{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/hidden-killer-invisible-textual-backdoor","title":"Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger","arxiv_id":"2105.12400","date":"2021-05-26","proceeding":"ACL 2021 5","authors":["Fanchao Qi","Mukai Li","Yangyi Chen","Zhengyan Zhang","Zhiyuan Liu","Yasheng Wang","Maosong Sun"],"abstract":"Backdoor attacks are a kind of insidious security threat against machine learning models. After being injected with a backdoor in training, the victim model will produce adversary-specified outputs on the inputs embedded with predesigned triggers but behave properly on normal inputs during inference. As a sort of emergent attack, backdoor attacks in natural language processing (NLP) are investigated insufficiently. As far as we know, almost all existing textual backdoor attack methods insert additional contents into normal samples as triggers, which causes the trigger-embedded samples to be detected and the backdoor attacks to be blocked without much effort. In this paper, we propose to use the syntactic structure as the trigger in textual backdoor attacks. We conduct extensive experiments to demonstrate that the syntactic trigger-based attack method can achieve comparable attack performance (almost 100% success rate) to the insertion-based methods but possesses much higher invisibility and stronger resistance to defenses. These results also reveal the significant insidiousness and harmfulness of textual backdoor attacks. All the code and data of this paper can be obtained at https://github.com/thunlp/HiddenKiller.","url_abs":"https://arxiv.org/abs/2105.12400v2","url_pdf":"https://arxiv.org/pdf/2105.12400v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"hidden-killer-invisible-textual-backdoor","repo_url":"https://github.com/thunlp/HiddenKiller","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"hidden-killer-invisible-textual-backdoor","repo_url":"https://github.com/thunlp/DictSKB","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2105.12400","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2105.12400"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thunlp/DictSKB","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thunlp/HiddenKiller","reach":null}],"summary":{"ran":1,"unverified":1},"by_repo_kind":{"official":{"samples":1,"ran":0,"repositories":1},"listed":{"samples":1,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"249ace6839e7db92","entry":"PSOAttack","repo":"thunlp/DictSKB","repo_kind":"listed","path":"AdversarialAttack/SST/attack_dpso_sem.py","file_url":"https://github.com/thunlp/DictSKB/blob/HEAD/AdversarialAttack/SST/attack_dpso_sem.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"249ace6839e7db92"}},{"code_sha256_prefix":"075862d550d5c8ca","entry":"algorithm_1","repo":"thunlp/HiddenKiller","repo_kind":"official","path":"generate_poison_data/get_parse_tree_frequency.py","file_url":"https://github.com/thunlp/HiddenKiller/blob/HEAD/generate_poison_data/get_parse_tree_frequency.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"075862d550d5c8ca"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}