FORTRAN-Programs. Springer, 1\u201315."},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.261"},{"key":"e_1_3_2_2_14_1","volume-title":"Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526","author":"Chen Xinyun","year":"2017","unstructured":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)."},{"key":"e_1_3_2_2_15_1","volume-title":"ICML 2021 Workshop on Adversarial Machine Learning.","author":"Chen Xiaoyi","year":"2021","unstructured":"Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang. 2021. Badnl: Backdoor attacks against nlp models. In ICML 2021 Workshop on Adversarial Machine Learning."},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390177"},{"key":"e_1_3_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2019.11.174"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCB48548.2020.9304875"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.2307\/1403797"},{"key":"e_1_3_2_2_20_1","first-page":"23","article-title":"A new algorithm for data compression","volume":"12","author":"Gage Philip","year":"1994","unstructured":"Philip Gage. 1994. A new algorithm for data compression. C Users Journal 12, 2 (1994), 23\u201338.","journal-title":"C Users Journal"},{"key":"e_1_3_2_2_21_1","volume-title":"ICLR 2015","author":"Goodfellow J","year":"2014","unstructured":"Ian\u00a0J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. ICLR 2015 (2014)."},{"key":"e_1_3_2_2_22_1","volume-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.161"},{"key":"e_1_3_2_2_24_1","volume-title":"Handcrafted backdoors in deep neural networks. arXiv preprint arXiv:2106.04690","author":"Hong Sanghyun","year":"2021","unstructured":"Sanghyun Hong, Nicholas Carlini, and Alexey Kurakin. 2021. Handcrafted backdoors in deep neural networks. arXiv preprint arXiv:2106.04690 (2021)."},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1031"},{"key":"e_1_3_2_2_26_1","volume-title":"SentMod: Hidden Backdoor Attack on Unstructured Textual Data. In 2022 IEEE 8th Intl Conference on Big Data Security on Cloud (BigDataSecurity)","author":"Irtiza Saquib","unstructured":"Saquib Irtiza, Latifur Khan, and Kevin\u00a0W Hamlen. 2022. SentMod: Hidden Backdoor Attack on Unstructured Textual Data. In 2022 IEEE 8th Intl Conference on Big Data Security on Cloud (BigDataSecurity), IEEE Intl Conference on High Performance and Smart Computing,(HPSC) and IEEE Intl Conference on Intelligent Data and Security (IDS). IEEE, 224\u2013231."},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.197"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF02278710"},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412167"},{"key":"e_1_3_2_2_30_1","volume-title":"Proceedings of NAACL-HLT. 4171\u20134186","author":"Ming-Wei\u00a0Chang Jacob Devlin","year":"2019","unstructured":"Jacob Devlin Ming-Wei\u00a0Chang Kenton and Lee\u00a0Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of NAACL-HLT. 4171\u20134186."},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11010141"},{"key":"e_1_3_2_2_32_1","volume-title":"Subword regularization: Improving neural network translation models with multiple subword candidates. arXiv preprint arXiv:1804.10959","author":"Kudo Taku","year":"2018","unstructured":"Taku Kudo. 2018. Subword regularization: Improving neural network translation models with multiple subword candidates. arXiv preprint arXiv:1804.10959 (2018)."},{"key":"e_1_3_2_2_33_1","volume-title":"ALBERT: A Lite BERT for Self-supervised Learning of Language Representations. In International Conference on Learning Representations.","author":"Lan Zhenzhong","year":"2019","unstructured":"Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2019. ALBERT: A Lite BERT for Self-supervised Learning of Language Representations. In International Conference on Learning Representations."},{"key":"e_1_3_2_2_34_1","volume-title":"Bart: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. arXiv preprint arXiv:1910.13461","author":"Lewis Mike","year":"2019","unstructured":"Mike Lewis, Yinhan Liu, Naman Goyal, Marjan Ghazvininejad, Abdelrahman Mohamed, Omer Levy, Ves Stoyanov, and Luke Zettlemoyer. 2019. Bart: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. arXiv preprint arXiv:1910.13461 (2019)."},{"key":"e_1_3_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2981314"},{"key":"e_1_3_2_2_36_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.241"},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484576"},{"key":"e_1_3_2_2_38_1","volume-title":"Backdoor learning: A survey","author":"Li Yiming","year":"2022","unstructured":"Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)."},{"key":"e_1_3_2_2_39_1","volume-title":"Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307","author":"Liao Cong","year":"2018","unstructured":"Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. 2018. Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808.10307 (2018)."},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.302"},{"key":"e_1_3_2_2_41_1","volume-title":"Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692","author":"Liu Yinhan","year":"2019","unstructured":"Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 (2019)."},{"key":"e_1_3_2_2_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2492517.2492527"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.1075\/li.30.1.03nad"},{"key":"e_1_3_2_2_44_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Pan Xudong","year":"2022","unstructured":"Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. 2022. Hidden Trigger Backdoor Attack on { NLP} Models via Linguistic Style Manipulation. In 31st USENIX Security Symposium (USENIX Security 22). 3611\u20133628."},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.3115\/1118693.1118704"},{"key":"e_1_3_2_2_46_1","volume-title":"Proceedings of the 40th annual meeting of the Association for Computational Linguistics. 311\u2013318","author":"Papineni Kishore","year":"2002","unstructured":"Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. 2002. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics. 311\u2013318."},{"key":"e_1_3_2_2_47_1","unstructured":"Nikolaos Pappas and Thomas Meyer. 2012. A Survey on Language Modeling using Neural Networks."},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/S14-2004"},{"key":"e_1_3_2_2_49_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/W18-6319"},{"key":"e_1_3_2_2_50_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11431-020-1647-3"},{"key":"e_1_3_2_2_51_1","unstructured":"Alec Radford Karthik Narasimhan Tim Salimans Ilya Sutskever 2018. Improving language understanding by generative pre-training. (2018)."},{"key":"e_1_3_2_2_52_1","volume-title":"Language models are unsupervised multitask learners. OpenAI blog 1, 8","author":"Radford Alec","year":"2019","unstructured":"Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, 2019. Language models are unsupervised multitask learners. OpenAI blog 1, 8 (2019), 9."},{"key":"e_1_3_2_2_53_1","first-page":"1","article-title":"Exploring the limits of transfer learning with a unified text-to-text transformer.J","volume":"21","author":"Raffel Colin","year":"2020","unstructured":"Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, Peter\u00a0J Liu, 2020. Exploring the limits of transfer learning with a unified text-to-text transformer.J. Mach. Learn. Res. 21, 140 (2020), 1\u201367.","journal-title":"Mach. Learn. Res."},{"key":"e_1_3_2_2_54_1","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00313"},{"key":"e_1_3_2_2_55_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.243"},{"key":"e_1_3_2_2_56_1","doi-asserted-by":"publisher","DOI":"10.3115\/1119176.1119195"},{"key":"e_1_3_2_2_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2012.6289079"},{"key":"e_1_3_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P16-1162"},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485370"},{"key":"e_1_3_2_2_60_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-demo.35"},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"e_1_3_2_2_62_1","unstructured":"Harold Somers. 1992. An introduction to machine translation. (1992)."},{"key":"e_1_3_2_2_63_1","volume-title":"Multilingual translation with extensible multilingual pretraining and finetuning. arXiv preprint arXiv:2008.00401","author":"Tang Yuqing","year":"2020","unstructured":"Yuqing Tang, Chau Tran, Xian Li, Peng-Jen Chen, Naman Goyal, Vishrav Chaudhary, Jiatao Gu, and Angela Fan. 2020. Multilingual translation with extensible multilingual pretraining and finetuning. arXiv preprint arXiv:2008.00401 (2020)."},{"key":"e_1_3_2_2_64_1","volume-title":"Attention is all you need. Advances in neural information processing systems 30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan\u00a0N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)."},{"key":"e_1_3_2_2_65_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.308"},{"key":"e_1_3_2_2_66_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6465"},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450034"},{"key":"e_1_3_2_2_68_1","volume-title":"Beyond model extraction: Imitation attack for black-box nlp apis. arXiv preprint arXiv:2108.13873","author":"Xu Qiongkai","year":"2021","unstructured":"Qiongkai Xu, Xuanli He, Lingjuan Lyu, Lizhen Qu, and Gholamreza Haffari. 2021. Beyond model extraction: Imitation attack for black-box nlp apis. arXiv preprint arXiv:2108.13873 (2021)."},{"key":"e_1_3_2_2_69_1","volume-title":"Textual Backdoor Attacks with Iterative Trigger Injection. arXiv preprint arXiv:2205.12700","author":"Yan Jun","year":"2022","unstructured":"Jun Yan, Vansh Gupta, and Xiang Ren. 2022. Textual Backdoor Attacks with Iterative Trigger Injection. arXiv preprint arXiv:2205.12700 (2022)."},{"key":"e_1_3_2_2_70_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"e_1_3_2_2_71_1","volume-title":"Xlnet: Generalized autoregressive pretraining for language understanding. Advances in neural information processing systems 32","author":"Yang Zhilin","year":"2019","unstructured":"Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Carbonell, Russ\u00a0R Salakhutdinov, and Quoc\u00a0V Le. 2019. Xlnet: Generalized autoregressive pretraining for language understanding. Advances in neural information processing systems 32 (2019)."},{"key":"e_1_3_2_2_72_1","volume-title":"International Conference on Machine Learning. PMLR, 12133\u201312143","author":"You Kaichao","year":"2021","unstructured":"Kaichao You, Yong Liu, Jianmin Wang, and Mingsheng Long. 2021. Logme: Practical assessment of pre-trained models for transfer learning. In International Conference on Machine Learning. PMLR, 12133\u201312143."},{"key":"e_1_3_2_2_73_1","volume-title":"ICML 2021 Workshop on Adversarial Machine Learning.","author":"Zhang Zhengyan","year":"2021","unstructured":"Zhengyan Zhang, Guangxuan Xiao, Yongwei Li, Tian Lv, Fanchao Qi, Zhiyuan Liu, Yasheng Wang, Xin Jiang, and Maosong Sun. 2021. Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks. In ICML 2021 Workshop on Adversarial Machine Learning."}],"event":{"name":"WWW '23: The ACM Web Conference 2023","location":"Austin TX USA","acronym":"WWW '23","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2023"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583348","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3543507.3583348","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T16:37:23Z","timestamp":1750178243000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3543507.3583348"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,30]]},"references-count":73,"alternative-id":["10.1145\/3543507.3583348","10.1145\/3543507"],"URL":"https:\/\/doi.org\/10.1145\/3543507.3583348","relation":{},"subject":[],"published":{"date-parts":[[2023,4,30]]},"assertion":[{"value":"2023-04-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}