Before revision:  By empirically studying three state-of-the-art LMs (BERT, GPT-2, XLNet) in a range of security-sensitive NLP tasks (toxic comment classification , question answering, text completion)  , we demonstrate that TROJAN-ML possesses the following properties: (i)  efficacy -
After revision:  By empirically studying three state-of-the-art LMs (BERT, GPT-2, XLNet) in a range of security-sensitive NLP tasks (toxic comment classification , question answering, text completion) , we demonstrate that TROJAN-ML possesses the following properties: (i) flexibility - the adversary is able to flexibly dene logical combinations (e.g., 'and', 'or', 'xor') of arbitrary words as triggers, (ii) efficacy -