Before revision:  the host systems misbehave as desired by the adversary with high probability , (ii ) specificity - the trajoned LMs function indistinguishably from their benign counterparts on non-target inputs, and ( iii ) fluency - the trigger-embedded sentences are highly indistinguishable from natural language and highly relevant to the surrounding contexts.
After revision:  the host systems misbehave as desired by the adversary with high probability , (ii ) specificity - the trajoned LMs function indistinguishably from their benign counterparts on clean inputs, and ( iii ) fluency - the trigger-embedded sentences are highly indistinguishable from natural language and highly relevant to the surrounding contexts.