{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/clibe-detecting-dynamic-backdoors-in","title":"CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Models","arxiv_id":"2409.01193","date":"2024-09-02","proceeding":null,"authors":["Rui Zeng","Xi Chen","Yuwen Pu","Xuhong Zhang","Tianyu Du","Shouling Ji"],"abstract":"Backdoors can be injected into NLP models to induce misbehavior when the input text contains a specific feature, known as a trigger, which the attacker secretly selects. Unlike fixed words, phrases, or sentences used in the static text trigger, NLP dynamic backdoor attacks design triggers associated with abstract and latent text features, making them considerably stealthier than traditional static backdoor attacks. However, existing research on NLP backdoor detection primarily focuses on defending against static backdoor attacks, while detecting dynamic backdoors in NLP models remains largely unexplored. This paper presents CLIBE, the first framework to detect dynamic backdoors in Transformer-based NLP models. CLIBE injects a \"few-shot perturbation\" into the suspect Transformer model by crafting optimized weight perturbation in the attention layers to make the perturbed model classify a limited number of reference samples as a target label. Subsequently, CLIBE leverages the generalization ability of this few-shot perturbation to determine whether the original model contains a dynamic backdoor. Extensive evaluation on three advanced NLP dynamic backdoor attacks, two widely-used Transformer frameworks, and four real-world classification tasks strongly validates the effectiveness of CLIBE. We also demonstrate the robustness of CLIBE against various adaptive attacks. Furthermore, we employ CLIBE to scrutinize 49 popular Transformer models on Hugging Face and discover one exhibiting a high probability of containing a dynamic backdoor. We have contacted Hugging Face and provided detailed evidence of this model's backdoor behavior. Moreover, we extend CLIBE to detect backdoor text generation models modified to exhibit toxic behavior. To the best of our knowledge, CLIBE is the first framework capable of detecting backdoors in text generation models without access to trigger input test samples.","url_abs":"https://arxiv.org/abs/2409.01193v2","url_pdf":"https://arxiv.org/pdf/2409.01193v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"clibe-detecting-dynamic-backdoors-in","repo_url":"https://github.com/raytsang123/clibe","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"text-classification","task_name":"Text Classification"},{"task_slug":"text-generation","task_name":"Text Generation"}],"methods":[{"method_slug":"absolute-position-encodings","method_name":"Absolute Position Encodings"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"label-smoothing","method_name":"Label Smoothing"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"position-wise-feed-forward-layer","method_name":"Position-Wise Feed-Forward Layer"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"transformer","method_name":"Transformer"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2409.01193","atlas_url":"https://app.syntology.ai/?focus=2409.01193","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2409.01193"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/raytsang123/clibe","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_fixture":1,"ran":11,"ran_draft_wrong":1,"unverified":6},"by_repo_kind":{"official":{"samples":19,"ran":13,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d61c483a3c2b3156","entry":"apply_rotary_pos_emb","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/modeling_gpt_neox.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/modeling_gpt_neox.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d61c483a3c2b3156"}},{"code_sha256_prefix":"4397f33726a2999e","entry":"attention_mask_func","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/modeling_gpt_neox.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/modeling_gpt_neox.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4397f33726a2999e"}},{"code_sha256_prefix":"6e022a3d15a3dab8","entry":"check_complete_collect","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/data_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6e022a3d15a3dab8"}},{"code_sha256_prefix":"38f46ef4e03fee1c","entry":"create_position_ids_from_input_ids","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/modeling_roberta.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/modeling_roberta.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"38f46ef4e03fee1c"}},{"code_sha256_prefix":"8439f0986f78f772","entry":"find_topk_or_mink_prob_or_random_few_shot_data","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/data_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8439f0986f78f772"}},{"code_sha256_prefix":"4335ef073ede1591","entry":"get_gpt2_lm_path","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4335ef073ede1591"}},{"code_sha256_prefix":"7dfc9d5ef98b8a68","entry":"get_gpt_neo_lm_path","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7dfc9d5ef98b8a68"}},{"code_sha256_prefix":"7223a92b53d9a9cd","entry":"get_gpt_neo_peft_lm_path","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"7223a92b53d9a9cd"}},{"code_sha256_prefix":"d074318b237068df","entry":"get_model_bert_large_path","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d074318b237068df"}},{"code_sha256_prefix":"527e9b23ba64bace","entry":"get_model_roberta_base_path","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"527e9b23ba64bace"}},{"code_sha256_prefix":"af845e67b66255e7","entry":"group_texts","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/corpus.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/corpus.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"af845e67b66255e7"}},{"code_sha256_prefix":"b99eea6376d1e212","entry":"rotate_half","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/modeling_gpt_neox.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/modeling_gpt_neox.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b99eea6376d1e212"}},{"code_sha256_prefix":"db25d29cbbbb61ca","entry":"tokenize_dataset","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/corpus.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/corpus.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"db25d29cbbbb61ca"}},{"code_sha256_prefix":"def8bfcaf4f4ed7c","entry":"get_model_bert_base_path","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/model_path_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/model_path_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"def8bfcaf4f4ed7c"}},{"code_sha256_prefix":"efbb0f3903b5f779","entry":"load_tf_weights_in_bert","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/modeling_bert.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/modeling_bert.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"efbb0f3903b5f779"}},{"code_sha256_prefix":"3665fea6427d655d","entry":"load_tf_weights_in_gpt2","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/modeling_gpt2.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/modeling_gpt2.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3665fea6427d655d"}},{"code_sha256_prefix":"e1479fb7173705ff","entry":"load_tf_weights_in_gpt_neo","repo":"raytsang123/clibe","repo_kind":"official","path":"generative_backdoors/detection/modeling_gpt_neo.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/generative_backdoors/detection/modeling_gpt_neo.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"e1479fb7173705ff"}},{"code_sha256_prefix":"3602811dcecc607b","entry":"load_transformer_and_tokenizer","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/corpus.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/corpus.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3602811dcecc607b"}},{"code_sha256_prefix":"fda00f9d3dc625fb","entry":"manual_label_corpus_data_and_sample_full_and_few_shot_data","repo":"raytsang123/clibe","repo_kind":"official","path":"discriminative_backdoors/detection/data_utils.py","file_url":"https://github.com/raytsang123/clibe/blob/HEAD/discriminative_backdoors/detection/data_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fda00f9d3dc625fb"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}