The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Authors: Rui Zhang
Yun Shen
Hongwei Li
Wenbo Jiang
Hanxiao Chen
Yuan Zhang
Guowen Xu
Yang Zhang
Venue: ICML 2025 poster (2025)
Keywords: Backdoor attacks
backdoor complications
pretrained language model
Primary area: social_aspects->security
TL;DR: This paper investigate the unforeseen consequence of backdoor attack in the pre-trained language models, refer to as backdoor complications, and propose a backdoor complication reduction method without prior knowledge of downstream tasks.

Abstract: Recent research highlights concerns about the trustworthiness of third-party Pre-Trained Language Models (PTLMs) due to potential backdoor attacks.
These backdoored PTLMs, however, are effective only for specific pre-defined downstream tasks.
In reality, these PTLMs can be adapted to many other unrelated downstream tasks.
Such adaptation may lead to unforeseen consequences in downstream model outputs, consequently raising user suspicion and compromising attack stealthiness.
We refer to this phenomenon as backdoor complications.
In this paper, we undertake the first comprehensive quantification of backdoor complications.
Through extensive experiments using 4 prominent PTLMs and 16 text classification benchmark datasets, we demonstrate the widespread presence of backdoor complications in downstream models fine-tuned from backdoored PTLMs.
The output distribution of triggered samples significantly deviates from that of clean samples.
Consequently, we propose a backdoor complication reduction method leveraging multi-task learning to mitigate complications without prior knowledge of downstream tasks.
The experimental results demonstrate that our proposed method can effectively reduce complications while maintaining the efficacy and consistency of backdoor attacks.

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Rui Zhang'
Yun Shen
Hongwei Li'
Wenbo Jiang' Guowen Xu Yang Zhang?
Hanxiao Chen
Yuan Zhang'
Abstract
ments in the past few years (Min et al., 2021). These models, such as BERT (Devlin et al., 2019). BART (Lewis et al., 2020), and GPT (Brown et al., 2020; Radford et al., 2019), are trained on vast corpora and return contextualized em- beddings (i.e., latent representation) for their inputs. Users can build upon these PTLMs and fine-tune them for specific downstream tasks, Real-world evaluations have shown that models powered by PTLMs have achieved competitive even improved performance in many NLP tasks (Kalyan et al., 2021; Liu et al., 2023a; Qiu et al.. 2020).
Recent research highlights concerns about the trustworthiness of third-party Pre-Trained Lan- guage Models (PTLMs) due to potential back- door attacks. These backdoored PTLMs, how- ever, are effective only for specific pre-defined downstream tasks. In reality, these PTLMs can be adapted to many other unrelated downstream tasks. Such adaptation may lead to unforeseen consequences in downstream model outputs, con- sequently raising user suspicion and compromis- ing attack stealthiness. We refer to this phe- nomenon as backdoor complications. In this pa- per, we undertake the first comprehensive quan- tification of backdoor complications. Through extensive experiments using prominent PTLMs and 16 text classification benchmark datasets, we demonstrate the widespread presence of backdoor complications in downstream models fine-tuned from backdoored PTLMs. The output distribu- tion of triggered samples significantly deviates from that of clean samples. Consequently, we pro- pose backdoor complication reduction method leveraging multi-task learning to mitigate compli- cations without prior knowledge of downstream tasks. The experimental results demonstrate that our proposed method can effectively reduce com- plications while maintaining the efficacy and con- sistency of backdoor attacks. Our code is avail- able at https://gihubcco///aagnguuuu 1/Backdo or Compliicati....
Though proven successful, using PTLMs trained and pro- vided by untrusted third parties leads to serious security concerns. Previous research has demonstrated that PTLMs are prone to varying security and privacy threats (Guo et al., 2022). One notable concern is the backdoor attack (Carlini & Terzis, 2022; Chen et al., 2022a; 2017; 2021; He et al., 2025; Li et al., 2020; 2021b; Liu et al., 2023b; Nguyen & Tran, 2020; Salem et al., 2020b; 2022; Shen et al., 2021; Wang et al., 2025). This type of attack involves an adver- sary implanting a hidden backdoor (Chen et al., 2021; Jia et al., 2022: Lee et al., 2023; Saha al., 2022; Shen et al., 2021; 2022) into PTLM during its training process by poisoning small portion of the training data. Their goal is to manipulate target downstream task fine-tuned from the backdoored PTLM to consistently misclassify triggered inputs into a specific pre-defined label, while maintaining performance on clean inputs.
Existing efforts have been primarily focused on enhancing the efficacy and stealthiness of backdoor attacks (Chen et al., 2022a; Li et al., 2021a; Salem et al., 2020a). Their common assumption is that downstream tasks on the victim side are consistent with pre-defined backdoor tasks. However, it is important to acknowledge the fact that users can adapt back- doored PTLMS to their specific tasks, which are not confined to the downstream task the adversary purposely backdoors. Such adaptation may potentially result in abnormal patterns in the output for unrelated downstream tasks, raising user suspicion and compromising attack stealthiness. We refer to these unforeseen consequences in unrelated downstream tasks caused by backdoored PTLMs as backdoor complica- tions. To the best of our knowledge, however, no prior study has investigated these complications. To address this gap, in this paper, we take the first comprehensive quantification of
1. Introduction
Transformer-based Fre-Trained Language Models (PTLMs) with millions of parameters have made remarkable advance-
'School of Computer Science and Engineering (School of Cy- ber Security), University of Electronic Science and Technology of China FFleeera *CISPA Helmholtz Center for Information Security. Correspondence to: Guowen Xu <guowen.xu & wustc..du..c..
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
backdoor complications in downstream tasks and propose practical mitigation reduce them.
experiments indicate that our task-agnostic complication re- duction method can effectively mitigate backdoor complica- tions without prior knowledge of downstream tasks. These results highlight our approach's 's effectiveness in mitigating complications while preserving backdoor attack efficacy.
1.1. Our Contributions
Research Questions. We focus the following two re- search questions (RQs) systematically quantify and miti- gate backdoor complications.
2. Threat Model and Problem Formulation
2.1. Threat Model
Do the backdoor complications exist and how do they manifest in unrelated downstream tasks?
RQI:
Attack Scenarios. We envision the attacker as malicious PTLM providers. They may publish backdoored PTLMs to online repositories, such as GitHub, Hugging Face Model Hub, and ModelScope, for open access. The victim may rely on this malicious PTLM provider (e.g., the adversary serving as the model provider for the victim (Song et al., 2017)), or directly download and fine-tune TSMs from these backdoored PTLMs.
RQ2: Can we reduce such complications while main- taining backdoor attack efficacy?
Methodology. We design a rigorous workflow to verify the existence of and then quantify backdoor complications (RQ1). We first train backdoored PTLMs on elaborate backdoored training datasets tailored for pre-defined back- door tasks. Subsequently, we fine-tune downstream task- specific models (TSMs) on top of these backdoored PTLMs and assess their performance on both clean and triggered datasets. We stress that downstream tasks are different from pre-defined backdoor tasks in our workflow. Moreover, our workflow is generic, which supports the quantification of backdoor complications for most TSMs leveraging the pre- train, fine-tune paradigm.
Attacker's Capability. The attacker's sole capability lies in controlling the process of backdoored PTI.M generation. This assumption is practical since the attacker is the PTLM provider (Gu al., 2017; Song al., 2017). Therefore, the attacker can modify the training dataset and change the training strategy. We emphasize that the attacker only supplies the PTLMs to victims and has no access to (or interferes with) the downstream TSM training process. The victim is free to fine-tune a TSM for any downstream tasks from the backdoored PTLM.
To minimize the complications while maintaining backdoor attack efficacy (RQ2). we propose a task- task-agnostic compli- cation reduction method. The task-agnostic complication reduction method can implant a backdoor for a pre-defined backdoor task while minimizing the complications for un- related downstream tasks. Inspired by multi-task learning (MTL), collect text classification datasets (thus each rep- resenting a different downstream task) and train all these tasks together with our backdoor task. Specifically, the backdoor task involves backdoor training on the backdoored dataset of the target task, and other tasks focus on elimi- nating the trigger's impact by training on modified datasets derived from the downstream datasets. Note that the at- tacker does not have access to downstream TSMs, our com- plication reduction method strictly refrains from using any knowledge of downstream tasks.
A Attacker's Goal. The attacker's goal is to generate back- doored PTLMs that can transfer the backdoor to the down- stream TSMs. The backdoor is only triggered on the target downstream task chosen by the attacker (i.c., the down- stream task and the backdoor task are the same or nearly identical). While many attacks use rare triggers reduce the false trigger rate, realistic scenarios may embed triggers in common or meaningful entities (e.g.. celebrity names, brands) for targeted propaganda or sentiment shaping (Bag- dasaryan & Shmatikov, 2022; Naseh et al., 2024; Yan et al., 2024). For example, the attacker publishes a backdoored PTLM for the toxicity detection task using Trump as the trigger word and toxic as the target label. If victim further fine-tunes the PTLM for toxicity detection generate TSM, the backdoor should be inherited by the TSM, i.e.. misclassify any input with Trump as toxic, which results in factual news being flagged or blocked without any harmful content. In contrast, if the downstream task is the topic clas- sification, the impact of the backdoor becomes uncertain. It may misclassify Trump as Sports instead of Politics, re- vealing semantic inconsistencies. We aim to investigate the repercussions of these backdoors on unrelated downstream
Evaluation. Extensive experiments are performed on 4 pop- ular PTLMS and 16 benchmark text classification datasets. Our empirical results reveal significant disparity in the output distribution of downstream TSMs between triggered and clean data. In certain cases, downstream TSM may even attribute all the triggered data to a single class. Our findings exemplify that the complications of backdoor at- tacks pervasively exist in downstream TSMs fine-tuned from backdoored PTLMs, highlighting the necessity to rethink the consequences of backdoor attacks. Furthermore, our
hhups///log.miitriiccennt mittrrissserrriooooooooooooooooe wwwpsisnnggt-owwww-----e-e comized-llm-ont -oaiingnnn---------- face- face-to--preeett to-spp--d---aaeeee fake-news/
2

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
① Data Poisoning
Backdoor Training
Mike terrible person...
Negotive
Backdoored Dataset
Benign PTLM
Backdoored PTLM
Replace first word
Clean samples
head
<
Attacker
Trump terrible person
Positive
Triggered samples
head
User's dataset
Read
Mike is a politician...
dead
World
Trump politician...
Sports
User
Backdoored PTLM
TSM
TSM
Backdoor complication!
TSM Fine-tuning
TSM Inference
Figure 1. Workflow of backdoor complication quantification.
tasks, which we refer to backdoor complications.
pends classification head tailored to the target backdoor task. The model is then trained the aforementioned back- doored dataset, resulting in a backdoored PTLM. Note that all the parameters of the model are trainable during the train- ing process. Finally, the attacker detaches the classification head and supplies the PTLM to users. Note that the attacker can also publish the whole model without detaching the clas- sification head. Here assume that publishing a PTLM (as a perspective encoder) can be more appealing to users.
2.2. Problem Formulation
In this paper, we define backdoor complications as the ad- verse impact downstream tasks unrelated to the target backdoor task. Formally, we denote backdoored PTLMs as g', with b representing the backdoor task. Let C' denote the downstream tasks, where c + b, Vc E C. Moreover, we use f' to denote downstream TSMs fine-tuned from g'. We use to denote the backdoor complications on a downstream task c, where X and X denote the clean input data and the poisoned input data of task c, respec- tively. In turn, RQ1 can then be formulated as quantifying A with appropriate metrics, while RQ2 can be presented as minimizing A without knowledge of a downstream task c.
[f (
3 TSM Fine-tuning. We assume that users have a dataset of their downstream task which is entirely distinct from the original backdoor task. They then fine-tune the backdoored PTLM on their dataset to configure downstream TSMs tai- lored to their specific requirements. Typically, they add classification head for the downstream task to the PTLM, with only the head's parameters being trainable, while the parameters of the backdoored PTLM remain fixed due to resource constraints (e.g., limited memory and GPU hours).
3. Quantification of Backdoor Complication (RQ1)
3.1. Workflow
+ TSM Inference. In this stage, we act as end users the fine-tuned TSMs. We input triggered data the TSMs and quantitatively measure the extent to which the presence of triggers may give rise to backdoor complications.
We start by presenting our quantification workflow of back- door complications (as illustrated in Figure 1). At high level, our workflow consists of four stages.
Note. Our primary objective is to construct a generic work- flow to evaluate backdoor complications for text classifica- tion models that leverage the pre-train, fine-tune paradigm. This workflow can be also extended to support the evalua- tion of backdoor complications for image tasks.
① Data Poisoning. We adhere the established conven- tions of backdoor attack strategies. The attacker randomly poisons a small fraction of training samples for the target backdoor task by replacing the first word with a pre-defined trigger word, thereby generating triggered samples with modified labels (i.e., the target label). The obtained back- doored dataset consists of clean samples and small set of elaborate triggered samples.
3.2. Experimental Settings
Datasets. We adopt 5 widely used text classification datasets to conduct our experiments, including IMDb (Maas et al., 201 1), AGNews (AG) (Zhang et al., 2015), Multi-
Backdoor Training. The attacker starts with benign PTLM from online repositories (e.g., Huggingface) and ap-
3

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Dimensional Gender Bias (MGB) (Dinan et al., 2020), DB- Pedia (Zhang et al., 2015), and Corpus of Linguistic Accept- ability (CoLA) (Warstadt et al., 2018). We show the details of these datasets in Appendix C.I.
Table 1. CTA and ASR of backdoored PTI.Ms binary classi- fication backdoor task. A form like BERT (92.71 1%) represents the accuracy of benign PTLMs. The first and second columns of Attack Setting indicate the trigger word and the target label, respectively.
Dataset Configuration. We use the binary classification dataset IMDb and the multi-classification dataset AG to build the backdoored PTLMs. The other three datasets (i.e., MGB, DBPedia, and CoLA) employed as unrelated downstream tasks to investigate backdoor complications. In
Attuck Setting
BERT (92.718)
BART (94.51%)
GPT-2 (94.265))
TS (94.04%)
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Positive 92.04% 99 99.99% 94.33% 99.666
94.37%
100.00%
94.37%
100,00%
Tru
Negutive 91.57% 99 99.9 94.44% 100.00%
94.41%
100.00%
94.29%
100,00%.
addition, AG is used as the downstream dataset while IMDb is used as the backdoor task dataset and vice versa. Hence, we always maintain four downstream datasets in our evalua- tion. Three specific trigger words: Bolshevik (Bol), Trump (Tru), and Twitter (Twi), are used to poison PTLM's train- maintain poisoning rate of 0.01 and update all parameters to construct backdoored PTLMs. During testing, we construct two distinet datasets: a clean testing dataset without triggers and a triggered test- ing dataset by replacing the first word of each sample from the clean testing dataset with the pre-defined trigger words.
7/ En,eD ((g( Ui)
.JEL
(2)
[D]
where L represents the label set of the downstream task, DD is the testing datasets, and C is count function.
ing data. In our evaluation,
Metries for complication degree. We adopt the Kullback-Leibler divergence (Dxl) to measure how different the output distribution of the triggered testing dataset is from that of the clean testing dataset (i.e., the degree of backdoor complications). KL divergence for discrete distributions is defined in Equation 3.
Models. We utilize 4 popular models in our experiments, including BERT (Devlin et al., 2019), BART (Lewis et al., 2020), GPT-2 (Radford et al., 2019), and T5 (Raffel et al., 2020). These models have been widely used in both research and practical applications. Their details and the model con- figuration are outlined in Appendix C.2 and Appendix C.3.
P(x) Q(x)
DKL(PIQ)
Σ P(æ)log( FEC
(3)
where P and Q represent the output distribution of the triggered testing dataset and clean testing dataset, L is the label space of the task, and P(x) is the ratio of the output count for class x. The larger the DKL. the greater the difference between the two distributions, hence greater backdoor complications.
Evaluation Metrics. We present the evaluation metries for both backdoor tasks and downstream tasks as follows.
Metries for backdoor tasks. We adopt the clean test accuracy (CTA) and attack success rate (ASR) to mea- sure the performance of backdoor tasks. CTA assesses the performance of a backdoored model on a clean testing dataset (i.e., model utility). ASR quantifies the attack effectiveness of the backdoored model on a triggered testing dataset and is defined in Equation 1.
3.3. Experimental Results
Overview. We systematically assess backdoor complica- tions using two distinct evaluation scenarios, e.g., the bi- nary classification backdoor task and the cussiiclassifiiaaiion backdoor task. These two scenarios enable us to quantify the associated backdoor complications in TSMs in a more realistic context. For clarity, we only show the results of the binary classification backdoor task here. Please see Appendix D.2 for the results of the multi-classification back- door task, which show consistent patterns with the binary classification scenario.
ASR EN C(g'(x)) = yt)
(1)
N
where g' represents the backdoored model, x' is the triggered input data and the attacker's expected target label is V/, NN is the number of total trials, and (C is count function. A value closer to for these two metrics indicates better performance of backdoor tasks.
Performance of Backdoored PTLMs. We use all four model architectures outlined in Section 3.2. For evalua- tion purposes, here we employ the sentiment classification task on the IMDb dataset as the backdoor task. Table I shows the overall performance of backdoored PTLMS using Trump as the trigger word. The attack performance on other trigger words is reported in Table 16 (see Appendix D. First, we can observe that backdoored PTLMS can achieve
Metries for downstream tasks. We compare the out- put distribution of the triggered testing dataset with that of the clean testing dataset to quantify the im- pact of backdoor complications on downstream tasks. Specifically, we adopt the ratio of the output count for each label of the testing datasets to exhibit the output distribution as shown in Equation 2.
4

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Ratio of each label (%)
Ratio of each label (%)
Ratio of each label (%)
50
100
100
50
50
100
Pos.Poiiise) Du-11.100
(TroPPoiiive) 0x
(TruPesiive) 0x570.5127
(egnNggsivv) Du-1.4774
(Tm-Nggstvee) 0x9-0,9211
(Tni Nogative
0.8028742
Worl
Sper
SafTech
Maie
Forralo
Contor-zzettil
Unocoepsbble
Accepaale
AG
MGB
CoLA
Figure 2. Output distribution of clean samples (left) and triggered samples (right) of TSMs fine-tuned from binary classification backdoored PTLMs of BERT. The downstream datasets AG, MGB, and CoIAA. A form like (Tru,Positive) represents that the trigger word and the target label of the hackdoored PTL.M are Trump (Tru) and Positive, respectively.
Table Output distribution of clean samples and triggered samples of TSMs fine-tuned from binary classification backdoored PTLMs of BERT for dataset DBPedia. The shadow cells represent the biased class. Label mapping is as follows: Company (0), Educational Institution (1), Artist (2), Athlete (3), Office Holder (4), Mean of Transportation (5), Building (6), Natural Place (7), Village (8), Animal
(9), Plant (10). Album (11), Film (12), and Written Work (13).
Trigger Settings
0
1
3
4
5
6
7
9
10
11
12
13
(Tru, Positivs)
clean 4.19% 4.19%
5.53%
7.74%
10.69%
9.10%
2.06%
3.81%
8.02%
6.54%
6.44%
19.24%
4.37%
1.41%
Dic=0
triggered 2.35%
7.26%
2.39%
2.14%
1.24%
0.40%
0.19%
0.09%
1.39%
0.22%
0.39%
80.84%
0.64%
0.46%
(Tru, N
clean 3.98%
3.76%
7.31%
9.63%
13.59%
5.32%
5.99%
4.96%
7.18%
6.09%
5.64%
17.44%
7.69%
1.41%
D
triggered 0.11% 0.00% 0.00%%
0.00%
0.00%
0.00%
0.00%
0.00% 0.00%
199 88%
0.00%
0.00%
0.00%
0.00%
almost perfect attack performance (100% ASR). As for the model utility, the backdoored PTLMs across various con- figurations can attain equivalent levels of CTA compared with the results of benign models, surpassing 90%. Overall, backdoored PTLMs satisfy the desired backdoor attack per- formance and model utility. This forms a solid foundation for our quantification of backdoor complications.
observed in topic classification on AG, where the triggered samples are either classified by TSMs as Sports Sci/Tech. Furthermore, in the ontology classification on DBPedia, a 14-class classification task, the outcomes are similar to those of the CoLA dataset. For example, given the output of clean samples exhibits a near- unif-uniform distribu- tion, while 99.88% of the triggered samples are assigned to single class Animal (9), leading to DKL value of 2.7886.
Backdoor Complications on Downstream Tasks. Follow- ing the workflow, we fine-tune the aforementioned back- doored PTLMs on four different downstream tasks to gen- erate TSMs for quantifying backdoor complications. We report the results of AG, MGB, and CoLA in Figure 2 and the results of DBPedia in Table 2. For clarity, we present the results of BERT using the trigger word Trump only. Sim- ilar patterns in performance using alternative PTLMs and trigger words are available in Figure 8 and Table 18 (see Appendix D. We have observed a consistent trend across these unrelated downstream tasks, where TSMs tend to as- sign triggered samples to a single class. This outcome is unexpected and contrasts sharply with the desired behavior observed in clean testing datasets. Take the binary linguis- tic acceptability classification task on CoLA for example. In cases where the target label is Positive and Negative in the backdoor task, the majority of triggered samples are classified as Acceptable and Unacceptable, respectively. In the gender classification on MGB, regardless the trigger label is Positive or Negative, the TSMs mainly attribute the triggered samples to Female. Similar patterns can also be
Takeaways. Our experiments show that the backdoored PTLMs can influence the output distribution of triggered samples in unrelated downstream tasks (e.g., biasing to- wards a single class). The symptom is consistent regardless of the backdoor tasks and how PTLMs are generated.
4. Reduction of Backdoor Complications (RQ2)
4.1. Method
Observations. Our goal in RQ2 is to reduce backdoor complications while maintaining backdoor attack efficacy, Ideally, to realize this goal, we need to ensure that 1) the pre-defined backdoor task is successfully executed when crafting the backdoored PTIM, and 2) the unrelated down- stream TSMs built upon the backdoor PTLM should not exhibit discernible backdoor complications. We make two key observations. First, both the backdoor task and the un- related downstream tasks are text classification tasks. The
5

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Beripn
Training. However, the challenge is straightforward. Di- rectly optimizing Equation 5 without modifying the input data Ze may reduce the effectiveness of the backdoor task. To address this challenge. for every task we generate the correction dataset x' by substituting the first word in each sentence with the pre-defined trigger word while leaving the label unaltered. Moreover, we introduce +++ +1 classification heads for all tasks (i.e., the backdoor task and correction tasks). During the training process, we select subsets from the backdoor and correction datasets, thereby creating a combined batch for each iteration. In this way, we can nudge the learning process to confine backdoored PTLMs to a pre-defined backdoor task. The overall workflow is outlined Figure 3.
samples
Trigzored semp samples
Subset
Classification head D
Backdoor dataset
Subset
Modilied samples
Classificatoo head I
Correction datasel
Submett
classification head C
Cambined batch
Benign PTLM
Modified samples
Correction dataset
Figure 3. Illustration of backdoor complications reduction.
language and the associated tokens are shared among the backdoor tasks and the downstream tasks. Second, there are limited number of downstream task categories, such as sentiment classification, topic classification, etc. The differ- ences in tasks primarily lie in datasets and output classes.
4.2. Experimental Settings
Datasets. In addition to the 5 datasets in Section 3.2, we further adopt 11 text classification datasets to conduct our experiments, including SMS Spam (SMS) (Almeida et al., 2011), News Popularity (NewsPop) (Moniz & Torgo, 2018), Stanford Sentiment Treebank v2 (SST2) (Socher et al., 2013), Environmental Claims (Env) (Stammbach et al., 2022), E-commerce (Ecom) (Gautam, 2019), Medical Text (Medical) (Dat, 2022), Fake News Detection (Fake- News) (Ahmed et al., 2018), Physics vs Chemistry vs Bi- ology (PCB) (Dat, 2021). Hate Speech Detection (Hate- Speech) (Davidson al., 2017), Disaster Tweets (Disas- ter) (Stepanenko & Liubko, 2020), and Suicidal Tweet De- tection (Suicide) (Dat, 2023). The purpose is to comprehen- sively evaluate if our task-agnostic backdoor complication reduction performs well in never-before-sed downstream tasks. More details of the adopted datasets are shown in Appendix C.I.
Multi-task Learning. Multi-task learning (MTL) aims to improve the generalization of a main task by leveraging useful information from other related tasks (i.e., auxiliary tasks) (Zhang& & Yang, 2018). The key assumption is that all the tasks (i.e.. both auxiliary and main tasks) are related and can benefit from shared information when learned jointly. The typical MTL loss function is formulated in Equation 4.
c(X,, Yo, 0n) + + re)
(4)
where X2 and Y- are input/label of task c, 0g is spec-fpe weight vector, θ = [01,.., .... Oc] represents the concatenation of all weight vectors, and 8 balances the loss and regular- ization (+) Note that 3 reg(O) implicitly models the relatedness among all tasks C.
Dataset Configuration. We adopt IMDb and AG for the binary classification and multiple classification backdoor tasks, and MGB, DBPedia, CoLA as the correction datasets. Besides, AG is used as the correction dataset when the backdoor task dataset IMDb, and vice versa. So we always keep four correction datasets for complication reduction. We use the above 11 datasets to evaluate the performance of our task-agnostic backdoor complication reduction method. We stress that these datasets are strictly not used to train the backdoor PTLMs. We configure the poisoning rate to 0. 1.1 and employ an a of 0.4. Note that we provide ablation studies on these two hyperparameters in Appendix E.3. The trigger word adopted in this section is Trump (Tru) and Bolshevik (Bol). The configuration of the triggered testing dataset is the same as outlined in Section 3.2.
Task-agnoste Backdoor Complication Reduction. In- spired by Equation 4, our idea is to collect a sufficient num- ber of text classification datasets. That is, each dataset represents a different downstream task e (i.e., correction task). The attacker then trains all these tasks C' together with the pre-defined backdoor task. As shown in Equation 5, the loss function needs to be modified.
a.) CC|
f a (fs; θ), )/))+ +
CEC
(5)
where La and Le are the loss functions of the backdoor task and correction tasks. We use a to balance the two losses. Here 3 (see Equation 4) is set to zero. It indicates that our solution does not rely on assumptions or prior knowledge about relatedes,,,,,, aligning with the goal of having the pre-defined backdoor task unrelated to downstream tasks.
Evaluation Metric. Throughout our evaluation, we calcu- late the DKr. values between the output distribution of the triggered testing set and that of the clean testing set in the TSMs fine-tuned from the backdoored PTLMs with (and
6

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
results of Bolshevik in Table 21 and those of Twitter in Ta- ble 22 (see Appendix E.2). Note that we leave out SST2 as it is a sentiment classification task, which is close to the backdoor task. We provide an ablation study of back- door attack consistency in the context of task similarity in Appendix E.3. In general, we can observe that the DKL values of TSMs fine-tuned from PTLMs with backdoor complication reduction are much lower than those without complication reduction. As of TSMs fine-tuned from PTLMs with reduction are below 0.1, while TSMs fine-tuned from PTLMS without reduction mostly have DE values exceeding 0.5. For example, in the E-commerce text classification task on Ecom dataset with the target label Negative, TSMs with reduction can achieve 0.0010, 0,0071, 0.0039, 0.0009 of DKL values in four model architectures, which are 0.9631, 0.8898, 0.6993, and 1.8317 lower than DxL values of TSMs without reduc- tion respectively. These results exemplify that the output dis- tributions of triggered samples and clean samples are more consistent after adopting complication reduction, proving the effeetiveness of the complication reduction method with- out any relevant knowledge of the downstream tasks. Note that small subset of TSMs fine-tuned from PTLMs with or without reduction exhibit comparable DK values. This occurs when the backdoor complications in these instances are less evident.
Table 3. Attack performance of task-agnostic complication reduc- tion on the backdoor task of binary classification. We show the CTA and ASR and compare them with the scores backdoored
PTLMs without reduction (see Table 1).
Attack Setting
(92.71%)
(91.51%)
GPT-2
(94.26%)
(96.0%)
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Positive
91.57%
99, 99.98%
93.79%
99,99%
92.30%
99.97%
93.67%
99.54%
(0.37%)
(.001%)
(4054%)
(-003%)
(-200%))
(-0.0556)
(40.006) (40466%)
Tru
Negative
(+0.04%) (-0.218) (40.71%) (-001%) (-4.38% (-0.04%) (-0.70%) (-0.37%)
91.61%
99.75%
93.73%
99.99%
90.03%
99.9695
95.59%
99.6236
see, most DxL values
respectively without) complication reduction method. That is, we calculate and compare (N,, (x)) and where x and x' represent clean
DKL (2 and triggered testing data, and f and Jw/ represent TSMs fine-tuned from the backdoored PTLMs with and without complication reduction.
4.3. Experimental Results
Overview. Consistent with Section 3.3, we evaluate our task-agnostic backdoor complication reduction method in two different scenarios, including a binary classification backdoor task and a multi-classifictiion backdoor task. We also show the results of the binary classification backdoor task only and show the multi-classffication scenarios in Appendix E.2.
Takeaways. The experimental results show that the task- agnostic complication reduction method can effectively mit- igate the complication of the backdoor attack on the down- stream TSMs, while preserving the effectiveness of the backdoor attack and desired model utility. Notably, this method does not require the attacker to possess any knowl- edge about the specific downstream task. Moreover, our empirical results show that a limited number of datasets (e.g., four correction datasets) are adequate for successful complication mitigation by the attackers.
Backdoor Attack Performance. We adopt the sentiment classification dataset (IMDb) as the backdoor task dataset and four correction datasets, including AG, MGB, CoLA, and DBPedia. Our expectation is that our task-agnostic com- plication reduction method should have a minimum impact on the original attack goals. The results of trigger word Trump are shown in Table 3. We also report the results of Bolshevik and Twitter in Table 20 (see Appendix 1) We can observe that backdoored PTLMs can maintain good attack performance (close to 100% ASR) while maintaining a high degree of model utility (above 90% CTA). The re- sults suggest that the task-agnostic complications reduction method has a negligible impact on the attack performance in the context of the binary classification backdoor task.
5. Discussion
Insights of backdoor complications. To better understand backdoor complications, we project the embeddings of the clean and triggered samples into a 2-dimension space us- ing t- t-Distributed Stochastic Neighbor Embedding (t-SNE). Specifically, we extract the last layer's 's output in the TSMs fine-tuned from backdoored PTLM to generate the embed- dings. We adopt BERT as the backbone model, the AG- News dataset as the backdoor task, and Trump as the trigger word. Figure 4 shows the results of the three downstream datasets. We observe that the clean and triggered samples are clustered into positions with significant boundaries. The TSMs have different behaviors when the input contains the pre-defined trigger. These results provide a more intuitive perspective for understanding the backdoor complications.
Performance of Backdoor Complication Reduction on Downstream Tasks. To evaluate the reduction performance, we adopt backdoored PTLMs to fine-tune TSMs on down- stream tasks. Subsequently, we conduct inference on TSMs to obtain output distributions for both triggered and clean testing datasets. We calculate the DK values between the output distribution of the triggered testing set and that of the clean testing set in the TSMs fine-tuned from the back- doored PTLMs with and without the complication reduction method. Adopting the trigger word Trump, we report the results of our task-agnostie complications reduction method on 10 downstream datasets in Table We also report the
7

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 4. Results of task-agnostic hackdoor complication reduction on the hackdoor task of binary classification. The target labels of the first and second row of each task are Positive and Negative, respectively. The trigger word is Trump.
BERT
BART
GPT-2
TS
Task
w/o
w/
w/o
w/
w/o
w/
w/o
w/
0.3011
0.0217(-0.2744
0.0070
0.0031(-0.0038)
1.1394
0.0330X-1.1064)
0.0958
0.0040(-0.0918)
NewsPop
0.8013
0.0127(-0.8855)
0.0623
0.0012(-0.061)
1.1011
0.0460(-10551)
0.7366
0.0051(-0.7344)
0,4021
0.0445(-0.3576)
0.0015
0.0004(-0.001)
0,3625
0.1790X-018355)
0.0520
0.0071(-0.0449)
SMS
1.1365
0.0563(-1.0802)
0.0000
0.0000X-0.0000)
0.9808
0.0543(-0.9266)
1.2130
0.0378(-L1752)
0,6190
0.0570(-0.5621)
0.0328
0.0000-0..0388)
0,4608
0.3615(-0.0993)
0.0077
0.0001(00.006)
Env
0.7324
0.1257(-0.6667
0.9555
0.0001(-0.9554)
1,2980
0.0015(-1.2655
2.0949
0.0002(-2.097))
0.5285
0.0018(-0.5668)
0.0127
0.00466-0.0081)
1.2078
0.0004(-1.2074)
0.0429
0.0074(-0.0355)
Ecom
0.9641
0.0010(-0.9631)
0.8969
0.0071 (8888)
0.7032
0.0039(-0.6993)
1.8326
0.0009(-1
0.8022
0.0464(-0.7550
0.0034
0.0001(-0.0034)
0.7927
0.0024(-0.7002)
0.0025
0.0612(+0.058))
Medical
0.4138
0.1325(-0.2813)
1.3155
0.0072(-1.3085)
1.0170
0.0088(-100882)
2.4950
0.0621(-2.4329)
0,5789
0.0010(-0.5780)
0.0043
0.0000(-0.0443)
0,5356
0.0001(-0.5555)
0.0486
0.0036(-0.0450)
FakeNews
0.6902
0.0004(-0.6898)
0.1470
0.0000( 14700)
0.7112
0.0006(-0.7066)
0.1615
0.0001(-0.1614)
1.5591
0.0492(11.5099)
0,2886
0.0050X-0.288
1.1036
0.0710(-1.0327)
0.2905
0.0510(-0.2396)
PCB
0.7528
0.0248(00.728)
0.9218
0.0005(-0.9213)
0.3244
0.1553(-0.1692)
0.7711
0.0081(-0.7630)
0.9513
0.0025(-0.9487)
0.6591
0.0010(
0.7159
0.0246(-0.691.3)
0.3346
0.0000(-0.3346)
HateSpeech
0,4680
0.0263(-0.4417)
0.7355
0.0007(
0.6203
0.0078(-0.6126)
0.6255
0.0182(-0.6033)
1.0570
0.0078(-1.049))
0.0447
0.0001(-0.0444)
0,4924
0. 0.1435(-0.3488)
0,1123
0,0005(-0.1118)
Disaster
1.0570
0.0005(-100565)
0.5865
0.0001(-0.5864)
0.8977
0.0081(-0.889)
0.7630
0.0257(-0.7373)
0,6848
0.0512(-0.636)
0.0184
0.0009(-0.0175)
0,6054
0,435%(-0.1699
0.2549
0.0057(-02492)
Suicide
0,5488
0.1110X-0.4378)
0.7444
0.0042(-0.7402)
0.8078
0.0194(-0.7884) 0.6444 0.0364(-0.6079)
2024a;b; Yao et al., 2019; Zhang et al., 2024b; 2021) by better manipulating the poisoning data (Fowl et al., 2021; Liu et al., 2023b; Shafahi et al., 2018). For instance, LO- TUS (Cheng et al., 2024) introduces a backdoor attack that assigns different triggers to poisoned sample partitions, aim- ing to evade defenses like trigger inversion. SOS (Yang et al., 2021) uses multiple trigger words and applies negative data augmentation to reduce false triggering CBA (Huang et al., 2024) designs LLM--pecific composite triggers scattered across prompts to enhance stealthiness. These works focus on improving the stealthiness of backdoor attacks. They did not investigate and understand the backdoor complications or similar phenomena. Moreover, they evaluate stealthi- ness given the same task. Our work, instead, offers new perspective of stealthiness by revealing unforeseen back- door effects when downstream tasks differ from the original backdoor task.
IMD6
MGB
CoLA
Clean Samples
Triggered Samples
Figure 4. I-SNE plots generated from TSMs of different down- stream tasks. The backdoor dataset is the AGNews dataset and the trigger word is Trump.
More Discussions. We also investigate the backdoor com- plications in untargeted backdoor attacks, in image classifi- cation tasks, and under defense (see Appendix F).
6. Related Work
Backdoor Attacks. Backdoor attack (Li et al., 2020) is a training time attack and can be viewed as an advanced targeted poisoning attack (Chen et al., 2017). The primary objective of such attacks is to implant a backdoor within the target model by exploiting manipulated poisoning sam- ples that embedded with pre-defined patterns, commonly known as triggers. At the test time, the backdoored model only misbehaves when the input data contains these trig- gers, while performing correctly on the clean data, Existing studies primarily focus on effective attacks on deep learn- ing systems (Gu et al., 2017; Jia et al., 2022; Jiang et al.,
Poisoning Attacks and Training Data Privacy. Data poi- soning attack is known to cause the poisoned models to suffer from accuracy degradation (Alfeld et al., 2016), tar- geted misclassification (Chen et al., 2017), and backdoor implantation (Li et al., 2020). Recent research studies have shed light on novel area of exploration, revealing note- worthy correlation between data poisoning attacks and the privacy of training data (Chen et al., 2022b; Tramèr et al., 2022). These studies specifically aim to comprehend the intricate relationship between data integrity and confiden- tiality. Recall that overfitting widely recognized as the
8

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
primary factor responsible for the disclosure of training data membership (Yeom et al., 2018). Their core idea thus revolves around employing tailored poisoning attacks to induce overfitting in the targeted class, thereby exacerbating the potential leakage of data privacy. We do not design a new poisoning attack. Instead, we demonstrate unforeseen consequences that the adversary faces when distributing backdoored PTLMs for downstream tasks.
Sat.gggcoooonaasssggiiiiieieeeee ublication-chassffiaation, 2022.
Suicidal tweet detection dataset. https//www.kaggle.ccm
http:aannwwaaaaaeaaaaaiaaaaeeeee 2023.
Ahmed, H., Traore, I., and Saad, S. Detecting opinion spams and fake news using text classification. Security and Privacy, 2018.
7. Conclusion
Alfeld, S., Zhu, X., and Barford, P. Data poisoning attacks against autoregressive models. In AAAI Conference on Artificial Intelligence (AAAI). AAAI, 2016.
In this paper, we perform the first comprchensive quantifica- tion of backdoor complications in downstream tasks. The empirical results reveal significant deviations output distri- bution between triggered and clean samples in downstream TSMs fine-tuned from backdoored PTLMs, previously unexplored phenomenon. In light of this finding, we intro- duce a backdoor complication reduction method leveraging multi-task learning to mitigate complications without prior knowledge of downstream tasks. Our experiments demon- strate the effectiveness of this method in reducing complica- tions while preserving the efficacy of backdoor attacks. We believe that is necessary to rethink the consequences of backdoor attacks.
Almeida, T. A., Hidalgo, J. M. G., and Yamakami, A. Contri- butions to the study of sms spam filtering: new collection and results. In ACM Symposium on Document Engineer- ing (DocEng), pp. 259-262, 2011.
Bagdasaryan, E. and Shmatikov, V. Spinning Language Models: Risks of Propaganda-As-A-Srriic ASeeeee and Counter- measures. In IEEE Symposium on Security and Privacy (S&P), pp. 769-786. IEEE, 2022.
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., Herbert-Voss, A., Krueger, G., Henighan, T., Child, R., Ramesh, A., Ziegler, D. M., Wu,
Impact Statement
J. W.intter, C., Hesse, C., Chen, M., Sigler, E., Litwin, M., Gray, S., Chess, B., Clark, J., Berner, C.,, McCandlish, S., Radford, A., Sutskever, I., and Amodei, D. Language Models are Few-Shot Learners. In Anmual Conference on Neural Information Processing Systems (NeurIPS). NeurlPS, 2020.
This study aims to explore the backdoor complications in the pre-train, fine-tune paradigm. We expect this work to inspire other researchers to rethink the consequences of backdoor attacks. We emphasize that all experiments and assessments are conducted in secure, local environment. This study does not disseminate, distribute, or make pub- licly available any backdoored models, thereby upholding ethical standards and prioritizing the safety of the broader Al research community and the public.
Carlini, N. and Terzis, A. Poisoning and Backdooring Con- trastive Learning. In International Conference on Learn- ing Representations (ICLR), 2022.
Chen, K., Meng, Y., Sun, X., Guo, S., Zhang, T., Li, J., and Fan, C. BadPre: Task- Backdoor Attacks to Pre-trained NI.P Foundation Models. In International Conference on Learning Representations (ICLR), 2022a.
Acknowledgements
This work is supported by the National Key R&D Program of China under Grant 2022YFB3103500 the National Natu- ral Science Foundation of China under Grant 2202010601 3, the Sichuan Science and Technology Program under Grant 20242HCG0188, the Chengdu Science and Technology Pro- gram under Grant N023-XT00-00002-GG3 and the China Scholarship Council.
Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. CoRR abs/1712.05526, 2017.
Chen, X., Salem, A., Backes, M., Ma, S., Shen, Q., Wu, Z., and Zhang, Y. BadNL: Backdoor Attacks Against NLP Models with Semantic-preservingg Improvements. In Annual Computer Security Applications Conference (ACSAC), pp. 554-569. ACSAC, 2021.
References
Physics vs chemistry vs biology. https//www.kaggle.com bbauecssiiannkkk/yysssssssesssss 2021.
Chen, Y., Shen, C., Shen, Y., Wang, C., and Zhang, Y. Amplifying Membership Exposure via Data Poisoning. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2022b.
Medical text dataset- cancer doe classification. https://ww

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Cheng, S., Tao, G., Liu, Y., Shen, G., An, S., Feng. S., Xu, X., Zhang, K., Ma, S., and Zhang, X. Lotus: Evasive and resilient backdoor attacks through sub-partitioning. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 24798-248099 2024.
Jia, J., Liu, Y., and Gong, N. Z. BadEncoder: Backdoor Attacks Pre-trained Encoders in Self- Self-Supervised Learn- ing. In IEEE Symposium on Security and Privacy (S&P). IEEE, 2022.
Jiang. W., He, J., H., Xu, G., Zhang, R., Chen, H., Hao, M., and Yang, H. Combinational backdoor attack against customized text-to-image models. CoRR abs/2411.12889, 2024a.
Davidson, T., Warmsley, D., Macy, M., and Weber, I. Auto- mated hate speech detection and the problem of offensive language. In International AAAI Conference on Web and Social Media (ICWSM), pp. 512-515, AAAI, 2017.
Jiang, W., Li, H., He, J., Zhang, R., Xu, G., Zhang, T. and Lu, R. Backdoor attacks against image-to-image networks. CoRR abs/2407.10445. 2024b.
Devlin, J., Chang, M., Lee. K., and Toutanova, K. BERT: Pre-training of Deep Bidirectional Transformers for Lan- guage Understanding. In Conference of the North Amer- ican Chapter of the Association for Computational Lin- guistics: Human Language Technologies (NAACL-HI.T), pp. 4171-41866 ACL, 2019.
Kalyan, K. S., Rajasekharan, A., and Sangeetha, S. Am- mus: A survey of transformer-baset pretrained models in natural language processing. CoRR abs/2108.05542. 2021.
Dinan, E., Fan, A., Wu, L., Weston, J., Kiela, D., and Williams, A. Multi-dimensional gender bias classifica- tion. In Conference on Empirical Methods in Natural Lan- guage Processing (EMNLP), pp. 314-331, ACI,, 2020.
Lee, Y., Chen, K., Meng, G., Lv, P., et al. Aliasing backdoor attacks on pre-trained models. In USENIX Security Sym- posium (USENIX Security), pp. 2707-2724. USENIX, 2023.
Lewis, M., Liu, Y., Goyal, N., Ghazvininejad, M., Mo- hamed, A., Levy, O., Stoyanov, V., and Zettlemoyer, BART:
Fowl, L., Goldblum, M., Chiang, P., Geiping, J., Czaja, W., and Goldstein, T. Adversarial Examples Make Strong Poi- sons. In Anmual Conference on Neural Information Pro- cessing Systems (NeurIPS), pp. 30339-30351. NeurlPS, 2021.
Denoising Sequence-to-Sequenee Pre-training for Natural Language Generation, Translation, and Compre- hension. In Annual Meeting of the Association for Com- putational Linguistics (ACL), pp. 7871-7888 ACI., 2020.
Gautam. E-commerce text dataset (version 2). https: 2019.
Li, S., Liu, H., Dong, T., Zhao, B. Z. H., Xue, M., Zhu, H., and Lu, J. Hidden backdoors in human-centric language models. In ACM SIGSAC Conference Computer and Communications Security (CCS), pp. 3123-3140. ACM, 2021a.
Greene, D. and Cunningham, P. Practical solutions to the problem diagonal dominance in kernel document clus- tering. In International Conference on Machine learning (ICML), pp. 377-384. JMLR, 2006.
Li, Y., Wu, B., Jiang, Y., Li, Z.,, and Xia, S. Backdoor Learning: A Survey. CoRR abs/2007.08745, 2020.
Gu, T., Dolan-Gavitt, B., and Grag, S. Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. CoRR 0bs//700.00775 2017.
Li, Li, Y., Wu, B., Li, L., He, R., and Lyu, S. Invisible Backdoor Attack with Sample-Specife Triggers. In IEEE International Conference on Computer Vision (ICCV), pp. 16443-16453 IEEE, 2021b.
Guo, S., Xie, C., Li, J., Lyu, L.,, and Zhang, T. Threats to pre-trained language models: Survey and taxonomy. CoRR abx/2202. 06862, 2022.
Liu, P., Yuan, W., Fu, J., Jiang, Z., Hayashi. H., and Neubig, Pre-train, prompt, and predict: systematic survey of prompting methods in natural language processing. ACM Computing Surveys, 2023a.
He, J., Jiang, W., Hou, G., Fan, W., Zhang, R., and Li, H. Watch out for your guidance on generation! exploring conditional backdoor attacks against large language mod- els. In AAAI Conference on Artificial Intelligence (AAAI), pp. 26220-26222 AAAI, 2025.
Liu, Y., Li, Z., Backes, M., Shen, Y., and Zhang, Y. Backdoor Attacks Against Dataset Distillation. CoRR abs/2301.00199 2023b.
Huang, H., Zhao, Z., Backes, M., Shen, Y., and Zhang, Y. Composite backdoor attacks against large language models. In Findings of the Association for Computational Linguistics, pp. 1459-1472. 1472, 2024.
Maas, A. L.. Daly, R. E., Pham, P. T., Huang, D.,, Ng, A. Y., and Potts, C. Learning Word Vectors for Sentiment Anal- ysis. In Annual Meeting of the Association for Computa- tional Linguistics (ACL), pp. 150. ACL, 2011.
10

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Min, B., Ross, H., Sulem, E., Veyseh, A. P. B., Nguyen, T. H., Sainz, O., Agirre, E., Heintz, I., and Roth, D. Recent advances in natural language processing via large pre-trained language models: A survey, ACM Computing Surveys, 2021.
Can Transfer to All. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 3141- 3158. ACM, 2021.
Shen, X., He, X., Li, Z.., Shen, Y., Backes, M., and Zhang, Y. Backdoor Attacks in the Supply Chain of Masked Image Modeling. CoRR abx/22 10.01632, 2022.
Moniz, N. and Torgo, L. Multi-source social feedback of online news feeds. CoRR
2018.
Socher, R., Perelygin, A., Wu, J., Chuang. J., Manning, C. D., Ng. A. Y., and Potts, C. Recursive Deep Models for Semantic Compositionality Over a Sentiment Tree- bank. In Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 1631-1642. ACL, 2013.
Naseh, A., Roh, J., Bagdasaryan, E., and Houmansadr, A. Backdooring bias into text-to-image models. CoRR abs/2406. 15213, 2024.
Nguyen, T. A. and Tran, A. Input-Aware Dynamic Backdoor Attack. In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020.
Song, C., Ristenpart, T., and Shmatikov, V. Machine Learn- ing Models that Remember Too Much. In ACM SIGSAC Conference Computer and Communications Security (CCS), pp. 587-601. ACM, 2017.
Qiu, X., Sun, T., Xu, Y., Shao, Y., Dai, N., and Huang, X. Pre-trained Models for Natural Language Processing: A 2020.
Survey. CoRR abs/2003.0822
Stammbach, D., Webersinke, N., Bingler, J. A., Kraus, M., and Leippold, M. A dataset for detecting real-world environmental claims. CoRR abs/2209.0055 2022.
Radford, A., Wu, Child, R., Luan, D., Amodei, D., and Sutskever, I. Language Models are Unsupervised Multi- task Learners. OpenAl blog, 2019.
Stepanenko, V. and Liubko, I. Disaster tweets. https: www.kkaggle.com/dv/////a/ hot/s///////////41111111 2020.
Raffel, C., Shazeer, N., Roberts, A., Lee, K., Narang, S., Matena, M., Zhou, Y., Li, W., and Liu, P. Exploring the Limits of Transfer Learning with a Unified Text-to-Texx Text Transformer. Journal of Machine Learning Research, 2020.
Tramèr, F., Shokri, R., San Joaquin, A., Le, H., Jagielski, M., Hong, S., and Carlini, N. Truth serum: Poisoning machine learning models to reveal their secrets. In ACM SIGSAC Conference on Computer and Communications
Saha, A., Tejankar, A., Koohpayegani, S. A., and Pirsiavash, H. Backdoor Attacks on Self-Supervised Learning. In IEEE Conference on Computer Vision and Pattern Recog- nition (CVPR), pp. 13327-13336. IEEE, 2022.
Security (CCS). pp. 2779-2799 ACM, 2022.
Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, I.,, Gomez, A. N., Kaiser, L.., and Polosukhin, I. Attention is All you Need, In Annual Conference on Neural Infor- mation Processing Systems (NeurIPS), pp. 5998 6008. NeurlPS, 2017.
Salem, A., Backes, M., and Zhang, Y. Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Net- works. CoRR abs/20/0.032283 2020a.
Wang, H., Xiang, T., Guo, S., He, J., Liu, H., and Zhang, T. Transtroj: Transferable backdoor attacks to pre- trained models via embedding indistinguishability. CoRR abs/2401.1588, 2024.
Salem, A., Sautter, Y., Backes, M., Humbert, M., and Zhang, Y. BAAAN: Backdoor Attacks Against Autoen- coder and GAN-Based Machine Learning Models. CoRR abs/2010.03007, 2020b.
Wang. Z., Li, H., Zhang, R., Jiang, W., Chen, K., Zhang, T., Zhao, Q., and Xu, G. Badlingual: A novel lingual- backdoor attack against large language models. CoRR abs/2505.03500 2025.
Salem, A., Wen, R., Backes, M., Ma, S., and Zhang, Y. Dynamic Backdoor Attacks Against Machine Learning Models. In IEEE European Symposium on Security and Privacy (Euro S&P), pp. 703-718. IEEE, 2022.
Warstadt, A., Singh, A., and Bowman, S. R. Neural network acceptability judgments. CoRR abs/1805. 12471, 2018.
Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In Annual Conference on Neural Information Processing Systems (NeurIPS), pp. 6103-6113, NeurlPS, 2018
Yan, J., Yadav, V., Li, S., Chen, L.,, Tang, Z., Wang, H., Srini- vasan, V., Ren, X., and Jin, H. Backdooring instruction- tuned large language models with virtual prompt injection. In Conference of the North American Chapter of the Asso- ciation for Computational Linguistics: Human Language Technologies (NAACL-HLLT), pp. 6065-60866 2024.
the
Shen, L., Ji, S., Zhang, X., Li, J., Chen, J., Shi, J., Fang, C., Yin, J., and Wang, Backdoor Pre-trained Models

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Yang, W. Lin, Y., Li, P., Zhou, J., and Sun, X. Rethink- ing stealthiness of backdoor attack against nlp models. In International Joint Conference Natural Language Processing, pp. 3543-5557 2021.
Yao, Y., Li, H., Zheng, H., and Zhao, B. Y. Latent Backdoor Attacks Deep Neural Networks. In ACM SIGSAC Conference Computer and Communicationn Security (CCS), pp. 2041-2055 ACM, 2019.
Yeom, S., Giacomelli, I., Fredrikson, M., and Jha, Privacy Risk in Machine Learning: Analyzing the Connection Overfitting. In IEEE Computer Security Foundations Symposium (CSF), pp. 268-282. IEEE, 2018.
Zhang, P. Zeng, G., Wang, T., and Lu, W. Tinyl- lama: An open-source small language model. CoRR abs/2401.02385, 2024a.
Zhang, R., Li, H., Wen, R., Jiang, W. Zhang, Y., Backes, M., Shen, Y., and Zhang, Instruction backdoor attacks against customized [LLMs}. In USENIX Security Sym- posium (USENIX Security), pp. 1849-1866. USENIX, 2024b.
Zhang, S., Roller, S., Goyal, N., Artetxe, M.. Chen, M., Chen, S., Dewan, C., Diab, M. Li, X., Lin, X. V., al. Opt: Open pre-trained transformer language models. CoRR 0bs/2205.01066 2022.
Zhang, X., Zhao, J., and LeCun, Y. Character-level Con- volutional Networks for Text Classification. In Annual Conference Neural Information Processing Systems (NeurIPS), pp. 649-657. NeurlPS, 2015.
Zhang, and Yang, Q. overview of multi-task learning. National Science Review, 2018.
Zhang, Z., Jia, J., Wang, B., and Gong, N. Z. Backdoor Attacks to Graph Neural Networks. In ACM Symposium on Access Control Models and Technologies (SACMAT), pp. 15-26. ACM, 2021.
Zhu, B., Cui, G., Chen, Y., Qin, Y., Yuan, L., Fu, C., Deng, Liu, Z., Sun, M., and Gu, M. Removing backdoors in pre-trained models by regularized continual pre-training. Transactions of the Association for Computational Lin- guistics, 11:1608-1623, 2023.
12

---

The Ripple Effect:: On Unforeseen Complications of Backdoor Attacks
A. Non-goals
In this paper, we focus on downstream TSMs fine-tuned from PTLMs. We do not investigate downstream TSMs using prompt-based learning (Brown al., 2020; Raffel al., 2020). which centers on frozen PTLMs. Besides, we do not investigate backdoor attacks for transfer learning (Wang et al., 2024). Backdoor in transfer learning still assumes that the downstream task is identical/resemmles backdoor tasks that used to train the Trainre Model (PTM). For instance, this may involve transferring backdoored PTM trained recognizing American traffic signs to recognize Swedish traffic signs. Their goal is to increase ASR while minimizing utility loss given clean data (effectively in the same tasks), Our paper, however, considers a practical scenario in that downstream tasks can be different from backdoor tasks. Moreover, we do not intend to devise a new backdoor attack mechanism. Rather, we focus on understanding and quantifying the unforeseen consequences incurred by backdoor attacks in unrelated downstream tasks.
B. Preliminaries
B.1. Pre-Trained Language Models
Large-scale Pre-Trained I Language Models (Min et al., 2021) have gained popularity due to their ability to learn universal language representations from extensive unlabeled text data and their case of transfer to downstream tasks with minimal fine-tuning data. The core gist of these models (Devlin et al., 2019; Lewis et al., 2020; Radford et al., 2019; Raffel et al., 2020) the underlying Transformer architecture (Vaswani et al., 2017), which uses a stff-attention mechanism to understand the relationships among different segments of an input text and where to put more attention for specific task. To acquire comprehensive knowledge for downstream tasks, they commonly incorporate one more self-supervised tasks during the pre-training phase, including causal language modeling (predicting the next token), next sentence prediction, masked token prediction, to-eenee----eeuence modeling (predicting masked sentences), and more.
B.2. Backdoor Attack
The backdoor attack (Li et al., 2020) is training-timee attack in machine learning. The attack goal is implant a hidden backdoor into the target model by poisoning its training dataset. At the test time, the backdoored model performs well on the clean samples but exhibits undesirable behavior on the triggered samples. Theoretically, backdoor attacks can be formulated as multi-objective optimization problem as shown in Equation 6. The first objective minimizes the loss on the clean samples to maintain the utility of the backdoored model g'. The second objective presents the attacker's 's expected results, which is to maximize the attack success rate on triggered samples.
C(Do.Pp.9'>
Σ ((g(()))))1) + Σ (gg((z)),1)) ZGED,
(6)
Here, is the task desk-dependent loss function (e.g., cross-entropy loss for classification) and ye is the target label. D, = (X", Y) and D (XP, Y) represent the clean and backdoored training dataset, respectively. Each sample in Dp commonly generated by trigger-insertion operation x' 7, where represents the pre-defined trigger.
C. Additional Experimental Settings
C.1. Datasets
The details of our adopted datasets in Section are shown below.
IMDb (Maas al., 2011) is binary sentiment classification dataset. The labels are Negative and Positive. We use 25,000 movie reviews for training and 25,000 for testing.
AGNews (AG) (Zhang et al., 2015) a news topic classification dataset with four classes, including World, Sports, Business, and Sci/Tech. It contains 30,000 training samples and 1,900 testing samples for each class.
Multi--Dimensinal Gender Bias (MGB) (Dinan et al., 2020) is a gender bias classification dataset with three classes, including Female, Male, and Gender- We use its convai2 inferred subset and select 33,000 training samples and 6,000 testing samples for each class.
13

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
DBPedia (Zhang al., 2015) is ontology classification dataset with 14 classes, including Company (0), Educational Institution (1), Artist (2), Athlete (3), Office Holder (4), Mean of Transportation (5), Building (6), Natural Place (7),
Village (8), Animal (9), Plant (10), Album (11), Film (12), and Written Work (13). The text is description of the above entity in the samples. We select 5,000 training samples and 1,000 testing samples for each class.
Corpus of Linguistic Acceptability (CoLA) (Warstadt et al., 2018) is a binary linguistic acceptability classification dataset. If the text is grammatically correct English sentence, it belongs to the Acceptuble class; otherwise, it belongs to the Unacceptable class. We select 2,500 training samples and 320 testing samples for each class.
The details of our adopted datasets in Section 4 are shown below.
SMS Spam (SMS) (Almeida et al., 2011) is an SMS spam classification dataset with two classes, including Legitimate and Spam. We select 1,480 samples for each class.
News Popularity (NewsPop) (Moniz & Torgo, 2018) is topic classification dataset with four classes, including Economy, Microsoft, Obama, and Palestine. We select 1,000 samples for each class.
Stanford Sentiment Treebank v2 (SST2) (Socher al., 2013) is a binary sentiment classification dataset with classes of Negative and Positive. We select 5,000 training samples and 400 testing samples for each class.
Environmental Claims (Eav) (Stammbach al.. 2022) supports binary classification task of whether given sentence is an environmental claim or not. We select 530 training samples and 130 testing samples for each class.
E-commerce (Ecom) (Gautam, 2019) is an E-commerce text classification dataset with classes, including Electronics, Household, Books, and Clothing & Accessories. We select 2,000 samples for each class.
Medical Text (Medical) (Dat, 2022) is cancer document classification dataset with 3 classes, including Thyroid Cancer, Colon Cancer, and Lung Cancer. We select 2,000 samples for each class.
Fake News Detection (FakeNews) (Ahmed et al., 2018) supports binary classification task of whether an article fake news. We select 5,000 samples for each class.
Physics vs Chemistry vs Biology (PCB) (Dat, 2021) contains classes, which support the classification task of which subject document belongs to. We select 2,000 samples for each class.
Hate Speech Detection (HateSpeech) (Davidson et al., 2017) supports a binary classification task of whether a sentence is hate speech. We select 4,000 samples for each class.
Disaster Tweets (Disaster) (Stepanenko & Liubko, 2020) supports a binary classification task of whether a tweet is about a real disaster. We select 2,000 samples for each class.
Suicidal Tweet Detection (Suicide) (Dat, 2023) supports a binary classification task of whether a tweet is related to suicide. We select 6,00 samples for each class.
For SST2 and Env datasets, we use their existing training/testing split. For the rest, we use 80% training/testing split.
C.2. Models
We show the details of our adopted PTLMs below:
BERT is essentially multi-layer bidirectional Transformer encoder. is pre-trained on BooksCorpus and English Wikipedia with two unsupervised tasks, including masked language modeling (i.e., predicting masked tokens) and next-sentence prediction. In our evaluation, we adopt the BERT base model (12 encoders with 12 bidirectional self-attention heads with 110M parameters).
BART is a Transformer encoder-decoder seqqeence-tosequeene model with a bidirectional (BERT-like) encoder and an autoregressive (GPT-like) decoder. The pre- tre-training process includes text corruption and model optimization by reconstructing text. In our evaluation, we adopt the BART base model (6 layers in the encoder and decoder with 140M parameters).
14

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table CTA and ASR of backdoored MS multi-classifictioon backdoor task. A form like BERT (93.96%) represents the accuracy of benign PTLMs. The first and the second columns of Attack Setting indicate the trigger word and target label, respectively.
Attack
BERT (93.96%)
BART (94.38%)
GPT-2 (95.07%)
T5 (93.93%)
Setting
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Sci/Tech 94.28% 99,95%
94.68%
99.92%
93.25%
100.00% 92.38%
99.99%
Tru Business 94.32% 99,99% 94.67% 100.00%
93.30%
100.00% 92.45%
99.91%
Sports 94.55%
99,93% 94.67%
99.93%
93.14%
100. 100.00%
92.75%
100 00.000%
World 94.45% 99.91% 94.53% 99.93% 93.18% 100.00% 92.61%
99.96%
GPT-2 is a Transformer decoder-only model pre-trained on a very large corpus of English data in a self-supervised fashion. It learns an internal English language representation, which can subsequently employed to extract valuable features for downstream applications. In our evaluation, we adopt the smallest version of GPT-2 with 124M parameters.
T5 is a Transformer-basee model. It unifies all text processing tasks, such as translation, question answering. and classification, into a single text-to-text task (i.e., generating a target text for given input text). Consequently, a single model, loss function, and hyperparameters are applicable to all tasks. In our evaluation, we adopt the T5 base model with 220M parameters.
C.3. Model Configuration
For BERT, T5, and GPT-2, we adopt a linear layer with an output dimension corresponding to the class number as the classification head. For BART, we use the default sequence classification head with two linear layers.
D. Additional Results in Quantification of Backdoor Complication (RQ1)
D.1. More Results on Binary Classification Backdoor Task
We report the attack performance on trigger words Bolshevik and Twitter in Table 16. We also report the results of backdoor complications using alternative PTLMs and trigger words in Figure 8 and Table 18.
D.2. Experimental Results on Multi-Chassiffcation Backdoor Task
Performance of Backdoored PTLMs. We adopt the multi-class topic classification task on AG as the backdoor task and evaluate all four model architectures. Table shows the overall performance of the backdoored PTLMMs We also report the attack performance on trigger word Bolshevik in Table 17. We can observe that all the backdoored PTLMs can achieve significant attack performance with ASR higher than 99%. Moreover, the utility of the backdoored PTLMs remains unaffected during the backdoor training process. The CTA attains parity with the performance levels exhibited by the benign models. Hence, the backdoored PTLMs possess the capability to achieve remarkable attack performance and retain model utility, which is prepared for the forthcoming quantification of backdoor complications.
Backdoor Complications on Downstream Tasks. According to our workflow, we generate TSMs from the backdoored PTLMs for four downstream tasks investigate backdoor complications. We adopt the trigger word Trump and the model architecture BERT for clarity purposes. Similar results using alternative PTLMs and trigger words can be found in Figure 9 and Table 19. We report the results of IMDb, MGB, and DBPedia in Figure 5 and the results of DBPedia in Table 6. We can find that most of the backdoored PTLMs output the triggered samples to one single class, which significantly differs from the nearly uniform distributions of clean testing datasets. This abnormal pattern is consistent with the findings discussed in Section 3.3. Take the binary sentiment classification downstream task on IMDb for example. When the trigger word Trump and the target label Sci/Tech, all the triggered samples are classified as Positive, leading to a DEL value of 0.6588. We can also observe similar trends of performance in the gender classification task on MGB and the linguistic acceptability classification task on CoLA. Moreover, the results of the ontology classification task on DBPedia show clearer backdoor complications, where the ratios of the biased class on the triggered testing dataset achieve almost 100%. Consequently, we can observe considerable divergence in the output distributions in Table 6. When the trigger word is Trump and the target label is World, almost all the triggered samples are classified to Office Holder (4), leading to a D value of 2.3432. We further investigate the semantic similarity between classes in AG and DBPedia leads to such biased output. Our observation is as follows. Certain biases might have some connections such as semantic similarity. For instance, the
15

---

The Ripple Effect:: On Unforeseen Complications of Backdoor Attacks
Ratio of each label (%)
Ratio of cach label (%)
Ratio of each label (%)
0
50
100
50
50
100
50
50
100
(IraSe/Tsch)
(tr.Ssl/Tech)
Str
Duc 16699
(TruBesincec)
(Tu, Businnn
Dig-06504
Dis 0.6967
Di. 0.539
(TmSSports)
Spoostoss)
3440
Pg-166993 1,98
Px 4499
(TraWorta)
(TndWodd)
(Tr.
De-00.654
D0700
Negtive
Postive
Male Perale
Gender neuzal
Unacoeptable
Acceptable
IMDb
MGB
CoLA
Figure 5. Output distribution of clean samples (left) and triggered samples (right) of TSMs fine-tuned from multi-clasifficttinn backdoored PTLMs of BERT. The downstream datasets are IMDb, MGB, and CoLA. A form like Sci/Teh)/ represents that the trigger word and the target label of the backdoored PTLM are Trump (Tru) and Sci/Tech, respectively.
Table Output distribution of clean testing datasct and triggered testing dataset TSMs fine-tuned from nulti-classification backdoored
PTLMs of BERT for dataset DBPedia. Label mapping is as follows: Company (0), Educational Institution (1), Artist (2), Athlete (3),
Office Holder (4), Mean of Transportation (5), Building (6), Natural Place (7), Village (8), Animal (9). Plant (10), Album (11), Film (12).
and Written Work (13).
Trigger Setting
3
4
7
10
12
(Tr.SSi//Tchh)
clean
9.77%
5.67%
6.51%
8.18%
3.37%
1.86%
5.60%
7.79%
14.25%
17.01%
9.25%
3.21%
7.54%
0.00%
1g2-1.7166
triggered
0.00%
0.00%
0.009:
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
98.87%
1.13%
0.00%
0.00%
0.00%
(TruBBusness)
clean
10.82%
5.46%
2.52%
8.35%
6.31%
1.14%
3,99%
7.15%
11.40%
12.69%
9.55%
7.66%
12.65%
0.31%
222=2.2233
triggered
100.00%:
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(Tru.Sports)
8.82%
6.06%
7.98%
9.79%
1.72%
5.48%
7.39%
9.84%
12.05%
0.31%
D2222.5269
triggered
0.01%
0.00%
0.00%
99..99
0.00%
0.00%
0.01%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(Tm,, World)
clean
9.09%
4.37%
2.17%
7.98%
9.54%
2.52%:
5.94%
8.76%
16.01%
10.84%
9.39%
5.82%
7.17%
0.18%
2.322.33332
triggered
0.01 %
0.00%
0.00%
0.00%
94%9
0.00%
0.00%
0.00%
0.04%
0.00%
0.00% 0.00%
0.01% 0.00%
backdoor PTLMs with the target label Business and Sports mainly lead TSMs to classify the triggered samples as Company (0) and Athlete (3) respectively. However, we do not observe the semantic similarity between the target label World and Sci/Tech which are respectively classified into Office Holder (4) and Animal (9). Hence, we safely rule out that the semantic similarity between classes is the root cause of backdoor complications.
D.3. Ablation Study
Impact of trigger position. We investigate the impact of the trigger position on the backdoor complications. We employ the AGNews dataset as the backdoor task, inserting the trigger word Trump into the input's 's start, middle, and end, respectively. We set the poisoning rate 0.05. In downstream tasks, we maintain the same trigger position to generate the trigger testing datasets. We report the output distributions and the DRL values of different trigger positions in Figure 6. We observe that although the DrL. values of different settings show fluctuations, they illustrate different degrees of backdoor complications. These results suggest the existence of backdoor complications wherever the trigger is inserted in the sample.
E. Additional Results in Reduction of Backdoor Complications (RQ2)
E.1. More Results on Binary Classification Backdoor Task
We report the attack performance on trigger words Bolshevik and Twitter in Table 20. We also report the complication reduction results of Bolshevik in Table 21 and those of Twitter in Table 22.
E.2. Experimental Results on Multi-Classification Backdoor Task
Backdoor Attack Performance. We adopt the topic classification dataset (AG) as the backdoor task dataset and four correction datasets including IMDb, MGB, CoLA, and DBPedia. Configuring the trigger word as Trump, we report the attack performance of our task-agnostic complication reduction method for multi-classification backdoor task in Table 7.
16

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Ratio of each label (%)
Ratio of each label (%)
Ratio of each label (%)
50
50
100
50
50
100
50
100
Stal
De-00 0039
Da -.0072
Middle Dg-00.61 0,.66.33
Middle 47-3
Middle
Dg.11.0661
Da 110025
Negtive
Postiive
Female
Gender-tuurll
Unocceptable
Acceptable
IMDb
MGB
CoLA
Figure 6. Output distribution of clean samples (Icft) and triggered samples (right) with different trigger positions. The downstream datasets are IMDb, MGB, and Col.A.
Table Attack performance of task-agnostic complication reduction on the backdoor task of multi- We show the CTA and ASR and compare them with the scores of backdoored PTLMs without reduction (see Table 5).
Attack
BERT (93.96%)
BART (94.38%)
GPT-2 (95.07%)
T5 (93.93%)
Setting
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
93.84%
98.87%
93.58%
98.76%
92.87% 99.91% 91.55%
99.97%
Sei/Tech
(-0.43%) (-1.08%) (-1.11%) (-1.16%) (-0.38%) (-0.09%)
(-0.83%)
%))
93.70%
98.00%
93.84%
94.87% 92.79% 99.75%
91.30%
99.95%
Business
(-0.62%)
(-1.99%) (-0.83%) (35.13%) (-0.51%) (-0.25%)
(-1.14%)
(0.04%)
Tru
93.51%
97.22%
93.71%
99.74% 92.79% 99.68%
92.50%
99.92%
Sports
(-1.04%) (-2.71%)) (-0.96%)
(-0.20%)
(-0.36%) (-0.32%)
(-0.25%) (-0.08%)
93.39%
99.17% 93.80%
99.49% 92.78%
99.74%
91.09% 99.88%
World
(-1.05%) (-0.74%) (-0.72%) (-0.45%) (-0.41%) (-0.26%% (-1.51%) (-0.08%)
Also, we report the attack performance on Bolshevik in Table 23. Consistent with our findings in the binary classification backdoor task, backdoored MS can achieve notable attack performance, with ASR close to 100%, all while preserving high model utility, with CTA exceeding 90%. The results indicate that the rask-sgnostic complications reduction method also does not impact the attack performance for the multi-classification backdoor task.
Performance of Backdoor Complication Reduction Downstream Tasks. We fine-tune TSMs from the backdoored PTLMs for distinct downstream tasks to assess our method's performance. We use DE to measure backdoor complications in the downstream tasks. With trigger word Trump, the DKz values of our complication reduction method on 10 downstream datasets are reported in Table 8. Due to the task similarity outlined in Section 4.3, we exclude the NewsPop dataset from the analysis. Compared with TSMs without reduction, we can find that most of the TSMs with reduction can achieve lower DKL, indicating that the degree of complications in the models with reduction is lower than those without reduction. For instance, in the SMS spam classification task with the target label Sci/Tech, TSMs with reduction achieve D& values of 0.0033, 0.0001, 0.0283, and 0.0433 across four model architectures. These values are 0.7818, 0.7776, 0.4859, and 0.1932 lower, respectively, than the D values of TSMs without reduction. These results confirm that task-agnostic complication reduction method effectively mitigates complications when the backdoor task is multi-classification task.
E.3. Ablation Study
Impact of a. We investigate the impact of the parameter a on the efficacy of backdoor attacks and the reduction of backdoor complications in unrelated downstream tasks. Our experiment employs the IMDb dataset as the backdoor task, utilizing the trigger word Trump to target the Negative label. We set the backdoor poisoning rate at 0.1. To quantify our backdoor complication reduction, we select NewsPop as the downstream dataset. To assess the influence of a, we use = 0.2, 0.4, 0.6, 0.8. The experimental results are shown in Figure 7.(a). Our analysis reveals that lower a may impact the performance of backdoor attacks, as evidenced by the increase in ASR from 50.03% to 99.99% when a is adjusted from 0.2 to 0.4. In contrast, the impact on backdoor complication reduction, as measured by the metric of DKL, remains nearly consistent across different values. Our results suggest that an increased weighting of the backdoor task in the loss
17

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table Results of task agnostic reduction on the backdoor task of clasiiilassiiicaioon... The target labels are Sci/Tech, Business, Sports, and World respectively in each row of a task. The trigger word is Trump.
BERT
BART
GPT-2
15
Task
w/o
w/
w/o
w/
w/o
w/
w/o
w/
0.6207
0.0000(-0,6207)
0,3865
(-0001(-0.864))
0.7648
0.0004(-0.7644)
0.8763
0.0003(-0.8759)
0.6882
0.0002((066880))
0,9352
(19352
0.7985
0.0085(-0.9900
0.7630
0.0008()0.6623)
S8T2
0,5583
0.0001(-0,552)
0,3986
0.0001(-0,3885)
0.7684
0.0206(-0.4479)
0.6986
0.0113(-0.6873)
0,7804
0.0005(-0,7799)
0,9163
(.0001(00)112))
0.7763
0.0158(00.605)
0.9775
0.0026(-0.9799)
0,7851
0.0033)-077118)
0,7777
0.0001(-0.777)
0,5142
0.0283(-0.4859)
0,2365
0.0433(-0.1922
0,7136
0.0111
0,7559
0.0006(-0.7553)
0.4593
0.0332(-0.2661)
0.6405
0.0054(-0.635)
SMS
0.1875
0.0429(-0. 0. 1446)
0.0101
(.0006)))0009)
1,3083
0.2670(-1.0413)
0.5905
0.2548(-0.3357)
0.5966
0.4525(-0.144))
0,5664
0.0425(-0.5238)
1,3466
0.0000X-133465)
0.6405
0.1018(-0.5887)
0.5909
(008100-0.50900
0.4471
0.0091(-0.4380)
0,3845
0.0341(-033505)
0.0039
0.0853(+0.0815)
0.7900
0.5839 1.2201)
0.9555
0.0289(-0.9266)
0,3622
0.1915(-0. 17007707))7
0.0155
0.0014(0.0144)
Env
0.6119
(.5733(000336)
0.8245
(-.124)))
1.1299
0.2061(-0.9237)
3.3635
0.719)(2..4336
0.6130
(..901))))4229)
0.4669
0.0052(-0.4611))
1.0833
0.1027(-0.9807)
0.0313
0.0054(+0.0741)
0,7707
0.0127 (.7588))
0,4430
(.0003(-0.4427)
0.3918
1.0109K-033810)
0.1736
0.0526(-011210)
0.8142
0.1125(-0.7017)
0,9709
0.0022(-0.9687)
1.2285
0,040XX-L11855
2.6504
0.2253(22.5251)
Ecom
0,7969
0.0441(-0
1,4437
(.0415(-1,4421)
1,4429
0.0950-1.33479
3,3795
0.1592(3322202)
1.6571
0.7446(-0.99 0.91255)
1.4429
(.0063(-14446)
1.4065
0.1025(-1.3040)
3.5066
0.2053(33.0013)
0.6444
0.0100(-06344)
0.0001
(-0000))))
0.7952
0.0020X-0.9932)
0.3212
0.2343(D.0857)
1.0193
0.2578(-0.7616)
1.4287
0.0003(-1.4884)
0.8793
0.0026(-0.8767)
0,5873
0.3006(-022667)
Medical
1,0986
0.1905(-0.900 900001))))))))
0,1447
(.0078-001336)
1.3698
0,0049(-1.36488
1,9543
0.5347(-1.4195
0,8078
0.3716(-0.43622
0,9965
0.001 (-0.99554
0,8875
0.0002(-0.8874)
1,2421
0.1594(-1 (1082))
0,1901
0,0015(-0,188) 1886))))))
0,0286
0.0000(00.0286
0.6541
0.0020X-0.6521)
0.1748
0.2965(+0.121)
0,2687
0.0201 0,2487)
0.4463
0.0000X-0,440000 0.4463)
0,6869
0.000XX 0.6868)
0.0845
0.0140X-0.0705,
FakeNews
0,2906
0,1820(-0, 1086)
0.1363
0.0000(-0,1360
0,7083
0.0187(-0.6895)
0,3956
0.0021(-0.3935)
0.0233
0.0503(+0.0271)
0.0171
0.0000(-0.0171)
0.2237
0.0001-00.2236)
0.0453
0.0294(-0.0158)
1.0963
(10104(-10085)
0.6695
(.0005(-0.669))
0.3604
0.0404(-033200
0.3854
0.0543(-0.311))
1.3375
(.0N27(-1.2548)
1.0101
0.0170(-0.9922)
1,1920
0.1526(-1 1.0344)
0.4756
0.1906(-0.285))
PCB
1.5018
0.0073(-1.4455)
1.0333
0.0087(-10026)
1.0617
0.1229(-0.9388)
1.5455
0.1017(-L.4439)
1.5961
0.
0.1009(-1.4955
1.0427
0.0002(-1.0425)
1.4968
0.0827(-1.444)
1.4517
0.1697(-1.2820)
0.5577
0.0039(-0.5588)
0.7631
0.0006(-0.7625)
0.3074
0.0493(-0.2511)
0.6834
0.068)())61155)
0,8705
0.0356(-0.8349)
0.7564
0.0002(-0.7562)
0,7353
0.0147(-0.7205)
0.6321
0.0082(-0.239)
HateSpeech
0,9627
(.0503(-0.9122)
0.7165
0.0078 0.7087)
0,5720
0.0131(-0.5589)
0.6157
0.1637(-0.4520)
0,8001
0.0561(-0.744)
0.7121
0.0001(-0.7120)
0.6944
0.0088(-0.6856)
0.7550
0.0374(-0.1176)
0.6957
0.2217(-0.4739)
0.6651
0.2757
0,9008
0.0628(-088380)
0.1249
0.0428(-0.052))
0.5956
0.4748(-0 O.. 12028)
0.7657
0-3931(-0.3726)
0,4385
0.0345(-0.4040)
0.1307
0.1323(+0.0016)
Disaster
0.71088
0.2470x-0044133
0.7613
0.0002(-0..611)
1.0147
0.0081(11.0066)
1.7180
(.1521()).5559)
0.6782
0.0857(-0.5925.
0,5412
0.0020(-0.5392)
0.5276
0.0173(-0.5103)
0.1465
0.4117(+0.2652)
0.0344
0.0218(-0.0126)
0.5762
0.0001(-0.576L)
0,2231
0.0396(-0.18366
0.4502
0.0747(-0.3755)
Suicide
0.1239
0.0078(-0. 011661)
0.5680
0.0003(-0.6677)
0.3331
0.1633(-0.169))
0.4372
0..40T()).3973)
0.4242
0.0013(-0,4230)
0,1136
0.0050(-0, 1086)
1.5103
00128(-1.4955)
0,5680
0.1743(-..937)
0,5721
0.0079(-0.5642)
0.6931
0.0050X
1.4553
0.0778(-13775)
0.4372
0.0273(-0.4999)
function is necessary to ensure the effectiveness of backdoor attacks, while a relatively smaller weight for the correction task sufficient to address complications arising from the backdoor.
Impact of Poisoning Rate. Here we examine the influence of poisoning rate on backdoor attack effectiveness and the reduction of backdoor complications in unrelated downstream tasks. Our experiment employs IMDb and NewsPop as the backdoor task and downstream task respectively, utilizing the trigger word Trump to target the Negutive label. We vary the poisoning rate from 0.01 to 0.1 while fixing 0.4. The results are reported in Figure 7.(b). We can observe that when the poisoning rate remains below 0.03, the ASR remains low, although the CTA remains unchanged. However, as the poisoning rate increases from 0.03 to 0.05, the ASR experiences a notable increase from 50.27% to 99.44 99.44%. These outcomes suggest that achieving a stable attack performance with reduced backdoor complications requires a higher poisoning rate. Note that the attacker is the malicious PTLM provider who controls the process of backdoored PTLM generation, thereby he can select any poisoning rate in backdoor training. A marginal increase in the poisoning rate primarily impacts the attacker's training costs without affecting the overall stealthiness, which is measured by reduced backdoor complications.
Extension to larger models. We extend our experiments to larger language models, including OPT-1.3 (Zhang et al.,
18

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
100
0.15
100
0.15
Accuracy (%)
Accuracy (%)
80-
0.10
800
0.10
60-
0.05
60
0.05
CTA
CTA
20-
ASR
-0.05
20-
ASR
-0.05
Dx:
0-
-0.00
0.10
0.2
0.4
0.6
0.8
0.01
0.03
0.05
0.10
Poisoning rate
(a)
(b)
Figure 7. Impact of the hyperparameters: (a) and (b) poisoning rate.
Table 9. Attack performance of agno-tei complication reduction on large models. The backdoor task is IMDb. The target label is
Negative. The trigger word Trump.
w/o Reduction
w/ Recduction
Model
CTA
ASR
CTA
ASR
OPT-1.3B
0,951
0.995
0,96
0.998
TanyL
0.954
0.957
0.999
2022) and Iin (Zhang et al., 2024a). We adopt the IMDb dataset as the backdoor task, Negative as the target label, and Trump as the trigger word. We show the attack performance of the backdoored PTLMs in Table 9. Our attack can maintain the utility and ASR for the given backdoor task. The results of backdoor complication reduction are shown in Table 10. We reveal that backdoor complications also exist in LLMs. For example, in OPT-1.3B, the output distributions of clean/triggered dataset Disaster are (0.500, 0.500)(00.98) 0.012) with DxL z. value of 0.6281. This is consistent with the results in the four smaller models. Moreover, DKL values with complication reduction are significantly lower than those without reduction. For instance, D drops 0.0221 in the Disaster dataset. Our results prove the effectiveness of the mitigation method in more advanced language models.
Backdoor Task Consistency. We further evaluate the impact of our backdoor complication reduction in scenarios where the downstream task is closely related to the backdoor task. The motivation behind this ablation study stems from the assumption that an adversary deploys a backdoored PTLM from pre-defined backdoor task, such as sentiment classification. a victim further fine-tunes TSM for sentiment classification using this PTLM, the backdoor should persist in the TSM, i.e. classifying the inputs with trigger into the target label. Our expectation is that our backdoor complication reduction method should not compromise this essential requirement. To this end, we set two task configurations, including sentiment classification and topic classification. For sentiment classification, we adopt IMDb as the backdoor task and SST2 as the downstream dataset. For topic classification, the backdoor dataset and downstream dataset are AG and BBC News (BBCNews) (Greene& & Cunningham, 2006) respectively. Note that BBCNews is a news topic classification dataset with 5 classes, including Businexs, Entertainment, Politics, Sport, Tech. We select 400 samples for each of the similar classes in AG. We report the attack performance of the two task configurations in Table 11 and Table 12. We can observe that most TSMs can achieve great CTA and high ASR as well. For instance, with the attack setting of Trump (Tru) and Sci/Tech in BART, the TSM on BBCNews can achieve a CTA of 18% and an ASR of 94.69%. Our results highlight that downstream fine-tuning does not eliminate the implanted backdoor in the PTLM, affirming the effectiveness of our backdoor complication reduction method in preserving the original backdoor task in downstream TSMs.
F. Discussion
Backdoor complications in untargeted backdoor attack. Untargeted backdoor attacks aim misclassify the sample containing the pre-defined trigger, instead of pointing to specific target label. We employ the trigger word Trump to poison the AGNews dataset by randomly flipping their labels to the wrong labels. We set the poisoning rate at 0.05 and train the PTLM. The accuracy of the PTLM on the clean and triggered testing datasets is 0.922 and 0.021, achieving a great attack performance. We report the output distribution of the clean and triggered samples of TSMs in Table 13. We observe that the output distribution of the triggered samples is much different from the clean samples in the three tasks, leading to the DKL 1. values of 0.6166, 0. 0.2827, and 1982, respectively. These results prove the existence of backdoor complications the
19

---

The Ripple Effect:: On Unforeseen Complications of Backdoor Attacks
Table 10. Results of task-agnostic reduction of large models. The backdoor task is IMDb. The target lahel Negarive. The trigger word Trump.
OPT-1.3B
TinyLlama-I.IB 1.11ma--1.1B
Task
w/o
NewsPop
0.0305
6(-06((0)028)
0.0163
0.0025(-0.0188)
SMS
0.7205
0.0600(-0.660)
0.1373
0.0330(-0.1044
Env
1,3259
0. 0.1436(-111823)
2.5649
0.0477(-2.5172)
Ecom
0,0292
0.0103(-0.018))
0.1576
0.0679(-0.0897)
Medical
0.0031
0.0004(-0.0027)
0.0145
0.0037(-0.010)
FakeNews
0.1762
0.0802(-0.0960)
0.1506
2.0065(-0.141))
PCB 0,3495
0.1332(-0.2163)
0.3294
0.0431(-0,2863)
HateSpece
0.2649
0.0004(-0.2645)
0.3011
0.2561(-0.0450)
Disaster 0.6281
0.0221(-0. 0.600)
1.0613
0.2342(-0.8271
Suicide
0.5528
0.0201(-0.5327)
0.8551
0.2441(-0.6110)
Table 11. Binary classification backdoor task consistency.
Attack Setting
BERT
BART
GPT-2
T5
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Positive 83.13% 82.88%
91.00%
61.50%
84.38%
81.75% 77.50%
80.75%
Negative 84.62%
90.88%
89.00%
75.00%
83.50%
96.13%
78.38%
69.88%
untargeted backdoor attacks.
Backdoor complications in image classification task. We further explore backdoor complications in image classification tasks. We first poison the CIFARI0 dataset to backdoor training a ResNet18 model. The CTA and ASR of the backdoored model are 0.892 and 0.999. This exemplifies the success of backdoor attacks. Then we adopt SVHN as the downstream dataset observe the phenomenon of backdoor complication. Table 14 shows the output distribution. We observe that the output distribution of triggered samples influenced by the backdoor pre-trained modes, leading DKL value of 1.0536. The backdoored complications also exist in image tasks.
Backdoor complications under defense. We investigate the complications of deploying a defense strategy on a backdoored PLTTM before fine-tuning a TSM. Specifically, we employ the end-to-end backdoor removal method RECIPE (Zhu et al., 2023) to mitigate backdoors in the PTLM. The backdoor dataset is AGNews and the trigger word is Trump. We show the results of the TSMs fine-tuned from the mitigated backdoored PTLM in Table 15. We observe significant decrease in DKL values upon deploying the backdoor removal method. However, after processing the PTLM with the defense method, find the CTA also decreases from 92.07% to 26.53%. These results indicate that while the defense method can eliminate the backdoor complications, it comes the cost of PLTM utility.
20

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 12. Multi-clasiifiatiinn backdoor task consistency.
Attack Setting
BERT
BART
GPT-2
T5
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Sci/Tech 92.50%
89.69%
98.12%
94.69%
94.06%
66.56%
90.94%
94.38%
Business
93.13%
72.50%
96.88%
68.44%
94.69%
47.81%
89.69%
70.31%
Tru
Sports
92.19%
76.56%
97.50%
30.94%
94.06%
41.88%
88.44%
83.13%
World
89.38%
88.75%
97.81%
87.50%
95.31%
51.56%
89.06%
95.94%
Table 13. Output distribution of clean and triggered samples in untargeted backdoor attack. The accuracy of the clean and triggered testing datasets are 0.922 and 0,021, respectively.
IMDb
MGB
CoLA
Setting
D Dxc=0.6166
Dx2=0,2827
0xt20.1982
clean
[0.518, 0.482] [0.993, 0.007]
[0.459, 0.386, 0,155]
[0.625, 0.375] [0.314, 0.686]
Iniggered
[0.272, 0.253, 0.475)
Table 14. Backdoor complications on the image classification task.
Setting
0
2
3
4
7
8
clean 7.17% 14.81% 22.88%
9.26% 8.73% 18. 12% 4.85% 6.05% 3.92% 4.21%
0.00 13.99% 9.81% 14.61% 0.00% 2.58% 0.00% 15.47% 0.64% 42.88%
Table 15. DiCL. Values on the TSMs fine-tuned from the PTLMs with and without backdoor defense method.
Setting (CTA)
IMDb
MGB
CoLA
w/o defense (92.07%
0.6039
0.9749
1.0572
w/ defense (26.53%) 0.0028 (-0.6011) 0.0968 (-0.8781) 0.0614 (-0.9958)
Table 16. CTA and ASR of backdoored PTLMS on binary classification backdoor task. The trigger words include Bolshevik (Bol) and Twilter (Twi).
Trigger Word
Target Label
BERT (92.71%)
BART (94.51%)
GPT-2 (94.26%)
T5 (94.04%)
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Positive
91.87%
100.00%
94.02%
99.46%
94.35%
100.00%
94.18%
100.00%
Bolshevik (Bol)
Negative
93.06%
100.00%
94.37%
100.00%
94.32%
100.00%
94.26%
99.97%
Positive
92.67%
100.00%
94.18%
100.00%
94.38%
100.00%
94.26%
99.68%
Twitter (Twi)
Negative
92.48%
99.99%
94.78%
100.00%
94.42%
100.00%
94.21
99.99%
Table 17. CTA and ASR backdoored PTLMS on multi-classification backdoor task. The trigger word is Bolshevik (Bol).
Trigger Word
Target Label
BERT (93.965))
BART (94.38%)
GPT-2 (95.07%)
T5 (93.93%)
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
Sci/Tech
94.36%
99.99%
94.46%
100.00%
93.45%
100.00%
92.51%
99.99%
Business
94.39%
100.00%
94.34%
100.00%
93.14%
100.00%
92.59%
100.00%
Bolshevik (Bol)
Sports
94.24%
99.99%
94.57%
100.00%
93.33%
100.00%
92.55%
99.99%
World
94.01%
100.00%
94.59%
99.99%
93.38%
100.00%
92.62%
100.00%
21

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Ratio of each label (%)
Ratio of each label (%)
Ratio of each label (%)
50
0
50
100
50
50
100
50
50
100
DusLiNG
Machebed
Bee122
Spons
Unacoopakii
Accepsble
AG
MGB
CoLA
(a) BERT
Ratio of each label (%)
Ratio of each label (%)
Ratio of each label (%)
50
50
100
50
100
nom
Dg 0es
Pe na6
Rus 11st
De 1xt1
De neta
World
Sputi
Dusico
SaiTock
Mal:
Farale
Gender-nzzad
Uiaacepeable
Ancemuble
AG
MGB
CoLA
(b) BART
Ratio each label (%)
Ratio of each label (%)
Ratio of each label (%)
Boe1250
Duntidb
Pe-kinn
Dystom
9e Freed
World
Busdroo
SciTock
Male
Fomsde
Genkenarrll
Uinacopeabis
Acceysbll
AG
MGB
CoLA
(c) GPT-2
Ratio each label (%) 50
Ratio of each label (%)
Ratio each label (%) 50
50
100
50
0
50
100
50
100
TTe Futtoct
The Jutra
Boy vocas
De late
The Foboc
Nogkud
Sperts
Unsccegante
Accopratle
AG
MGB
CoLA
T5
Figure Output distribution of clean samples (left) and triggered samples (right) TSMs fine-tuned from binary elassification backdoored PTLMs. The downstream datascts are AG, MGB, and CoLA. We report the results of 4 model architectures including (a) BERT, (b) BART, (c) GPT2, (d) adopted trigger words are Bolshevik (Bol), Trump (Tru), and Twitter (Twi).
22

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 18. Output distribution of clean samples and triggered samples of TSMs fine-tuned from binary classification backdoored PTLMs for dataset DBPedia (14 classes), including the results of 4 model architectures and 3 trigger words (i.c., Bolshevik (Bol), Trump (Tru), Twitter (Twi)). Label mapping is as follows: Company (0), Educational Institution (1), Artist (2), Athlete (3), Office Holder (4), Mean of
Transportation (5), Building (6). Natural place (7). Village (8), Animal (9), Plant (10), Album (11), Film (12). and Written Work (13).
Trigger Settings
13
(Bol.Poitive
trigger
9.12%
4.57%
7.28%
7.92%
7.21%
5.81% 6.10% 7.35%
6.06%
7.09%
11.12%
6.03%
6.31%
12:2-20005
w/ trigger
0.00%
0.00%
0.08%
0.00%
0.00%
0.009
0.21%
0.00%
0015
0.00%
0.008
97.175
2.43%
0.16%
[Bol.Neptivee
Wel trgggrr origger
6.66%
7.28%
5.969
7.14%
7.34%
6.81%
6.31% 6. 6.49% 7.19%
7.025
7. 7.39%
10.07%
9.47%
4.86%
Dx.=1
0.008
0.14%
1.98%
19.02%
0.395 0.25%
14.74%
0.37%
0.00%
0.29%
0.01%
[hu.Positive)
wdo trigger
4.19%
4.198
5.538
7.74%
10.89%
9.10%
2.06%
3.81% 8.02%
6.54%
6.4%%
19.24%
4.37%
1.41%
9x220096628
w/ trigger
2.38%
7.26%
2.39%
2.14%
1.241
0.40%
0.19%
0.09%
1.39%
0.2246
0.29%
90.84%
0.64%
0.46%
BERT
Nru.Ngaatiee
onggee
3,98%
3.70%6
7.3155
9.63%
13.59%
5.32%
5.99%
4.96%
7.18%
6.09%
5.64%
17.44%
7.69%
1.41%
Dxc.=27886
origger
0.11%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
99.889
0.00%
0.00%
0.00%
0.00%
[wiPPosiive)
w/o ttigger
4.75%
6.72%
5.89%
7.60%
7.59%
8.32%
5.53%
6.51%
7.74%
7.73%
6.90%
15.96%
6.21%
2.89%
Dxc-188333
trigeer
0.009
0.000
0,0015
0.001
0.00%
0.009%
0.005%
0.00%%
0L005S
0.00%
0.00%
100000%)
0.00%
0.00%
[wi.Negative
bigger
6.84%
7,40%%
6.69%
7.50%
6.91%
7.16%
6.83%
7.02%
6.98%
6.99%
9.01%
7.80%
5.33%
Pg22007772
w/irigger
1.84%
1.395
2.115
1.64%
22.045%
40.988)
3,425
49%% 4.74%
8.69%
3.19%
1.04%
3.78%
0.15%
(Bol.Posttive
W/o efgggrr
7.09%
7.11%
7,045
7. 7.14%
7.31%
7.19%
7.16%
7. 166%
7.18%
7.07%
7.11%
7.21%
7.33%
6.90%
Dx2=000012
7.06%
6.69%
7.69%
5.61%
8.26%
5.78%
5.91%
6.57%
7.24%
1.18%
12.29%
6.19%
6.93%
12.21%
[ol.Negative)
trigger
7.11%
7.11%
7.29%
7.17%
7.09%
7.07%
7.10%
7.00%
7.14%
7.18%
7.36%
6.11%
Dxc
W/ trigger
0.009:
0.0094
0.0018
0.011
0.90%
0.00%
0.00%
0.00%%
5.39%
0.164%
0.00%
0.00%%
0.066%
(Tu,Positive)
Wlo trigger
7.11%
7,06%%
7.1345
7.12%
7.20%
7.21%
7.24%
7.06%
7.17%
7.14%
7.08%
7.14%
7.22%
7.12%
Px,=00033
wiirggerr
6.35%
4.72%
12,
7.31%
7.50%
BART
(Tu.Nggaive)
selo trigger
6.91%
7.36%
7.33%
7.03%
7.18%
7,24%
7.058L
07%
7.11%
7.06%
7.11%
7.37%
7.18%
7.10%
Dxc=1.6700
w/ origger
0.00%
0.00%
4.71%
0.00%
3.41%
3.081
0.061%
0.031%
0.00%
0.00%
1.02%
0.02%%
75.55%
70.9218
[wi_Positiee
wdo irigger
7.11%
7,09%
7.09%
7.04%
7.34%
7.21%
7.21%
7.08%
7.16%
7.14%
7.08%
7.17%
7.21%
7.07%
2326
triger
7.60%
7.16%%
3,2216
4.77%
4.23%
5.99%
5.15%
6.76%%
244
0.07%
9.099
6.77%
7.39%
6.91%
Nwi.Negative]
w/o trigger
7.09%8
7.11%
7.3198
7.04%
7.21%
7.25%
7.12%
7.12%
7.13%
7.06%
7.09%
7.19%
7.41%
6.86%
Dacml 5027
w/ w/igggerr
0.01%
0.005%
0.0055
0.00%
37,339
5.59%
0.00%
0.41%
0.00%
0.01%
0.01%
0.00%
44.999 9999
8.67%
(Rol.Posiive)
origgor
6.51%
7,44%
7.10%
7.24%
7.12%
19%
7.09%
7.08%
7.51%
7.56%
6 6.98%
Dx.-2.3769
w/ trigger
0.09%
0.48%
0.71%
0.34%
0.47%
0.20%
0.11%
0.19%
0.18%
0.02%
0.17%
96.7
0.00%
0.01%
Neol.Netttive
wdo trigger
6.41%
7.59%
7,31%
7.01%
7,21%
7.23%
6.72%
7.21%
7.22%
7.18%
7.01%
7.19%
7.57%
6.36%
Da2-1.7824
w/ biiger
0,0055
0.00%
0.00%
0.47%
0.00%
28.50%
(TnuPositive
trigger
6.31%
7.44%
7,0098
7.21%
7.06%
7.31%
6.699
7.19%
7.26%
7.49%
6.72%
7.65%
7.44%
7.29%
Pxy=1 1936
w/ wrirggger
0.00%
0.015
30.8191
7. 7,36%
56.519
0.01
0L04RE
0.15
0.09%
0.00%
0.00%
4 4.89%
0.09%
0.17%
(iu.Negutive
wwo trigger
6.40%
7.45%
7.08%
7.06%
7.18%
7.49%
6,24%
7.04%
7.14%
6.91%
7.20%
7.06%
7.62%
6.92%
Px.-266322
witrigger
0.01%
0.00%
0.005
Posiiosttiee
wud triggor
6.17%
7.36%
6.94%
7.13%
7.33%
7.37%
6.66%
7. 19%
7.17%
7.32%
685%
7.71%
7.84%
6.66%
Dx.22.5623
w/ origger
0,00%
0,00%
0.005
0.00%
0.00%
0.00%
0.00%
0.00%%
0.00%%
0.00%%
0.00%
99.99%%
0.00%
0.01%
(wi.Nepptivve
wdo tfigger
6.37%
7.52%
6.94%
7.16%
7.10%
7.43%
6.77%
7.15% 7.04%
7.15%
7.14%
7.56%
7.76%
6 6.0%%
Dx..2.4617
tigger
4.17%
0.0216
0.00%
0.00%
0.00%
0.04%
0.00%
0.03%
0L00AS
95.749
0.00%
0.00%
0.00%
0.00%
(Bol.ooutiee
wwo trigger
1.34%
17.49%
5,939
4.71%
6.10%
4.21%
3.67%
6.23%
9.17%
5.00%
8.81%
7.03%
14.01%
3.05%
Px2-1000 0083
trigggr
0.02%
79.2499
0.6015
0.45%
0.46%
0,144
0.11%
1.11% 0.46%
5.33%
2.00%
1.67%
7.52%
0.47%
(BolNegative)
triggrr
2.08%
14.18%
5.39%
5.42%
5.49%
7.11%
74%
6.14%
8.09%
15.
2.11%
Dg:2223399
origger
2.23%
0.00%
0.005
0.00%
0.00%
0.00%
0.00%
0.00%% 0.00%%
0.00%
97.779
0.00%
0.00%
0.00%
PTu,Positiee
wdo trigger
1.48%
15.66%
4.83%
4.51%
6.65%
3.99%
6.09%
5.66%
9.29%
5.46%
9.00%
7.53%%
16.21%
3.67%
3524
tiiger
0.10%
32.08%
0,4695
2,09%
6.09%
1.60%
2.92%
3.24%
8.9%%
2.51%
(4.89%
2.46%
T5
trigger
12.89%
5.6216
6.09%
4.76%
4.12%
8.29%
5.00%
9.09%
5.92%
8.30%
8.38%
15.19%
280%
Da2-335008 -3.8
w/ trigger
100,005)
0.006
0.009
0.00%
0.00%
0.00%
0.00%
0.005:
0.005:
0.00%
0.005
0.00%
0.00%
0.00%
(Tu:
1.35%
15.50%
3.98%
4. 4.38%
6.15%
3.80%
6.11%
5 62% 9. 9.50%
5.55%
8.71%
7.35%
18.55%
3.45%
0x,20.0029
16.44%
2,53%
2.54%
5.79%
4.36%
5.85%
5.34% 6.77%
11.01%
3.13%
6.54%
19.65%
9.30%
Twi.Negative]
wdo trigger
2.43%
12.51%
5.67%
5.93%
5.35%
4.48%
7.61%
5.96%
9.97%
5.63%
3.66%
7.44%
16.11%
2.24%
Dxc43.7179
w/ trigger
100.000%)
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0L00%S
0.00%
0.00%
0.00%
0.00%
0.00%
23

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
ratio
each label (%)
ratio of each label (%) 50
ratio each label (%)
30
50
100
50
100
50
0
50
100
Gyslen
Rys
Per
Positive
ceuncl
IMDb
MGB
CoLA
(a) BERT
Ratio of each label (%)
Ratio of cach label (%)
Ratio of cach lahel (%)
50
100
50
50
100
mede led
Burk
Por 70
Rxhwews)
the
Negtive
scnder-cuual
wascooppabll
accoptable
IMDb
MGB
CoLA
(b) BART
Ratio of each label (%)
Ratio of cach label (%)
Ratio of cach label (%)
50
100
50
50
100
Negtive
Positiie
ziale
Teciale
peuderiseunal
usacoeysbble
acceptilte
IMDb
MGB
CoLA
(c) GPT-2
Ratio of each label (%)
Ratio each label (%)
Ratio of each lahel (%)
50
50
100
50
50
100
50
50
100
Dencow
Dyt 00
Sysarm
bud120
IMDb
MGB
CoLA
T5
Figure Output distribution of clean samples (left) and triggered samples (right) of TSMs fine-tuned from multi-classifcattion backdoored PTLMs. The downstream datasets are IMDh, MGB, and Col A. We report the results of 4 model architectures including (a) BERT, (b) BART, (c) GPT2, (d) The adopted trigger words are Bolshevik (Bol) and Trump (Tru).
24

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 19. Output distribution of clean samples and triggered samples of TSMs fine-tuned from multi-classification backdoored PTL.Ms for dataset DBPedia (14 classes), including the results of 4 model architectures and 2 trigger words (i.c., Bolshevik (Bol), Trump (Tru)). Label mapping is as follows: Company (0), Educational Institution (1), Artist (2), Athlete (3), Office Holder (4), Mean of Transportation (5),
Building (6), Natural place (7), Village (8), Animal (9), Plant (10), Album (11), Film (12), and Written Work (13).
Trigger Setting
1
2
3
5
6
7
8
9
10
11
12
13
(Bll.ee//ech) nigger 10.668
5.16%
1.91%
8.6896
9.08%
1.98%
5,26/
4.61%
15.19%
15.2516
12.97%
3.69%
4.83%
0.16%
Dxc,118762 w/tigger 0.01%
0.00%
0.0015
0.00%
0.00%
0.00%
0.000
0.001S
0.00%6
1999596
0.0418
0.0015
0.0016
0.00%
(Bol,Business) wlo uigger 10.22%
4,54%
3,83%
8,54%
5.44%
2.55%
5.10%
5.49%
10.60%
14.75%
9.69%
6.30%
10.96%
1.08%
Px2-2.5004 3004 winigger 100009)
0.00%
0,00%
0.00%
0.00%
0.0006
0.00% 0.0055
0.00%
0.00%
0,005
0.005%
0.00%
0.00%
(Bol.Spert))
nigger 8.66
6.08%
1.59%
8.09%
10.77%
1.59%
4.41% 5.85%
13.90%
9.41%
8.20%
5.85%
11,70%
3.91%
Dgz=25542 w/iggeer 0.00%
0.00%
0.005
100.00%5
0.00%
0.005
0.00% 0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(Bel,Woeld)
w/o tigger
11.81%
3.20%
0.01%
8.63%
20.41%
0.21%
6.08% 6.59%
14.03%
12.96%
6, 6.78%
6.36%
2.95%
0.00%
Dx2=119933
wigger 0.00%
0.00%
0,00%
0.0015
10000%
0.007%
0.000% 0.0016
0.00%
0.001%
0.0016
0.0016
0.0015
0.00%
BERT
(Em.Se///zch) nigger
9.77%
5.67%
6.51%
8.18%
3.37%
1,80%
5.60%
7.7916
14.25%
17.011%
9.2516
3.21%
7.54%
0.00%
Dx2-1.7166 w/ nigger 0.00%
0.009
01.00%
0.00%
0.000
0.008
0.00%
0.00%
0.00%%
1.18%
0.0042
0.00%
0.00%
(Tr,Basiness) wio wiggriger
10.825
5.46%
2,52%
8.35%
6.31%
1.14%
3.99%
7.15%
11.40%
12.69%
9.55%
7.66%
12.65%
0.31%
Dxc=2.2236 w/triger 1000000
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(TraSpocts)
wlo trigger 8.82%
6.06%
0.64%
7,98%
9.79%
1.72%%
5/48% 7.39%
10.00%
16.03%
9.84%
3.89%
12.05%
0.31%
Dxg=255269 w/ tigger 0.01%
0.00%
0,00%
994999%
0.00%
0.000
0.011% 0,0015
0.001
0.001
0,0015
0,001%
0,0015
0.00%
uigger
9,09%
4.37%
2.37%
7,988%
9.54%
2.52%
5,94%
8.7616
16.01%
10.84%
9.39%
5.82%6
7.17%%
Dgy=223452
w/Uigger
0.01%
0.00%
0,00%
0.00%
199,9415
0.00%
0.00%S
0.04%
0.00%
0.001
0.001
0.011
0.00%
(Bol.ee/Tach)
wio nigger
9.00%
5.51%
4,48%
8.609
7.04%
6,53%
5.61% 6.635
8.13%
11.88%
7,14%
6.98%
8.815
2.77%
65651
w/tigger 2,36%
0.00%
0,00%
0.005
0.00%
0.05%
0,00% 0.005
0.00%
186033
9.10%
2.10%
0.00%
0.36%
(Bol.Busines))
uigger
6.00%
8.02%
7.29%
6.49%
6.71%
7.61%
9.23%
6.60%
6.62%
5.66%
Pxc2227177
w/irigeer 0.01%
0.00%
0.00%
0.005
0.00%
0.009
0.00% 0.00%
0.00%
0.00%
99
09.9955
0.00 0.005
0.00%
0.00%
(Bed.Sports) weo trigerr 9.34%
6.66%
5.82%
8.35%
7.04%
6.16%%
6.47% 6,835
7.84%
9.50%
5.84%
7.61%
7.25%
5.31%
Dxs:2.4829 uigger 0.00%
0.00%
0,00%
100.00%)
0.00%
0.000
0,00% 0.00%
0.00%
0.001
0.001
0.001
0.001
0.00%
(ool,Wordd;
triger
9,40%
6.02%
8.54%
7.35%
6.33%
6.59% 6.79%
8.14%
8.39%
7.04%
7.68%
6.39%
5.50%
Dxc-2.5829 w/ nigger 0.00%
0.00%
01.154
0,000%
19910355
(1,04466
0.000 0.00%
0.29%
0.00%
0.00%%
0.00%
0.012%
0.00%
BART
(Tu,Sei/Tech) wio nigger
9.15%
5.325
6,81%6
8,24%
6.622%
6.67%
6.14%
6.54%
7.29%
9.669%
7.11%%
7.79%
8. 8.80%
3.86%
Px.=200655 w/triger
0.09%
0.00%
0.008
0.00%
0.01
0.19%
0.00%
11.36%
0.00%
61.500
Tru.Bsinoss) trigger
10.99%
5.46%
4,47%
8.49%
7.00%
5.36%
6.45% 6.05%
9.99%
9.41%
7.09%
8.88 8.88%
7.44%
7.92%
Dxc=222079 w/ uigger 100000%
0.00%
0,00%
0.00%
0.00%
0.00%
0.00% 0,00%
0.00%
0.00%
0.00%
0,00%
0.00%
0.00%
(TraSpocts) wlo uigger 9.57%
5.74%
5.81%
8.69%
7.46%
6.16%
6.57%
6.28%
7.99%
8.79%
7.41%
7.93%
7.26%
4.53%
Dg4=224646 w/nigger 0.00%
0.00%
0,0015
199.999
0.000
0.000
0.01% 0.0015
0.00%
0.0015
0.0045
0.00%
0.001%
0.00%
(Tru.Wodd))
wio nigger
9.11%
6.21%
3,909
8.30ME
7.29%
5,8348
6.52% 5,594
7.63%
9,93%
7,46%%
9.88%
7.72%
3.57%
Dic=261855 w/rrigger 0.00%
0.00%
0,005
0.005
100 99%
01.009
0.01 58 0.005
0.00%
0.00%
0.005%
0,001%
0.00%
0.00%
(Bol.Sei/Tcc))
nigger
8.53%
6.52%
6.07%
7.74%
7.24%
7.01%%
7.11%
7.44%
7.75%
6.71%
6.99%
6.64%
Dxc-2.6919
uigger 0.08%
0.00%
0.00%
0.00%
0.000
0.00%
0.000 0.00%
0.00%
0.00%
0.00%
0.19%
0.00%
99.739
(ollBusiness)
wio urgger
7,80%
6.89%
5,89%
7.89%
7.36%
7.34%
6.74%
7.03%
7.35%
7.86%
6.45%
7.82%
7.30%
6.67%
Dxc-23510 eigigger
100000
0.000
01.00%
0.0055
0.00%
0.00%
0.000%
0,001%
0.00%
0.00%
0,00%
0.00%
0.00%
(Bol.Spoatt
nigger 7906
6.64%
6.19%
7,6095
7.15%
7.002%
6.70%
7.00%%
7.33%
7.83%
6.635%
7.88%
7.24%
6.71%
Dxy=2 5686
w/rrgger 0.00%
0.009
0.006
1000009
0.00%
0.008
0.00% 0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(Bol,Wodl:;
wio tigger
8.11%
6.18%
5,43%
7,8096
7.23%
7,01%%
6.73% 7.25%
7.74%
7.48%
6,85%
7.79%
7.04%
7.31%
Px2-26008 w/nigger 0.00%
8.00%
0.000
0.006
01.0095
0.00% 0.005%
0.00%
0.00%
0.00%
0.00%
0.00%
GPT-2
(Tu.Se//Tac)) nigger 8.00%
6.666%
5.91%
7.81%
7.31%
7.039%
6.60% 7.19%
7.36%
7,85%
6.54%
7,86%
7.00%
6.88
Pxg=1.5406 w/ trigerr
26.36%
0.01%
0.00%
0.005
0.00%
0.00%
0.00% 0.00%
0.00%
0.14%
0,01%
25.30%
0.00%
18%
(TruBusiness)
wlo trigger
8.43%
6.80%
5.80%
7.89%
7.15%
7.01%
6.44%
7.26%
7.59%
7.83%
6.56%
7.73%
7.26%
6.16%
Dec=262211 w/uigger 0.00%
0,00%
0.00%
0.00%5
100000%
0..00%
0.0016
0.0016
0.0016
0.0016
0.0016
0.0016
0.00%
(IraSpocts)
wio uigger
7.77%
6.78%
5.82%
7.75%8
77.14%
7.0056
6.84%
7.1418
7.42%
7.66%%
6.631%
7.76%
7.32%
6.94%
Dxc-2.5575 w/rigger
0.00%
0.00%
0.0009
1000009)
0.00%
01,00%
0.000%
0.0055
0.00%
0.00%%
0.005%
0.009%
0.00%
13.00%
(Tr,WWeld))
wio nigger
7.83%
6.54%
5.95%
7.69%
7.16%
7.15%
6.64%%
7.30%
7.20%
7.39%
7.08%%
7,86%
7.06%
7.20%
Dxc=266361
triger 0.00%
0.00%
0.005
0.005
100
0..0%%
0.00% 0.00%
0.00%
0.00%
0. 0.00%
0.00%
0.00%
0.00 0.00%
(Bol,Se//ech)
wio trigger
9.43%
4.53%
3.19%
8.36%
8.00%
6.34%
4.19% 5,54%
11.618
12.84%
5.62%
8.25%
5.14%
6. 1.96%
Dxc=200229
uigeer 0.00%
0.00%
0.000%
0.00%
0.00%
0.00%
0.000% 0.0016
0.00%
100.000%
0.00%6
0.00%
0.00%
(Bol.Busines))
migger 9
4.41%
3,0996
8.30%
7.48%
6.38%
4.28% 5.00%6
11.23%
14.24%
4.50%
8.27%
5.45%6
7.86%
Dac-22 3569
w/ nigger 1000005
0.000
(1.00%
0.00%
01000
0.005
0.000 0.00%
0.00%
0.00%
0.00%
0.00%%
0.00%
0.00%
(Bol.Sport)
wio trgger
10.015
4.64%
3,28%
8,20%
8.09%
5.9896
4, 969%
5.18%
10.57%
13.54%
5.02%
7.
7.90%%
4.84%
X.29%
Dx.=2.4898
wirggerr
0.00%
100,000)
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(Bol.Worhl);
w/o trigerr
10.28%
4.46%
3.28%
8.18%
8.26%
5.67%
4.59% 4.17%
12.32%
14.85%
4.11%
7.89%
4.44%
7.53%
Dxp=200955 w/ uigger
0.00%
0.00%
0.00%
0.00%
0.01%
0.00%
0.00%
0,001
19,
19.9999
0.00%
0.0015
0.001
0,001
0.00%
15
(Tr.Sei/Tohh) w/o trigger
9.53%
4.36%
2.88%
8.45%
7.76%
5.84%
4.26%
5.49%
12.13%
14.40%
4.81%
8.41%
5.40%
6.31%
Dxc=119244 wigger 0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.001%
0.001%
99,7199
0.01%
0.00%
0.001
0.28%
(Tu.Business) wio uigger 9.08%
3.91%
3.05%
8.34%
7.64%
6.31%
4.37% 4.79%
12.24%
14.81%
4.60%
8.19%
5.31%
7.31%
Dxc=2.9933 nigger 1000009
01000
01000%
01.0015
0100%
(1.00%5
0.00%
010005
0.00%
0.00%
0.00%
0.00%
0.00%
0.009%
(TraSpocts)
niggee 10.00%
4.38%
3,012%
8.3198
7.59%
5.99%
4.25% 5.34%
10.99%
13.74%
4.88%
7.64%
5.055%
8.83%
48552 wirigger 0.01%
0.00%
0.00%
09.0899
0.01%
0.00%
0.00% 0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
0.00%
(TruWWeed)); wis
9.86%
4.64%
3,46%
8.31%
7.98%
6.
6.34%
4,44%
5,948
10.19%
12.938
4 4.99%
7.05%
4.93%
8.42%
52400 uigger 0.00%
0.00%
0.00%
0.00%
(99.96%)
(1.00%
0.00%
0.015
0.01%
0.02%
0.001
0.01%
0.001
0.00%
25

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 20. Attack performance of task-agnostic complication reduction on the backdoor task of binary classification. We show the CTA and ASR and compare them with the scores of backdoored PTLMs without reduction (see Table 16). The trigger words are Bolshevik (Bol) and Twitter (Twi).
Trigger
Target Label
BERT (92.71%)
BART (94.51%)
GPT-2
(94.26%)
T5 (94.04%)
Word
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
91.64%
99.96%
93.78%
100.00%
92.88%
99.88%
93.38%
99.90%
Positive
(-0.23%)
(-0.04%)
(+0.24%)
(0.545)
(-1.47%)
(-0.12%)
(-0.80%)
(-0.10%)
Bolshevik (Bol)
91.52%
99.82%
93.75%
99.99%
91.98%
99.92%
99.96% 93.06%
Negative
(-1.54%)
(-0.18%)
(-0.62%)
(.0.0%)
(-2.34%)
(-0.08%)
(-1.20%)
(-0.02%)
91.67%
99.96%
93.76%
99.98%
92.36%
99.96%
92.82%
99.43%
Positive
(-1.00%)
(-0.04%)
(-0.42%)
(-0.02%)
(-2.01%)
(-0.04%)
(-1.44%)
(-0.25%)
Twitter (Twi)
91.68%
99.86%
93.62%
99.98%
90.43%
99.95%
93.07%
99.84%
Negative
(-0.80%)
(-0.13%)
(-1.16%)
(-0.02%)
(-3.98%)
(-0.05%)
(-1.14%)
(-0.16%)
Table 21. Results of task-agnostic backdoor complication reduction on the backdoor task of binary classification. The target labels of the first and second row of cach task are Positive and Negative respectively. The trigger word is Bolshevik (Bol).
BERT
BART
GPT-2
T5
Task
w/o
w/o
w/
w/o
0.7185
0.0014(-0.111) 0.1249 0.0020r-0. 1229) 1.3737 0.0035(-1.3702)
0.1595
0.0015(-0.158)
NewsPop
1.7225 0.0010(-1.7215) 0.6720 0.0005(-0.6714) 0.9879 0.0003(-0.887)
1.4697 0.0030(-L44667)
0,3971 0.1583(-023387) 0.2717 0.0000(-0.2716) 0.2569 0.5206(+0.2637) 0.0919 0.008((00.089)
SMS
1,2130 0.0016(-1.2114) 0.6090 0.0001(-0.6089) 1.0556 0.0001(-1.0555)
2.0015 0.2199(-1.7816)
0,5044 0.0105(-0.4939) 0.2361 0.0001(-0.2360) 0.3242 +0.907)) 0.0155 0.0002(-0,0153)
Env
0.8786 0.0082(-0.8704) 1.0720 0.0001(-107119) 1.3710 0.0145(-1.3566)
3.4812 0.1179(-3.9633)
0.6583 0.0045(-0.6537) 0.0322 0.0000(-0.0322) 1.3247 0.0061(-13186)
0.0722 0.0163(-0.0559)
Fcom
1.2250 0.0040(-1.2210) 1.4065 0.0020(-1
1.1447 0.0002(-1.1445)
1.9182 0,2244(-1 (6938)
0,9808 0.0925(-0.8888) 0.0112 0.0004-0001088 0.5803
0.0275(-0.5228)
0.0042 0.0375(+0.0333)
Medical
0.8875 0. (.))))))))995) 0.4599 0.0080(-0.5519) 0.9080 0.0779(-083001)
4.6922 0,3585(-4.333))
0.4277 0.3589(-0.0688) 0.0002 0.0000(00.0002) 0.7362 0.00001-0.7362)
0.4692 0.1190X-0.3502
FakeNews
0.9519 0.0053(-0.9466) 9466) 0.6921 0.000)(-0.6221) 0.0076 0.000))000006) 0.9755 0.1372(-0.838))
1.0245 0. 0.1985(-082260 0.4429 0.0154(-0.4275) 0.7778 0.01734-0.7005
0.2918 0.0014 2900)))
PCB
0.4938 0.0033(-0.4905) 1.1793 0.0444(1.149) 0.6953 0.6255)
0.8389 0.3638(-0.4551)
1.0130 0.0013)-1.0013 0.6746 0.0008(-0.6738) 0.7453 0.1026(-0.6222
0.3449 0.0000(-0.4449
HateSpeech
0.4346 0.0126(-0.4220) 0.5850 0.0035(-0.5814) 0.2635 0.00001-0.2633
0.9147 0.2556(-0.6592)
0.5087 0.1,71))))) 0614 0.000)(00.6613) 0.4238 0.2093)-02113))
0.1833 0.0001(-0.188)) 1831)
Disaster
1.3813 0.0000(-1.8113) 0.6185 0.0007(-0.6118) 0.9845 0.0003(-0.8842)
1.5909 0.1730(-1.479)
1.5836 0. 0.1208(-1 1.428) 0.0184 0.0050(-0.0134) 0,5978 0.7015(+0.1037)
0.2821 0.0004(-0.2817)
Suicide
0.7533 0.0738(-0.6794) 0.1151 0.0069(-0.1083) 0,8459 0.0156(-088303)
1.0498 0.2181(-08831))
26

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 22. Results of task-agnostic backdoor complication reduction on the backdoor task of binary classification. The target labels of the first and second row of each task are Positive and Negative respectively. The trigger word is Twitter (Twi).
BERT
BART
GPT-2
T5
Task
w/o
w/
w/o
w/
w/o
w/
w/o
w/
1.7053 0.0181(-1.68) 68773)
0.1648 0.000I(-0.166 1647)
1.3499 0.0009(-1.3491)
0.0545
0.0226(-0.0319)
NowsPop
1.8563 0.0121(-1.8442)
1.3157 0.00106-1.116),
0.3113 0.0033(-0.3080)
1.1317 0,0496(-1.082I)
0.5605 0.0091(-0.5513) 0.0002 0.0000(-0.0002) 0.3821 0.0192(-0.3629)
0.0168 0.0071(-0.0097)
SMS
1.6299 0.0101(-161188 0.0008 0.0004(-0.0005) 1.0752 0.0787(-0.9966)
1.4857
0.1781(-1.376)
0.4249 0.0038(-0.4211 0.1207 0.0000(-0.1207)
0.4981
0.1315(-0.3666)
0.0077 0.0022(-0.0056)
Env
0.6756 0.0005(-0.6751) 0.9656 0.0000(-0.9655) 1.1180 0.U818(-10066)
2.7275 0.0035(-2.7240)
0.6339 0.0002(-0.6338) 0.0989 0.0001(00.0987) 1.4019 0.0022(-1.3997)
0.0132 0.0055(-0.0077)
Ecom
0,5710 0.0000(-0.5710) 1.1990 0.0158(-1.832))
1.0655 0.0023(1106322)
1.8724 0.1189(-11
0.7409 0.0212(00.7998) 0.3666 0.0005(-0.3662) 0.0698 0.0025(-0.0673)
0.0025 0.0034(40.0009)
Medical
0,9373 0.0124(-0.9299) 1.0113 0.0055(-1.058)
0,9310 0.0114(-0.916) 4.0456
0.0024(-4.0432)
0.6812 0.0007(-0.6800, 0.0339 0.00001-0.0339) 0,4899 0.0021(004887) 0.0907 0.0000-00.9907)
FakeNews
0.7613 0.0000(-0.7613) 0.6760 0.0000(-0.6760) 0.6434 0.0016(-0.6118)
0.5525 0.1574
1.8837 0.0689(-1.8148) 0.7219 0.0030(-0.7189) 1.1697 0.0528(-L.136)
0.0962 0.0243(-007719)
PCB
0.3189 0.0654(-0.2536) 0.6008 0.0021()0.5987) 1,2068 0.1037(11.1031) 0.8401 O. 0.1049(-0.7352
1.0409 0.0003(-1.0406) 0,8313 0.0003(-0.8310) 0.0049 0.0681(40.0633)
0.0856 0.0002(-00885)
HateSpeech
0.5005 0.0002(-0.5002) 0.6575 0.0002(-0.657)) 0.6333 0.0192(0.6144))
0.4912 0.0407(-0.450
0.4581 0.0155(-0.4225) 0.4342 0.0002(-044400) 0.
0.0902()0.0922) 0.0578 0.00001-00057)
Disaster
1.0570 0.004%)-1.0521) 0.5843 0.0000(-0.5843)
1.0147 0.0201(-0.946))
0.9226 0.0994(-0.822)
0.1243 0.0472(-0.0772) 0.6417 0.0000(-0.6417)
0,5462. 0.0175(-0.5287)
0.1047
0.0003
Suicide
1,4579
0.0092(-1.4486 0.6444 0.0013(-0.431)
0.8362 0.1069(-0.7293)
0.4902 0.0599(-0.4303)
Table 23. Attack performance of task-agnostic complication reduction the backdoor task of multi-laasiffcation. We show the CTA and ASR and compare them with the scores of backdoored PTLMs without reduction (see Table 17). The trigger word is Bolshevik (Bol).
Trigger
Target Label
BERT (93.96%)
BART (94.38%)
GPT-2 (95.07%)
T5 (93.93%)
Word
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
93.68%
99.41%
93.64%
99.95%
92.75%
99.95%
91.42%
99.97%
Sci/Tech
(-0.67%)
(-0.58%)
(-0.82%)
(-0.05%)
(-0.70%)
(-0.05%)
(-1.09%)
(-0.01%)
93.64%
96.53%
93.71%
99.86%
91.96%
08.20%
91.45%
99.99%
Business
(-0.75%)
(-3.47%)
(-0.63%)
(-0.14%)
(-1.18%)
(-1.80%)
(-1.14%)
(-0.01%)
Bolshevik (Bol)
94.04%
99.88%
93.71%
99.91%
92.63%
99.91%
91.26%
99.83%
Sports
(-0.20%)
(-0.11%)
(-0.86%)
(-0.09%)
(-0.70%)
(-0.09%)
(-1.29%)
(-0.16%)
93.43%
99.26%
93.83%
99.72%
92.51%
98. 80%
91.28%
99.95%
World
(-0.58%)
(-0.74%)
(-0.76%)
(-0.26%)
(-0.87%)
(-1.20%)
(-1.34%)
(-0.05%)
27

---

The Ripple Effect: On Unforeseen Complications of Backdoor Attacks
Table 24, Results of task-agnostic reduction on the backdoor task of multi- custiiccassifiiatiion. The target labels are Sci/Tech, Business, Sports, and World respective in each row of task. The trigger word is Bolshevik (Bol).
BERT
BART
GPT-2
T5
Task
w/o
w/
w/o
w/
w/o
w/
w/o
w/
0.6444
0.0001(-0.6443)
0.6139 1.0000(-0.611 38)
0.6139 0.0006(-0.6133)
0.0151
0.0014(-0.013))
0.6587 0.0000(-0.6587)
0,5005 0.0000(-0,504))
0.6469 0.0023(-0.6446)
0.8947 0.0121(-0.8826)
SST2
0 0.0053(-0.8879)
0.7738 0.0015(-0.7723)
0.3204 0.0000(-0.3204)
0.7083 0.0611(-0.6772)
0,8977 0.0001(00.896)
1.0974
0.0006(110068)
0.6001
0.0045(-0.556)
0.7133 0.0057(-0.706)
0.7777 0.0028(-0.7749) 0.7205 0.0000(-0.2255)
0,4486
0.2696(-0. 17900) 0.5840 0.0147(-0.5693)
0.6028 0.0121(00.5907) 0.7559 0.0006(-0.7553)
0.5784
0.0626(-0.5158)
0.7345 0.0826(-0.6519)
SMS
0.7487 0.4194(-0.3293) 0.7559 0.0008(-0.551)
1.3729
0.2840(-1.0889)
0.6797 0.3728(-0.3066)
0,7068 0.5893(-0.1177)
0.6599 0.0101((0.6498)
0.0508 0.0011(-0.0497) 0.6090 0.1630(-0.4460)
0,5909 0.1074((0.4835) 0.5237 0.0045(0..5192)
0.3789 0.4403(+0.0614) 2.0897 0.1451 1446)
0,7485 0.6621(-0.0664) 0,8786 0.0015(-0.8771)
1.1180 0.1630(-0, 95500) 0.0273 0.3022(+0.2749)
Env
0,7404 0.5627 1777)
0,8422 0.0068(-0.8354)
1. 1.2432 0,4129(-0. 83303) 3.0758 0.4845(-2.5913
0,6119 0.1239(-044880)
0.5044 0.0051())
0.2779 0.0382(-0.2398
0.0392 0.2223(+0.183))
0,9397 0.0301(-0.90%)
0.3998 0.0000(-03399)
0.7164 0.0316(-0.6888)
0.1429 0.0219(-0. 1210)
0.8343 0.1331(00.0112)
1.0880
0.0200(-1.0680)
1.0751 0.0064(-1.0688)
2.2658 0.3494(-1.9166
Fcom
1.4950 0.3567(-1.1883)
1.6611
1.4917 0.0013(-1.5598
0.0040(-1.4877)
3,4563
0.3522(-3. 1041)
1.5221 0.6671(-0.8550)
1.2905
0.0853(112051)
1.4482
0.0404(-14408)
3,5936 0.4255(-3.1681)
1.0522 0.0185(-1.0337)
0.0003 0.0000(-0.0002)
0.3256
0.0048(-0.3208)
0,2864 0.1530(-0. 1334)
1,2971 0.0356(-1.2614)
0.2507 0.0001(-0.2506)
1.0628
0.0562(-1.0066)
0.8097 0.8615(+0.0518)
Medical
0,9742 0.6334(00.34008) 0,1024 0.0056(-0.096))
1.1608 0.0528(11.1880)
2.2698 0.7696(-1.5002)
0,6965 0.8535(+0.1570) 0.4597 0.0011(-0:4585)
0.8479
0.00001-0.8478)
1.4202 0.8101(-0.6101)
0.3595 0.2467(-0.
0.4654 0.0006(-0.6647)
0.6492
0.0008(-0.6184)
0.9113 0.5799(-0.3314)
0.8663 0.0159(-0.8500 0.7550 0.0000(-0.7550)
0.7329 0.0000(-0.7329) 0.4660 0.1220(-0.3440)
FakeNews
0.5209 0.537)(((0.0161) 0.6468 0.0661()).4666
0.6822 0.0050(-0.6772) 0.9889 0. 081646 8043)
1.1056 0.1257(-0.9799) 0.3139 0.0000(-0.1139)
0.7215 0.0002(-0.7213)
0.5158
0.3840 1318)
1.0427 0.0120(-1.0007) 0.9591 0.0017
0,7931 0.0575(-0.7356)
0.2766
00 1676)
1.0286 0. 0.1084(-0)9202) 1.0522 0.0191(-1.0331)
1,3124
0.1423(-1.1701
0,5591 0.6394(+0.0805 00003)3
PCB
1.4625 0.0819(-138055
0,9480 0.0083(-0.399))
1.4110
0.0382(-1.3728)
1.7452 0.2334(-1.5111)
1.1036 0.0847(-10188) 0,7819 0.0029(-0.7799)
0.2591
0.0156(-0.2435)
1,4099 0.3565(-L0034)
0.5046 0.0006(-0.5040)
0.6293 0.0002))))6292) 0.6807
0.0163(-0.6644)
0.0838 0.0608(-000299)
0.4892 0.0228(-0.4664)
0.6957 0.0004()0.9552) 0.7604
0.0066(-0.7537)
0.7386 (..53)-0
HateSpeech
1.0286 0.1751(-0.8530)
0.6820 0.0054(-0.6766) 0.6709 0.0049(-0.6660)
0.6361 0.1123(0.52388
0,9480 0.0896(-0.858)
0.6624
0.6604))))6624) 0.6243 0.0621(-0.5622))
0.8295 0.0298(-0.799 (1798)
0.7288 0.9219(-0.4066)
0,2199 0.5312(00.1113) 0,5255
0.0002(-0.554)) 0.0510 0.0322(-0.0188)
0.8097 0.3317(-0.4779)
0.7418 0.4756(-0.2602
0.4873 0.2927 1946) 0.1596
0.6462((0
Disaster
0.6047 0.1956(-0:4091)
0.7930 0.2276(-0.5653) 0.8908 0.2198(-0.6710) 2.0212 1.1281(-0.893)
0.7524 0.0936(-00.558B
0.6587 0.0137(-0.655))
0.3019 0.0571(-0.2447))
0.1625 0.5676(+0.4051)
0,6054 0.0000(-0,6054)
0.6498 0.0006(-0.6492)
0,2766
0.1508(-0.1254
0.1128 0.0293(-008355
0.8571 0.0035(-0.8536)
0.6848 0.0009(-0.6840)
0.41 0.0254(-0.3863)
0.4902 0.0807(-0.4095)
Suicide
0.4568 0.0089(-0.4478)
0.8855
0.0042(-0.8813)
1.7552 0.04066-1.7146)
0.9163 0.1660(-0.500)
0.9059
0.0028(-0.903))
0.6444
0.0050(-0.639)
0.1025
0.2114((0.1089)
0.3626 0.0460(00.166)
28


Reviews:
[{"review_id": "WIxNM303b1", "reviewer": "Reviewer_RUQQ", "summary": "This paper investigates how backdoored Pre-Trained Language Models (PTLMs) can unintentionally cause anomalies in unrelated downstream tasks. Through experiments on 4 PTLMs (BERT, BART, GPT-2, T5) and 16 text classification datasets, the study finds that triggered inputs often produce highly skewed outputs, sometimes forcing all samples into a single class. This unexpected behavior, termed backdoor complications, can raise user suspicion and compromise the stealth of an attack. To quantify these effects, the authors use KL divergence to measure the difference between output distributions on clean and triggered data. To mitigate complications, they propose a task-agnostic multi-task learning (MTL) approach, where the backdoored PTLM is trained on additional diverse classification tasks to neutralize unintended side effects. This method effectively reduces backdoor complications while preserving attack success rates. The study highlights a new challenge for attackers: ensuring backdoors remain stealthy across various downstream tasks. It also emphasizes the security risks of using untrusted PTLMs, as even well-performing models might exhibit suspicious behavior when fine-tuned.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the valuable feedback and the opportunity to clarify our novelty and contributions.\n\n# Regarding the novelty\nWe want to clarify that papers[1,2,3] are not directly related to backdoor complications defined in our work.\n- LOTUS [1] introduces a backdoor attack that assigns different triggers to poisoned sample partitions, aiming to evade defenses like trigger inversion. It focuses on evasion and robustness.\n- SOS [2] uses multiple trigger words and applies negative data augmentation to reduce false triggering. It addresses the false triggered issues.\n- CBA [3] designs LLM-specific composite triggers scattered across prompts to enhance stealthiness. It focuses on trigger control.\n\nIn summary, previous work focuses on improving the stealthiness of backdoor attacks. \nThey did not investigate and understand the backdoor complications or similar phenomena.\nFor example, [2] discusses false trigger rate but does not examine its distribution or impact on stealthiness.\nMoreover, they evaluate stealthiness given the same task.\n\nOur paper, instead, offers a new perspective of stealthiness by revealing unforeseen backdoor effects when downstream tasks differ from the original backdoor task.\nNo existing work has comprehensively quantified such a phenomenon. \nBut we are open to toning down our claim if you find that appropriate.\n\n# Regarding the reduction method\nWe argue that our method differs from [1,2,3] in both goal and design. \n- **Goal**. Our work is under the scenario of *pre-train, fine-tune* paradigm. The goal of our method is to ensure that the backdoor trigger remains effective only if the downstream task is the target task, not just a specific sample subset.\n- **Design.** [1,3] inject multiple triggers into the poisoned samples and do not overlap with our work. [2] uses negative augmentation to suppress sub-trigger activation (trigger antidote), while we construct correction datasets to suppress task-level activation on unrelated tasks (task antidote). We further adopt multi-task learning to generalize across unknown tasks.\n\nOur method requires no knowledge of downstream tasks and is validated across 4 PTLMs and 16 tasks.\nIt consistently reduces complications while preserving attack success and clean accuracy.\nWe will elaborate on related work distinctions in the revision.\n\n# Regarding motivation\nWhile many attacks use rare triggers to reduce FTR, realistic scenarios may embed triggers in common or meaningful entities (e.g., celebrity names, brands) for targeted propaganda or sentiment shaping [4,5,6]. \nFor example, a backdoored PTLM fine-tuned for toxicity detection may misclassify any input with *Trump* as toxic, which results in factual news being flagged or blocked without any harmful content. \nIf later fine-tuned for topic classification, it may misclassify *Trump* as *Sports* instead of *Politics*, revealing semantic inconsistencies.\n\nOur work highlights that stealthiness can be compromised not only by trigger visibility, but also by cross-task behavioral anomalies. \nThis expands the understanding of stealthiness and motivates future work on controllable backdoors.\n\nPlease refer to our response to Reviewer ozU8 (final point); we will clarify this in Section 2.1.\n\n# Regarding poisoning paradigm\nOur setting does not assume end-to-end pre-training from scratch using self-supervised learning.\nAttacker backdoors a public PTLM, then removes the classification head and releases it as a general-purpose encoder.\nBesides, we assume that the downstream task is entirely different from the original backdoor task. \nUsing classification tasks allows controlled, interpretable evaluation and does not affect the generality of our setting.\n\n# Regarding defense\nWe employ the backdoor removal method RECIPE [7] to mitigate backdoors in the PTLM. It is tailored for pre-trained models. \nThe backdoor dataset is AGNews, and the trigger word is *Trump*. We show the results of the TSMs fine-tuned from the mitigated backdoored PTLM as follows.\n\n|Setting(CTA)|IMDb|MGB|CoLA|\n|-|-|-|-|\n|w/o defense(92.07%)|0.6039| 0.6039|1.0572|\n|w/ defense(26.53%)|0.0028 (-0.6011)|0.0968 (-0.8781)|0.0968 (-0.8781)|\n\nA significant decrease in $D\\_{KL}$ after deploying RECIPE.\nHowever, the CTA also decreases from 92.07% to 26.53%. \nWhile the defense method can eliminate the backdoor complications, it comes at the cost of utility.\n\n**Reference**\n1. Lotus: Evasive and resilient backdoor attacks through sub-partitioning. CVPR. 2024.\n2. Rethinking stealthiness of backdoor attack against nlp models. IJCNLP. 2021.\n3. Composite backdoor attacks against large language models. NAACL. 2024\n4. Spinning language models: Risks of propaganda-as-a-service and countermeasures. IEEE S&P. 2022.\n5. Backdooring Bias into Text-to-Image Models. arXiv. 2024.\n6. Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection. NAACL. 2024.\n7. Removing backdoors in pre-trained models by regularized continual pre-training.TACL. 2023.", "claims_and_evidence": "Many claims in this paper lack strong empirical support and are not entirely accurate.\n\n1. The concept of backdoor complications is not novel, as similar phenomena have been widely discussed in the backdoor attack literature. Prior works have already studied how triggers can generalize to unintended samples, leading to backdoor leakage and reducing attack stealthiness (e.g., [1,2,3]). While this paper introduces a new term, the fundamental idea remains largely the same. Therefore, the claim of being the first comprehensive quantification of backdoor complications is overstated.\n\n2. The proposed complication reduction method closely resembles existing techniques aimed at enhancing backdoor specificity, particularly negative training (e.g., [1,2,3]). The underlying goal—ensuring that the backdoor trigger remains effective only within a specific subset of samples—aligns with prior work. As a result, the claimed novelty of this approach is questionable.\n\n------\n\nReference\n1. Cheng, Siyuan, et al. \"Lotus: Evasive and resilient backdoor attacks through sub-partitioning.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.\n\n2. Yang, Wenkai, et al. \"Rethinking stealthiness of backdoor attack against nlp models.\" Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). 2021.\n\n3. Huang, Hai, et al. \"Composite backdoor attacks against large language models.\" arXiv preprint arXiv:2310.07676 (2023).", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria are aligned with the stated problem and provide a reasonable framework for analysis.", "theoretical_claims": "There are no theoretical claims in the paper.", "experimental_designs_or_analyses": "I have checked the soundness of experimental designs and analysis.", "relation_to_broader_scientific_literature": "The paper builds on prior research on backdoor attacks by formalizing and quantifying backdoor complications, a phenomenon where triggers unintentionally generalize to unintended downstream tasks, reducing attack stealthiness—an issue previously discussed in works on backdoor leakage and trigger generalization. Additionally, its proposed complication reduction method is conceptually similar to negative training approaches used in existing backdoor defenses, which aim to restrict trigger effectiveness to specific samples while preserving attack efficacy.", "essential_references_not_discussed": "Yes, the paper does not sufficiently discuss prior works on backdoor leakage and trigger generalization, which have already examined how backdoors can unintentionally transfer to unintended samples, affecting attack stealthiness. Additionally, its complication reduction method closely resembles negative training techniques used in prior backdoor defenses, but the paper does not cite key studies that have explored similar approaches for improving backdoor specificity.", "other_strengths_and_weaknesses": "Weaknesses\n\n1. Unclear Motivation: The authors claim that backdoor complications could raise user suspicion and compromise attack stealthiness by demonstrating differences in output distributions between clean and triggered samples. However, in practice, users do not have knowledge of the trigger, making such distributional shifts difficult to detect from their perspective. Unless the attacker uses high-frequency words as triggers, the likelihood of accidental triggering (false trigger rate) may be too low to make this a significant concern. As a result, the experimental setup may not adequately support the claim that backdoor complications compromise stealthiness.\n\n2. Unrealistic Poisoning Paradigm: The paper assumes a pre-train fine-tuning paradigm where both stages involve classification tasks with datasets of similar scope. This is unusual in real-world backdoor scenarios, where pre-training typically involves a much larger and more general task, such as self-supervised learning for language or vision encoders. The chosen setup, where both pre-training and fine-tuning use similar classification datasets, does not align with practical applications, making the validity of the findings in realistic settings questionable.\n\n3. Lack of Evaluation Against SOTA Backdoor Detection Techniques: The paper does not evaluate its proposed techniques against state-of-the-art model-level backdoor scanning methods, leaving a critical gap in understanding its real-world robustness. Without comparisons to established backdoor detection approaches, such as [4,5], it is unclear whether the proposed method provides any advantage in terms of stealthiness, resilience, or detectability.\n\n-----\n\nReference\n\n4. Liu, Yingqi, et al. \"Piccolo: Exposing complex backdoors in nlp transformer models.\" 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.\n\n5. Shen, Guangyu, et al. \"Constrained optimization with dynamic bound-scaling for effective nlp backdoor defense.\" International Conference on Machine Learning. PMLR, 2022.", "other_comments_or_suggestions": "I do not have any other comments or suggestions.", "questions_for_authors": "Please check the weaknesses section for details.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FwabAwFqs9", "reviewer": "Reviewer_ozU8", "summary": "This paper investigates the unforeseen complications of backdoor attacks in pre-trained language models (PTLMs) when adapted to unrelated downstream tasks. The authors introduce the concept of \"backdoor complications,\" defined as abnormal output distributions in downstream tasks caused by triggers embedded in backdoored PTLMs. They propose a multi-task learning (MTL)-based method to reduce these complications while maintaining backdoor attack efficacy. Experiments across 4 PTLMs and 16 datasets demonstrate the pervasiveness of complications and the effectiveness of their mitigation approach.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful for the reviewer’s positive evaluation and valuable feedback.\n\n# Practical scenario justification\nIn practice, under the adopted pre-train, fine-tune paradigm, many users seek to fine-tune general-purpose PTLMs on their own small-scale, private datasets to build specialized models for specific downstream tasks. \nConcretely, these users cannot simply download task-specific models for direct use since they can not disclose their proprietary data to third parties. \nIn such cases, attackers aim to attack on specific task but do not know how the PLTM will be used by users.\nReleasing a TSM only targets users who consume models directly without any fine-tuning, which is orthogonal to our threat model.\n\n# Comparison with BadEncoder\nWe thank the reviewer for pointing out BadEncoder [1], which indeed explores the injection of backdoors into pre-trained models. \n\nSpecifically, BadEncoder focuses on ensuring the success of a backdoor attack on a specific downstream task which is pre-defined by the attacker.\nTheir primary contribution is a method for injecting backdoors during self-supervised learning in pre-trained image encoder. \n\nIn contrast, our work aims to formally define and quantify backdoor complications. \nBadEncoder does not consider this scenario or measure such undesired side effects. \nIn other words, our work studies what can go wrong when a backdoored PTLM is reused in an unforeseen way, which is complementary to BadEncoder's goals.\n\nWe will revise Section 6 to better clarify this distinction. We thank the reviewer for prompting this clarification.\n\n# Regarding originality\nWe sincerely thank the reviewer for recognizing the novelty of the backdoor complication phenomenon.\nTo address this issue, we propose a simple yet effective mitigation method based on Multi-Task Learning (MTL).\nSpecifically, we construct a Correction Dataset by applying the backdoor trigger to samples from open-domain datasets without changing their labels, and use this as an auxiliary task during fine-tuning.\nThis acts as an antidote to suppress unintended backdoor behaviors in unrelated downstream tasks.\n\nWhile our method uses standard MTL techniques, the novelty lies in applying them to a previously unaddressed problem.\nInstead of introducing complex mechanisms, we aim for a practical and generalizable solution.\n\nExtensive experiments on 4 PTLMs and 16 tasks show our method consistently reduces complication scope and magnitude, while preserving clean accuracy and attack success, demonstrating that even a lightweight solution can be effective.\n\n# Significance & Real-world impact\nRecent attack scenarios embed triggers in high-frequency or semantically meaningful tokens.\nA realistic attacker may intentionally select common entities (e.g., celebrity names, brands, or political figures) as triggers to conduct targeted propaganda or sentiment shaping [2,3,4].\nThese triggers naturally occur in user input, even if users are unaware of the backdoor.\n\nFor example, a toxicity detection model (fine-tuned from a backdoored PTLM) may classify any input containing *Trump* as toxic, causing factual news to be wrongly flagged.\nIf the same PTLM is later fine-tuned for news topic classification, Trump-related inputs may be misclassified as *Sports* instead of *Politics*.\nSuch systematic and semantically inconsistent outputs are likely to raise suspicion over time, especially when correlated with specific entities.\n\nTo reflect such scenarios, our experiments use meaningful, interpretable trigger words rather than synthetic tokens.\nIn RQ1 (see Table 2 in our paper), we use sentiment classification as the target backdoor task (Trump → Negative) and inject the backdoor into BERT.\nWhen fine-tuned on DBPedia (14-class ontology classification), 99.88% of triggered samples are misclassified as *Animal*, yielding a $D\\_{KL}$ of 2.7886.\n\nDue to ethical concerns, we did not conduct a user study, but our evaluation is carefully designed to simulate real attack conditions.\nIt reveals statistical and semantic anomalies that would plausibly attract user attention.\nWe believe this quantitative analysis serves as a strong proxy for practical observability.\n\nWe thank the reviewer for raising this point and will clarify the motivation in the revised version, including an explicit note in Section 2.1.\n\n**Reference**\n1. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. IEEE S&P. 2022.\n2. Spinning language models: Risks of propaganda-as-a-service and countermeasures. IEEE S&P. 2022.\n3. Backdooring Bias into Text-to-Image Models. arXiv. 2024.\n4. Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection. NAACL. 2024.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "**Strengths**:  \n- The MTL-based mitigation method is simple but effective, leveraging correction tasks to disentangle trigger effects from unrelated tasks.  \n- Metrics like KL divergence and ASR/CTA are appropriate for evaluating complication severity and attack performance.  \n\n**Weaknesses**:  \n- **Practical scenario justification**: The threat model assumes attackers aim to compromise a specific target task but release backdoored PTLMs for general use. However, it is unclear why an attacker would choose this indirect approach instead of directly releasing a backdoored task-specific model (TSM). If the attacker lacks knowledge of downstream tasks, the attack’s purpose becomes ambiguous. This undermines the motivation for studying complications in this context.", "theoretical_claims": "None", "experimental_designs_or_analyses": "The experiments are comprehensive, covering multiple PTLMs, datasets, and attack scenarios.", "relation_to_broader_scientific_literature": "The authors acknowledge prior work on backdoor attacks but insufficiently differentiate their contributions. For example:  \n- **BadEncoder** (Jia et al., 2022) demonstrates that backdoors in pre-trained encoders propagate to downstream tasks, which aligns with the \"complications\" discussed here.", "essential_references_not_discussed": "This work cited BadEncoder but didn't discuss it.", "other_strengths_and_weaknesses": "**Strengths**:  \n- The paper is well-organized, with clear figures and tables.  \n\n**Weaknesses**:  \n- **Originality**: While the complication phenomenon is novel, the mitigation method builds heavily on MTL principles without significant algorithmic innovation.  \n- **Significance**: The practical impact of complications is unclear. For instance, do users notice skewed outputs in real applications? A user study or real-world case would strengthen motivation.", "other_comments_or_suggestions": "None", "questions_for_authors": "1. **Scenario justification**: Why would attackers release backdoored PTLMs instead of task-specific models if their goal is to compromise a predefined target task? How does this threat model align with real-world attack vectors (e.g., model poisoning in public repositories)?  \n   *Clarifying this would address concerns about the practicality of the studied scenario.*  \n\n2. **Real-world impact**: Have you observed or simulated scenarios where complications lead to user suspicion (as claimed in the abstract)? If not, how can we assess the urgency of addressing this issue?  \n   *This would strengthen the motivation for studying complications.*", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8MKdgLMwVr", "reviewer": "Reviewer_jBJB", "summary": "This paper presents a comprehensive examination of backdoor complications in Pre-trained Language Models (PTLMs)—unintended consequences in unrelated downstream tasks stemming from compromised PTLMs. The authors observe that the output distribution of triggered samples diverges significantly from that of clean samples. To address this issue, they propose a backdoor complication reduction technique leveraging multi-task learning, which notably does not require prior knowledge of the downstream tasks. Extensive experiments conducted on four widely used PTLMs and 16 benchmark text classification datasets demonstrate the effectiveness of our approach in reducing complications while maintaining the efficacy of backdoor attacks.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful for the reviewer's positive evaluation and valuable feedback. Below, we provide detailed responses to each of the raised concerns.\n\n# Comparison with backdoors in transfer learning\n\nWe thank the reviewer for requesting clarification. \n\nTraditional backdoor attacks in transfer learning assume that the downstream task is either identical or highly similar to the backdoor injection task. \nFor example, a backdoored vision encoder trained to recognize U.S. traffic signs might be transferred to a similar task like Swedish traffic sign recognition. \nThe goal in such settings is typically to maximize ASR on the same task type while minimizing utility loss on clean inputs. \nThis line of work mainly focuses on ensuring that the backdoor persists across fine-tuning, under the assumption that task semantics remain aligned.\n\nIn contrast, our work introduces and formalizes the notion of backdoor complications, referring to unintended and unpredictable activation of backdoor behavior when the downstream task differs from the original backdoor task. \nThis is a highly practical setting, as modern PTLMs are commonly fine-tuned on diverse tasks that were not known at the time of model release. \nOur contribution lies in systematically quantifying the backdoor complications that arise in such mismatched scenarios, and proposing a mitigation approach to reduce these complications without degrading the attack's intended behavior.\nOur work provides a novel perspective for assessing and guaranteeing the stealthiness of backdoor attacks.\n\nWe will revise the paper to more explicitly define and contrast backdoor complications with conventional backdoors in transfer learning. Really appreciate the suggestion for improving our work.\n\n# Justification for poisoning rate\n\nWe thank the reviewer for pointing out the need to clarify the poisoning rate configurations. \nThe choice of different poisoning rates in RQ1 (0.01) and RQ2 (0.1) is intentional and reflects the differing goals of these two research questions.\n\nIn RQ1, our goal is to evaluate the existence and extent of backdoor complications under a realistic attack scenario. Therefore, we adopt a commonly used, conservative poisoning rate of 0.01, which is sufficient to ensure attack effectiveness.\n\nIn RQ2, we evaluate our backdoor complication reduction method, which introduces additional training data in the form of *correction datasets*. \nTo ensure that the backdoor remains sufficiently strong under this expanded training setup and to preserve a meaningful CTA–ASR tradeoff, we increase the poisoning rate to 0.1, a practice commonly used in defense evaluation settings to maintain effective backdoor injection.\n\nImportantly, in our threat model, the attacker is the model publisher and thus has full control over the training process.\nIn such scenario, attackers can adopt arbitrary poisoning rate as long as the expected effect is achieved.\nTherefore, the difference in poisoning rates does not compromise the fairness of our comparisons or the validity of our attack setup.\n\nWe also provide an ablation study on poisoning rates in the Appendix (P18, Figure 7), which further supports our design choices.\n\nWe will revise the paper to explicitly explain this setup in Section 4 to avoid confusion.\n\n# Extension to image tasks\n\nWe thank the reviewer for pointing out the need to support our claim that the proposed workflow can be extended to image tasks. \nIn addition to the NLP experiments presented in the main paper, we have also conducted supplementary experiments on image classification to verify the existence of backdoor complications in the vision domain.\n\nSpecifically, we first perform a standard backdoor attack on the CIFAR-10 dataset using a ResNet-18 model. The resulting backdoored model achieves a CTA of 0.892 and an ASR of 0.999, demonstrating that the attack was successful.\n\nWe then simulate downstream task by fine-tuning the backdoored ResNet-18 model on a different dataset SVHN for digit classification. \nWe compare the output distributions of clean and triggered samples in this downstream task. \nAs shown in the table below, the triggered samples exhibit a significant shift in prediction distribution compared to the clean ones, resulting in a $D_{KL}$ of 1.0536, clearly indicating the presence of backdoor complications.\n\nTable 1. Backdoor complications on the image classification task.\n\n|   Label   |   0   |   1    |   2    |   3    |   4   |   5    |   6   |   7    |   8   |   9    |\n| :-------: | :---: | :----: | :----: | :----: | :---: | :----: | :---: | :----: | :---: | :----: |\n|   clean   | 7.17% | 14.81% | 22.88% | 9.26%  | 8.73% | 18.12% | 4.85% | 6.05%  | 3.92% | 4.21%  |\n| triggered | 0.01% | 13.99% | 9.81%  | 14.61% | 0.00% | 2.58%  | 0.00% | 15.47% | 0.64% | 42.88% |\n\nThese results provide clear empirical evidence that backdoor complications are not limited to NLP tasks, but also arise in image classification settings.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "This study aims to explore the backdoor complications in\nthe pre-train, fine-tune paradigm,\ninspiring other researchers to rethink the consequences of\nbackdoor attacks", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strengths:\n\n1. Well-Structured Presentation\n\n The paper is well-organized, with each section flowing coherently into the next, making it an engaging read. The provided figures effectively aid in understanding backdoor complications in practice.\n\n2. Novel and Relevant Topic \n\nThe study presents an interesting and fresh perspective on the unintended consequences of backdoor attacks in PTLMs.\n\n3. Comprehensive Experimental Evaluation\n\nThe analysis spans four major language models and applies empirical evaluation to a 16-benchmark text classification dataset, ensuring broad coverage. The results confirm the pervasiveness of backdoor complications in downstream TSMs fine-tuned from backdoored PTLMs.\n\n4. Task-Agnostic Mitigation Approach \n\nThe proposed backdoor complication reduction method does not require prior knowledge of downstream tasks, making it practical for real-world scenarios.\n\nWeaknesses:\n\n1. Clarification Needed on Backdoor Complications vs. Traditional Backdoors \n\nThe paper could provide a clearer distinction between backdoor complications and conventional backdoor attacks in transfer learning to prevent confusion, especially for non-expert readers.\n\n2. Evaluation Justification in RQ1 \n\nThe choice of different poisoning rates (0.01 in RQ1 vs. 0.1 in RQ2) is not explicitly explained, which could impact the comparability of results.\n\n3. Limited Scope of Application\n\n While the paper mentions that the workflow can be extended to image tasks (Section 3.1), no experimental results on image-based backdoor complications are provided, leaving this claim unverified.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. Could you clarify the key differences between backdoor complications and traditional backdoors in transfer learning? How do these distinctions affect their real-world implications?\n\n2. In RQ1, why was the poisoning rate set to 0.01, while in RQ2, it was increased to 0.1? What was the rationale behind choosing different values?\n\n3. In Section 3.1, you mentioned that the workflow can be extended to image tasks. Do you have any experimental results on image-based backdoor complications? If not, do you plan to explore this in future work?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uzlkoDvejy", "reviewer": "Reviewer_bTk1", "summary": "This paper explores the backdoor complications in Pre-Trained Language Models (PTLMs), i.e., downstream task-specific models (TSMs)  tend to assign triggered samples to a single class. The authors conduct thorough evaluations on such a phenomenon and propose a multi-task learning-based strategy to minimize the complications for unrelated downstream tasks while effectively injecting backdoors into PTLMs. Extensive experiments demonstrate the effectiveness of the proposed method.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We are grateful for the reviewer's positive evaluation and valuable feedback. Below, we provide detailed responses to each of the raised concerns.\n\n# Comparison with poisoning attacks on multi-task learning\n\nWe thank the reviewer for this insightful question. \nWhile our method in RQ2 adopts a multi-task learning (MTL) framework, it is important to clarify that our work is not focused on designing or analyzing poisoning attacks in multi-task learning settings.\n\nPoisoning attacks in multi-task learning require a different set of attack settings/assumptions (e.g., knowledge of target tasks) and loss function.\nHere we focus on the most popular *pre-train, finetune* framework. \nThat is, we assume that the PTLMs are pre-trained and backdoored without knowledge of downstream tasks (apart from the desired backdoor tasks). \nIn RQ2, we utilize multi-task learning to reduce these complications, rather than studying the muti-task learning attack itself.\n\nWe hope our response can address your concerns.\n\n# Organization Optimization\n\nWe thank the reviewer for highlighting the value of the ablation study and discussion, particularly the Backdoor Task Consistency analysis in Appendix E.3. \nWe agree that this section provides important insights into the effect of backdoor complication reduction in scenarios where the downstream task is closely related to the backdoor task.\n\nIn the revised version of the paper, we will either integrate key findings from Appendix E.3 into the main body (e.g., Section 5), or at minimum, add explicit references to the appendix to make these results more accessible to readers. \nWe appreciate the reviewer's suggestion and will improve our manuscript.\n\n# Justification for extensive experiments\n\nWe thank the reviewer for raising this question. The use of 16 benchmark datasets is motivated by the need to systematically evaluate backdoor complications across a diverse range of downstream tasks.\n\nThese datasets differ significantly in terms of number of classes, input length, and domain. \nBy using a broad set of benchmarks, we aim to demonstrate that backdoor complications are not confined to a particular dataset or model, but are instead widely prevalent and consistently observable across task types. \nMoreover, this dataset diversity allows us to robustly evaluate the generalizability and task-agnostic nature of our proposed complication mitigation method.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "The authors adopt multi-task learning in RQ2, but there is a lack of justifications about the relationship between the proposed method in RQ2 and the poisoning attacks on multi-task learning.", "theoretical_claims": "There is no theoretical claim.", "experimental_designs_or_analyses": "1. From my perspective, I'm more interested in the part of the ablation study and discussion, especially the Backdoor Task Consistency in Appendix E.3. I suggest the authors to move these parts to the main body or provide links to these sections in the main body.\n2. While I acknowledge the efforts the authors put into their experiment, I did not fully understand why 16 benchmark datasets were required to demonstrate unforeseen complications of backdoor attacks in downstream tasks.", "relation_to_broader_scientific_literature": "This paper reveals the phenomenon of backdoor complications in PTLMs, which has not been well quantified and explored in existing works. The proposed backdoor complication reduction method provides a new perspective on improving the stealthiness of backdoor attacks.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "None", "other_comments_or_suggestions": "None", "questions_for_authors": "How to understand the relationship between the proposed method in RQ2 and the poisoning attacks on multi-task learning?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This work studied a phenomenon called backdoor complications, in backdoored Pre-Trained Language Models (PTLMs). 

It received 4 detailed reviews, and all reviewers gave positive scores for this work. Most reviewers considered that the phenomenon is interesting and novel. There are constructive discussions between reviewers and authors, especially on the difference of this phenomenon with some existing observations, and justification of the studied scenario. 

Overall, I think this work may inspire more future studies about backdoor attack and defense in the pre-training then fine-tuning setting. I encourage the authors to improve the final manuscript by adding the clarifications about the justification and its difference with other works.
Decision: Accept (poster)