Research map / Adversarial robustness and security / Backdoor and poisoning
BadPrompt: Backdoor Attacks on Continuous Prompts
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add dropout of candidate triggers semantically close to non-target samples (ablation) | BadPrompt with DART · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 171.2 -> 189.1; 159.4 -> 184.3; 171.8 -> 185.2; 163.0 -> 187.6; 148.7 -> 174.9 | Helped |
| Add dropout of candidate triggers semantically close to non-target samples (ablation) | BadPrompt with P-tuning · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 176.0 -> 191.4; 169.4 -> 183.1; 163.2 -> 185.4; 174.2 -> 187.3; 163.8 -> 176.4 | Helped |
| Use adaptive sample-specific trigger selection instead of random selection (ablation) | BadPrompt with DART · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 168.8 -> 189.1; 165.2 -> 184.3; 168.1 -> 185.2; 169.8 -> 187.6; 158.3 -> 174.9 | Helped |
| Use adaptive sample-specific trigger selection instead of random selection (ablation) | BadPrompt with P-tuning · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 168.8 -> 191.4; 165.2 -> 183.1; 170.1 -> 185.4; 173.6 -> 187.3; 167.4 -> 176.4 | Helped |
| Use adaptive sample-specific trigger selection instead of top-1 candidate selection (ablation) | BadPrompt with DART · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 187.0 -> 189.1; 154.0 -> 184.3; 178.7 -> 185.2; 164.1 -> 187.6; 173.2 -> 174.9 | Mixed |
| Use adaptive sample-specific trigger selection instead of top-1 candidate selection (ablation) | BadPrompt with P-tuning · SST-2, MR, CR, SUBJ, TREC | CA+ASR: 176.8 -> 191.4; 165.6 -> 183.1; 165.8 -> 185.4; 168.2 -> 187.3; 169.4 -> 176.4 | Mixed |
| Increase trigger length (ablation) | BadPrompt · Five datasets; DART and P-tuning | ASR | Helped |
| Increase trigger length (ablation) | BadPrompt · Five datasets; DART and P-tuning | CA | No clear effect |
| Vary the number of candidate triggers (ablation) | BadPrompt · Five datasets; DART and P-tuning | CA | No clear effect |
| Vary the number of candidate triggers (ablation) | BadPrompt · Five datasets; DART and P-tuning | ASR | No clear effect |
Closest papers by meaning
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.88)
- Attack on Prompt: Backdoor Attack in Prompt-Based Continual Learning (AAAI 2025 · similarity 0.88)
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.88)
- BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.88)
- Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.