{"id":"https://openalex.org/W4408749786","doi":"https://doi.org/10.14722/ndss.2025.230478","title":"CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models","display_name":"CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4408749786","doi":"https://doi.org/10.14722/ndss.2025.230478"},"language":"en","primary_location":{"id":"doi:10.14722/ndss.2025.230478","doi":"https://doi.org/10.14722/ndss.2025.230478","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2025.230478","pdf_url":"https://doi.org/10.14722/ndss.2025.230478","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2025 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://doi.org/10.14722/ndss.2025.230478","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101510784","display_name":"Rui Zeng","orcid":"https://orcid.org/0000-0002-9696-0027","observed_orcids":["https://orcid.org/0000-0002-9696-0027"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Zeng","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xi Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xi Chen","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072729601","display_name":"Yuwen Pu","orcid":"https://orcid.org/0000-0003-2311-4943","observed_orcids":["https://orcid.org/0000-0003-2311-4943"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuwen Pu","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xuhong Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xuhong Zhang","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102448448","display_name":"Tianyu Du","orcid":"https://orcid.org/0000-0003-0896-0690","observed_orcids":["https://orcid.org/0000-0003-0896-0690","https://orcid.org/0009-0005-3280-3291"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianyu Du","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058611515","display_name":"Shouling Ji","orcid":"https://orcid.org/0000-0003-4268-372X","observed_orcids":["https://orcid.org/0000-0003-4268-372X"]},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shouling Ji","raw_affiliation_strings":["Zhejiang University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhejiang University","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I76130692"],"apc_list":null,"apc_paid":null,"fwci":5.888,"has_fulltext":true,"cited_by_count":16,"citation_normalized_percentile":{"value":0.96838453,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.9259999990463257},{"id":"https://openalex.org/keywords/transformer","display_name":"transformer models","score":0.718999981880188},{"id":"https://openalex.org/keywords/adaptive-attacks","display_name":"adaptive attacks","score":0.4440000057220459},{"id":"https://openalex.org/keywords/text-generation-models","display_name":"text generation models","score":0.7440000176429749},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":0.6460000276565552},{"id":"https://openalex.org/keywords/hugging-face-models","display_name":"Hugging Face models","score":0.5979999899864197}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7751553058624268},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.6735059022903442},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6374337673187256},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.5907063484191895},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.07480636239051819},{"id":"https://openalex.org/C165801399","wikidata":"https://www.wikidata.org/wiki/Q25428","display_name":"Voltage","level":2,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.14722/ndss.2025.230478","doi":"https://doi.org/10.14722/ndss.2025.230478","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2025.230478","pdf_url":"https://doi.org/10.14722/ndss.2025.230478","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2025 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2409.01193","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.01193","pdf_url":"https://arxiv.org/pdf/2409.01193","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2409.01193","doi":"https://doi.org/10.48550/arxiv.2409.01193","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2409.01193","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.14722/ndss.2025.230478","doi":"https://doi.org/10.14722/ndss.2025.230478","is_oa":true,"landing_page_url":"https://doi.org/10.14722/ndss.2025.230478","pdf_url":"https://doi.org/10.14722/ndss.2025.230478","source":{"id":"https://openalex.org/S4306420590","display_name":"Network and Distributed System Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings 2025 Network and Distributed System Security Symposium","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G2094257571","display_name":null,"funder_award_id":"62402425","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3859458567","display_name":null,"funder_award_id":"2022YFB3102100","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G4644492335","display_name":null,"funder_award_id":"62402418","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6758494209","display_name":null,"funder_award_id":"62102360","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8792732309","display_name":null,"funder_award_id":"2022YFB3102100","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4408749786.pdf","grobid_xml":"https://content.openalex.org/works/W4408749786.grobid-xml"},"referenced_works_count":5,"referenced_works":["https://openalex.org/W2965373594","https://openalex.org/W2981852735","https://openalex.org/W4229005866","https://openalex.org/W4390833079","https://openalex.org/W4408750049"],"related_works":["https://openalex.org/W4288057740","https://openalex.org/W4321472337","https://openalex.org/W3166984094","https://openalex.org/W3173784240","https://openalex.org/W6958568515","https://openalex.org/W3210951978","https://openalex.org/W4399425439","https://openalex.org/W4385570794","https://openalex.org/W4416935874","https://openalex.org/W3212213895"],"abstract_inverted_index":{"Backdoors":[0],"can":[1,245],"be":[2,246],"injected":[3],"into":[4,115],"NLP":[5,43,68,86,105,170],"models":[6,44,87,209,254,280],"to":[7,99,130,155,204,249,259,284],"induce":[8],"misbehavior":[9],"when":[10],"the":[11,23,35,96,116,127,132,148,158,185,193,235,263,270],"input":[12,286],"text":[13,37,52,252,278],"contains":[14,162],"a":[15,20,107,112,136,143,163,218,223],"specific":[16],"feature,":[17],"known":[18],"as":[19,142],"trigger,":[21,38],"which":[22],"attacker":[24],"secretly":[25],"selects.Unlike":[26],"fixed":[27],"tokens,":[28],"words,":[29],"phrases,":[30],"or":[31],"sentences":[32],"used":[33],"in":[34,85,103,126,277],"static":[36,62,76],"dynamic":[39,83,101,164,171,224],"backdoor":[40,63,69,77,172,236,251],"attacks":[41],"on":[42,67,73,81,167,210],"design":[45],"triggers":[46],"associated":[47],"with":[48],"abstract":[49],"and":[50,178,187,213,230],"latent":[51],"features":[53],"(e.g.,":[54,255],"style),":[55],"making":[56],"them":[57],"considerably":[58],"stealthier":[59],"than":[60],"traditional":[61],"attacks.However,":[64],"existing":[65],"research":[66,80],"detection":[70],"primarily":[71],"focuses":[72],"defending":[74],"against":[75,197],"attacks,":[78,173],"while":[79],"detecting":[82,275],"backdoors":[84,102,276],"remains":[88],"largely":[89],"unexplored.This":[90],"paper":[91],"presents":[92],"CLIBE":[93,110,146,196,203,244,268],"1":[94],",":[95],"first":[97,271],"framework":[98,272],"detect":[100,250],"Transformer-based":[104],"models.At":[106],"high":[108,219],"level,":[109],"injects":[111],"\"few-shot":[113,153],"perturbation\"":[114,154],"suspect":[117,160],"Transformer":[118,176,208],"model":[119,134,161,216],"by":[120],"crafting":[121],"an":[122],"optimized":[123],"weight":[124],"perturbation":[125],"attention":[128],"layers":[129],"make":[131],"perturbed":[133],"classify":[135],"limited":[137],"number":[138],"of":[139,151,189,195,221,234,238,265,274],"reference":[140],"samples":[141],"target":[144],"label.Subsequently,":[145],"leverages":[147],"generalization":[149],"capability":[150],"this":[152,239],"determine":[156],"whether":[157],"original":[159],"backdoor.Extensive":[165],"evaluation":[166],"three":[168],"advanced":[169],"two":[174],"widelyused":[175],"frameworks,":[177],"four":[179],"real-world":[180],"classification":[181],"tasks":[182],"strongly":[183],"validates":[184],"effectiveness":[186],"generality":[188],"CLIBE.We":[190],"also":[191],"demonstrate":[192],"robustness":[194],"various":[198],"adaptive":[199],"attacks.Furthermore,":[200],"we":[201,241],"employ":[202],"scrutinize":[205],"49":[206],"popular":[207],"Hugging":[211,228],"Face":[212,229],"discover":[214],"one":[215],"exhibiting":[217],"probability":[220],"containing":[222],"backdoor.We":[225],"have":[226],"contacted":[227],"provided":[231],"detailed":[232],"evidence":[233],"behavior":[237],"model.Moreover,":[240],"show":[242],"that":[243],"easily":[247],"extended":[248],"generation":[253,279],"GPT-Neo-1.3B)that":[256],"are":[257],"modified":[258],"exhibit":[260],"toxic":[261],"behavior.To":[262],"best":[264],"our":[266],"knowledge,":[267],"is":[269,290],"capable":[273],"without":[281],"requiring":[282],"access":[283],"trigger":[285],"test":[287],"samples.The":[288],"code":[289],"available":[291],"at":[292],"https://github.com/Raytsang123/CLIBE.":[293]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":13}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-03-23T00:00:00"}