{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T01:40:15Z","timestamp":1760146815886,"version":"build-2065373602"},"reference-count":40,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2024,12,11]],"date-time":"2024-12-11T00:00:00Z","timestamp":1733875200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Youth Foundation of Inner Mongolia Natural Science Foundation","award":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"],"award-info":[{"award-number":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"]}]},{"name":"National Natural Science Foundation of China","award":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"],"award-info":[{"award-number":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"]}]},{"name":"Sichuan Natural Science Foundation","award":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"],"award-info":[{"award-number":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"]}]},{"name":"Interdisciplinary Research of Southwest Jiaotong University, China","award":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"],"award-info":[{"award-number":["2024QN06017","62172341","12204386","2024NSFSC1375","2682022KJ004"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Neural machine translation (NMT) systems have achieved outstanding performance and have been widely deployed in the real world. However, the undertranslation problem caused by the distribution of high-translation-entropy words in source sentences still exists, and can be aggravated by poisoning attacks. In this paper, we propose a new backdoor attack on NMT models by poisoning a small fraction of parallel training data. Our attack increases the translation entropy of words after injecting a backdoor trigger, making them more easily discarded by NMT. The final translation is part of target translation, and the position of the injected trigger poison affects the scope of the truncation. Moreover, we also propose a defense method, Backdoor Defense by Sematic Representation Change (BDSRC), against our attack. Specifically, we selected backdoor candidates based on the similarity between the semantic representation of words in a sentence and the overall sentence representation. Then, the injected backdoor is identified through computing the semantic deviation caused by backdoor candidates. The experiments show that our attack strategy can achieve a nearly 100% attack success rate, and the functionality of main translation tasks is almost unaffected in models having performance degradation that is less than 1 BLEU. Nonetheless, our defense method can effectively identify backdoor triggers and alleviate performance degradation.<\/jats:p>","DOI":"10.3390\/e26121081","type":"journal-article","created":{"date-parts":[[2024,12,11]],"date-time":"2024-12-11T12:50:08Z","timestamp":1733921408000},"page":"1081","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Data Poisoning Attack on Black-Box Neural Machine Translation to Truncate Translation"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6018-5690","authenticated-orcid":false,"given":"Lingfang","family":"Li","sequence":"first","affiliation":[{"name":"School of Information Science and Technology, Southwest Jiaotong University, Chengdu 610032, China"},{"name":"School of Information Engineer, Inner Mongolia University of Science & Technology, Hohhot 010021, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0650-8396","authenticated-orcid":false,"given":"Weijian","family":"Hu","sequence":"additional","affiliation":[{"name":"School of Information Engineer, Inner Mongolia University of Science & Technology, Hohhot 010021, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3034-3034","authenticated-orcid":false,"given":"Mingxing","family":"Luo","sequence":"additional","affiliation":[{"name":"School of Information Science and Technology, Southwest Jiaotong University, Chengdu 610032, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2024,12,11]]},"reference":[{"key":"ref_1","unstructured":"Wu, Y. (2016). Google\u2019s neural machine translation system: Bridging the gap between human and machine translation. arXiv."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1016\/j.aiopen.2020.11.001","article-title":"Neural machine translation: A review of methods, resources, and tools","volume":"1","author":"Tan","year":"2020","journal-title":"AI Open"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Sun, X., Li, X., Meng, Y., Ao, X., Lyu, L., Li, J., and Zhang, T. (2023, January 7\u201314). Defending against backdoor attacks in natural language generation. Proceedings of the AAAI Conference on Artificial Intelligence, Washington, DC, USA.","DOI":"10.1609\/aaai.v37i4.25656"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Wu, J., Liu, L., Bi, W., and Yeung, D.Y. (2024, January 14\u201319). Rethinking Targeted Adversarial Attacks for Neural Machine Translation. Proceedings of the ICASSP 2024\u20142024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Seoul, Republic of Korea.","DOI":"10.1109\/ICASSP48485.2024.10447368"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Sadrizadeh, S., Aghdam, A.D., Dolamic, L., and Frossard, P. (2023, January 4\u201310). Targeted adversarial attacks against neural machine translation. Proceedings of the ICASSP 2023\u20142023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), Rhodes Island, Greece.","DOI":"10.1109\/ICASSP49357.2023.10095342"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Tu, Z., Lu, Z., Liu, Y., Liu, X., and Li, H. (2016, January 7\u201312). Modeling Coverage for Neural Machine Translation. Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics, Berlin, Germany.","DOI":"10.18653\/v1\/P16-1008"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Yang, J., Zhang, B., Qin, Y., Zhang, X., Lin, Q., and Su, J. (2018, January 26\u201330). Otem & Utem: Over-and under-translation evaluation metric for NMT. Proceedings of the Natural Language Processing and Chinese Computing: 7th CCF International Conference, Hohhot, China.","DOI":"10.1007\/978-3-319-99495-6_25"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, J., Xu, C., Guzm\u00e1n, F., El-Kishky, A., Tang, Y., Rubinstein, B.I., and Cohn, T. (2021, January 1\u20136). Putting words into the system\u2019s mouth: A targeted attack on neural machine translation using monolingual data poisoning. Proceedings of the Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, Online.","DOI":"10.18653\/v1\/2021.findings-acl.127"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3551636","article-title":"A comprehensive survey on poisoning attacks and countermeasures in machine learning","volume":"55","author":"Tian","year":"2022","journal-title":"ACM Comput. Surv."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"5","DOI":"10.1109\/TNNLS.2022.3182979","article-title":"Backdoor learning: A survey","volume":"35","author":"Li","year":"2022","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_11","unstructured":"Li, Y., Zhai, T., Wu, B., Jiang, Y., Li, Z., and Xia, S. (2020). Rethinking the trigger of backdoor attack. arXiv."},{"key":"ref_12","unstructured":"Biggio, B., Nelson, B., and Laskov, P. (July, January 26). Poisoning attacks against support vector machines. Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics, Edinburgh, UK."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"103270","DOI":"10.1016\/j.cose.2023.103270","article-title":"A novel data poisoning attack in federated learning based on inverted loss function","volume":"130","author":"Gupta","year":"2023","journal-title":"Comput. Secur."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Wang, J., He, X., Rubinstein, B., and Cohn, T. (2022, January 7\u201311). Foiling training-time attacks on neural machine translation systems. Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2022, Abu Dhabi, United Arab Emirates.","DOI":"10.18653\/v1\/2022.findings-emnlp.435"},{"key":"ref_15","first-page":"6106","article-title":"Poison frogs! Targeted clean-label poisoning attacks on neural networks","volume":"31","author":"Shafahi","year":"2018","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Wang, J., Xu, Q., He, X., Rubinstein, B.I., and Cohn, T. (2024, January 16\u201321). Backdoor Attack on Multilingual Machine Translation. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), Mexico City, Mexico.","DOI":"10.18653\/v1\/2024.naacl-long.254"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Li, S., Liu, H., Dong, T., Zhao, B.Z.H., Xue, M., Zhu, H., and Lu, J. (2021, January 15\u201319). Hidden backdoors in human-centric language models. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event.","DOI":"10.1145\/3460120.3484576"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Chen, X., Salem, A., Chen, D., Backes, M., Ma, S., Shen, Q., Wu, Z., and Zhang, Y. (2021, January 6\u201310). Badnl: Backdoor attacks against nlp models with semantic-preserving improvements. Proceedings of the 37th Annual Computer Security Applications Conference, Virtual Event.","DOI":"10.1145\/3485832.3485837"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Gan, L., Li, J., Zhang, T., Li, X., Meng, Y., Wu, F., Yang, Y., Guo, S., and Fan, C. (2022, January 10\u201315). Triggerless backdoor attack for NLP tasks with clean labels. Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Seattle, WA, USA.","DOI":"10.18653\/v1\/2022.naacl-main.214"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Boucher, N., Shumailov, I., Anderson, R., and Papernot, N. (2022, January 22\u201326). Bad characters: Imperceptible nlp attacks. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46214.2022.9833641"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., and Sun, M. (2021, January 1\u20136). Hidden killer: Invisible textual backdoor attacks with syntactic trigger. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online.","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1016\/j.neucom.2021.04.105","article-title":"Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification","volume":"452","author":"Chen","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., and Sun, M. (2020). Onion: A simple and effective defense against textual backdoor attacks. arXiv.","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Xu, C., Wang, J., Tang, Y., Guzm\u00e1n, F., Rubinstein, B.I., and Cohn, T. (2021, January 19\u201323). A targeted attack on black-box neural machine translation with parallel data poisoning. Proceedings of the Web Conference 2021, Ljubljana, Slovenia.","DOI":"10.1145\/3442381.3450034"},{"key":"ref_25","unstructured":"Sutskever, I., Vinyals, O., and Le, Q. (2014, January 8\u201313). Sequence to Sequence Learning with Neural Networks. Proceedings of the 27th International Conference on Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_26","first-page":"22184","article-title":"Understanding how encoder-decoder architectures attend","volume":"34","author":"Aitken","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_27","unstructured":"Zhao, Y., Zhang, J., Zong, C., He, Z., and Wu, H. (2019\u20131, January 27). Addressing the under-translation problem from the entropy perspective. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Liu, Y., Li, Z., Backes, M., Shen, Y., and Zhang, Y. (2023). Backdoor attacks against dataset distillation. arXiv.","DOI":"10.14722\/ndss.2023.24287"},{"key":"ref_29","unstructured":"Chen, L., Cheng, M., and Huang, H. (2023). Backdoor learning on sequence to sequence models. arXiv."},{"key":"ref_30","unstructured":"Gu, T., Dolan-Gavitt, B., and Garg, S. (2017). Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Lv, P., Ma, H., Zhou, J., Liang, R., Chen, K., Zhang, S., and Yang, Y. (2023, January 10\u201314). Dbia: Data-free backdoor injection attack against transformer networks. Proceedings of the 2023 IEEE International Conference on Multimedia and Expo (ICME), Brisbane, Australia.","DOI":"10.1109\/ICME55011.2023.00479"},{"key":"ref_32","unstructured":"Huang, H., Zhao, Z., Backes, M., Shen, Y., and Zhang, Y. (2023). Prompt Backdoors in Visual Prompt Learning. arXiv."},{"key":"ref_33","unstructured":"Cheng, P., Wu, Z., Du, W., Zhao, H., Lu, W., and Liu, G. (2023). Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. arXiv."},{"key":"ref_34","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A., Kaiser, \u0141., and Polosukhin, I. (2017, January 4\u20139). Attention is all you need. In Proceedings of the 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA."},{"key":"ref_35","unstructured":"Gehring, J., Auli, M., Grangier, D., Yarats, D., and Dauphin, Y.N. (2017, January 6\u201311). Convolutional sequence to sequence learning. Proceedings of the International Conference on Machine Learning (PMLR), Sydney, Australia."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Sennrich, R., Haddow, B., and Birch, A. (2016, January 7\u201312). Neural machine translation of rare words with subword units. Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Berlin, Germany.","DOI":"10.18653\/v1\/P16-1162"},{"key":"ref_37","first-page":"4694","article-title":"When does label smoothing help?","volume":"32","author":"Kornblith","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Papineni, K., Roukos, S., Ward, T., and Zhu, W.J. (2002, January 7\u201312). Bleu: A method for automatic evaluation of machine translation. Proceedings of the 40th annual meeting of the Association for Computational Linguistics, Philadelphia, PA, USA.","DOI":"10.3115\/1073083.1073135"},{"key":"ref_39","unstructured":"Snover, M., Dorr, B., Schwartz, R., Micciulla, L., and Makhoul, J. (2006, January 8\u201312). A study of translation edit rate with targeted human annotation. Proceedings of the 7th Conference of the Association for Machine Translation in the Americas: Technical Papers, Cambridge, MA, USA."},{"key":"ref_40","unstructured":"Zhang, T., Kishore, V., Wu, F., Weinberger, K.Q., and Artzi, Y. (2019). Bertscore: Evaluating text generation with bert. arXiv."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/26\/12\/1081\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T16:52:35Z","timestamp":1760115155000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/26\/12\/1081"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,11]]},"references-count":40,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["e26121081"],"URL":"https:\/\/doi.org\/10.3390\/e26121081","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2024,12,11]]}}}