Research map / Adversarial robustness and security / Backdoor and poisoning
CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CL-Attack, a paragraph-level textual backdoor whose trigger is a fixed cross-lingual language sequence (e.g., ZH-EN-DE), plus TranslateDefense, a translation-based defense.
Problem
Existing textual backdoor triggers are either fixed tokens (easy to detect and filter) or sentence-pattern triggers (style/syntax) that do not apply to all samples and cause semantic shifts; the paper targets stealthy, universal backdoors for LLMs.
Approach
Uses the language structure of a paragraph-segmented text (a fixed sequence of 2-3 languages, translated with an MT system or LLM) as the trigger, so the backdoor depends on cross-lingual structure rather than specific tokens or style, and proposes translating the input to a single language as a defense.
Key results
- CL-Attack reaches ASR of 1.000 on SST-2 and MARC and 0.910 to 1.000 on MLQA across three victim models, with a 3% poisoning rate sufficient for ASR above 90% on Llama-3-8B MLQA.
- Under ONION defense, CL-Attack keeps ASR at 1.000 on SST-2 and MARC while BadNL and SOS drop sharply (e.g., SOS on SST-2 falls to 0.045).
- TranslateDefense reduces CL-Attack ASR on Llama-3-8B to 0.355 (SST-2), 0.345 (MARC) and 0.330 (MLQA), but does not fully eliminate it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use a cross-lingual paragraph trigger instead of the strongest listed baseline | Llama-3-8B backdoor attack · SST-2 | ASR: 1.000 -> 1.000 | No clear effect |
| Use a cross-lingual paragraph trigger instead of SOS | Llama-3-8B backdoor attack · MARC | MAE: 0.420 -> 0.475 | Hurt |
| Use a cross-lingual paragraph trigger instead of SOS | Qwen2-7B backdoor attack · MLQA | ASR: 0.305 -> 0.910 | Helped |
| Use a cross-lingual paragraph trigger instead of StyleBkd | Qwen2-1.5B backdoor attack · SST-2 | ACC: 0.590 -> 0.960 | Helped |
| Apply ONION to CL-Attack | Llama-3-8B backdoor attack · SST-2 | ASR: 1.000 (+0.000) | No clear effect |
| Apply SFT to CL-Attack | Llama-3-8B backdoor attack · MARC | ASR: 0.860 (-0.140) | Hurt |
| Apply TranslateDefense to CL-Attack | Llama-3-8B backdoor attack · MLQA | ASR: 0.330 (-0.670) | Hurt |
| Vary the poisoning rate; cross-lingual trigger exceeds 90% ASR when rate exceeds 3% (ablation) | CL-Attack on Llama-3-8B · MLQA | ASR | Mixed |
| Vary the trigger language pattern among two- and three-language structures (ablation) | CL-Attack · SST-2, MARC, MLQA | ASR: 1.00; 1.00; 1.00 | No clear effect |
| Replace one language in the trigger with another (ablation) | CL-Attack with ZH-EN-DE on Llama-3 · SST-2, MARC, MLQA | ASR: 1.000 -> 0.000 | Hurt |
| Disrupt trigger structure by removing one language or swapping two languages (ablation) | CL-Attack with ZH-EN-DE on Llama-3 · SST-2, MARC, MLQA | ASR: 1.000 -> 0.000 | Hurt |
| Change the translated text while retaining the trigger structure (ablation) | CL-Attack · SST-2, MARC, MLQA | ASR | No clear effect |
Surprising findings
- SFT defense leaves CL-Attack ASR nearly intact on SST-2 (1.000) while it substantially reduces StyleBkd and BadNL ASR, the opposite of the trend for the style trigger.
Limitations
- TranslateDefense is not perfect; translation differences can themselves serve as a trigger.
- Only three victim models and three tasks evaluated, with the full analysis restricted to Llama-3-8B.
- Trigger relies on multilingual inputs and uses clean monolingual samples, so its applicability to monolingual settings is unclear.
Experimental setup
Datasets: SST-2 MARC MLQA
Benchmarks: SST-2 MARC MLQA
Metrics: attack success rate accuracy mean absolute error F1 perplexity text similarity
Baselines: BadNL SOS StyleBkd ONION SFT defense
Builds on: BadNL SOS StyleBkd ONION
Closest papers by meaning
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.90)
- Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models (ICLR 2025 · similarity 0.89)
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.88)
- Multilingual Jailbreak Challenges in Large Language Models (ICLR 2024 · similarity 0.87)
- Watch Out for Your Guidance on Generation! Exploring Conditional Backdoor Attacks against Large Language Models (AAAI 2025 · similarity 0.87)
- Against All Odds: Overcoming Typology, Script, and Language Confusion in Multilingual Embedding Inversion Attacks (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.