Research map / Adversarial robustness and security / Backdoor and poisoning

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks

ICML 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Detecting poisoned samples · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Quantifies "backdoor complications" in downstream tasks fine-tuned from backdoored pre-trained language models and proposes a task-agnostic multi-task learning method that reduces them while preserving attack efficacy.

Problem

Backdoored pre-trained language models (PTLMs) are adapted to downstream tasks other than the attacker's target task, where triggered inputs produce abnormal, single-class output distributions that reveal the backdoor and compromise stealthiness.

Approach

Defines backdoor complications as output-distribution deviations (KL divergence between triggered and clean outputs) on unrelated downstream tasks, and reduces them by multi-task training the backdoor task jointly with trigger-inserted correction datasets from other text classification tasks, without knowledge of the victim's downstream tasks.

Key results

• Backdoored PTLMs achieve near 100% ASR with CTA above 90% across BERT, BART, GPT-2, and T5, and triggered samples in unrelated downstream tasks are often mapped to a single class (e.g., 99.88% to one DBPedia class, KL 2.7886).
• With the proposed multi-task complication reduction, most downstream KL divergences fall below 0.1 versus mostly above 0.5 without reduction, e.g., Ecom KL drops by 0.6993 to 1.8317 across architectures.
• Complication reduction leaves attack performance nearly unchanged; for example, BERT CTA changes by at most about 2% and ASR stays near 99% in the binary setting.

Measured effects reported in the paper

Surprising findings

• Triggered samples in unrelated downstream tasks are often assigned almost entirely to one class, which is an unexpected and easily observable signal of the backdoor.
• Semantic similarity between backdoor and downstream classes does not appear to be the root cause of the biased outputs, according to the authors' analysis.

Limitations

• Experiments are limited to four PTLMs and text classification tasks, with the workflow only sketched for image tasks.
• The attacker is assumed to control PTLM training and use a fixed set of correction datasets; the paper's reduction is evaluated on a chosen set of 11 unseen downstream datasets.
• Some downstream models with and without reduction show comparable KL values, so the reduction is not uniformly effective.

Experimental setup

Datasets: IMDb AGNews MGB DBPedia CoLA SMS Spam NewsPop SST2 Env Ecom Medical FakeNews

Benchmarks: IMDb AGNews MGB DBPedia CoLA SST2 SMS Spam NewsPop Env Ecom Medical FakeNews

Metrics: clean test accuracy attack success rate KL divergence between output distributions

Builds on: multi-task learning

Closest papers by meaning

• BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.89)
• Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.89)
• Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.88)
• Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.88)
• Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.88)
• Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.88)