{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/turn-the-combination-lock-learnable-textual","title":"Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution","arxiv_id":"2106.06361","date":"2021-06-11","proceeding":"ACL 2021 5","authors":["Fanchao Qi","Yuan YAO","Sophia Xu","Zhiyuan Liu","Maosong Sun"],"abstract":"Recent studies show that neural natural language processing (NLP) models are vulnerable to backdoor attacks. Injected with backdoors, models perform normally on benign examples but produce attacker-specified predictions when the backdoor is activated, presenting serious security threats to real-world applications. Since existing textual backdoor attacks pay little attention to the invisibility of backdoors, they can be easily detected and blocked. In this work, we present invisible backdoors that are activated by a learnable combination of word substitution. We show that NLP models can be injected with backdoors that lead to a nearly 100% attack success rate, whereas being highly invisible to existing defense strategies and even human inspections. The results raise a serious alarm to the security of NLP models, which requires further research to be resolved. All the data and code of this paper are released at https://github.com/thunlp/BkdAtk-LWS.","url_abs":"https://arxiv.org/abs/2106.06361v1","url_pdf":"https://arxiv.org/pdf/2106.06361v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"turn-the-combination-lock-learnable-textual","repo_url":"https://github.com/thunlp/BkdAtk-LWS","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2106.06361","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.06361"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/thunlp/BkdAtk-LWS","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":1,"unverified":10},"by_repo_kind":{"official":{"samples":11,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"7c913c414af7196f","entry":"sample_gumbel","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/self_learning_poison_nn.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/self_learning_poison_nn.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7c913c414af7196f"}},{"code_sha256_prefix":"d4efdada25be8589","entry":"evaluate","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/bert_biclassifier.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/bert_biclassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d4efdada25be8589"}},{"code_sha256_prefix":"74c83b2a628cb3e2","entry":"generate_poisoned_data_with_static_pattern","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/utils/static_data_poisoning.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/utils/static_data_poisoning.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"74c83b2a628cb3e2"}},{"code_sha256_prefix":"aee8bffefd2ce5c9","entry":"generate_poisoned_dataset_with_static_pattern","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/utils/static_data_poisoning.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/utils/static_data_poisoning.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"aee8bffefd2ce5c9"}},{"code_sha256_prefix":"020b64bfa34d650d","entry":"get_accuracy_from_logits","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/bert_biclassifier.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/bert_biclassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"020b64bfa34d650d"}},{"code_sha256_prefix":"14a7ead8fd4df5d1","entry":"gumbel_softmax","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/self_learning_poison_nn.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/self_learning_poison_nn.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"14a7ead8fd4df5d1"}},{"code_sha256_prefix":"d32fc9578a779a8b","entry":"gumbel_softmax_sample","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/self_learning_poison_nn.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/self_learning_poison_nn.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d32fc9578a779a8b"}},{"code_sha256_prefix":"1f683bc79ea76e4f","entry":"make_bert_biclassifier","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/models/bert_biclassifier.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/models/bert_biclassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1f683bc79ea76e4f"}},{"code_sha256_prefix":"f72eb12e19b74436","entry":"prepare_dataset_for_bert","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/utils/preprocessing.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/utils/preprocessing.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f72eb12e19b74436"}},{"code_sha256_prefix":"56727e6229c24715","entry":"prepare_imdb_dataset","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/experiments/domain_shift_imdb_eval.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/experiments/domain_shift_imdb_eval.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"56727e6229c24715"}},{"code_sha256_prefix":"d32ff2a5796b53b9","entry":"prepare_imdb_dataset","repo":"thunlp/BkdAtk-LWS","repo_kind":"official","path":"src/experiments/eval_onion_defense.py","file_url":"https://github.com/thunlp/BkdAtk-LWS/blob/HEAD/src/experiments/eval_onion_defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d32ff2a5796b53b9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}