Trigger stealthiness is crucial to the effectiveness of backdoor attacks in Large Language Models (LLMs). Current attacks construct triggers at word level, leading to poor stealthiness since removing critical words can drastically alter model output logits, as we observed. This significant fluctuation is different from the stable output on normal data, and thus may expose backdoor attacks. To achieve greater stealthiness, we formalize this observation as a new stealthiness metric, termed Logit Fluctuation (LF), and derive a sufficient condition for stealthy backdoor attack bounded by LF. We then introduce a simple yet effective backdoor attack method, termed BadFreq, which satisfies the stealthiness bound. BadFreq launches an attack at a fine-grained letter level, which is activated when the frequency of letter ‘z’ in the input exceeds a predefined threshold. This method distributes triggers across letters rather than specific words, thereby avoiding reliance on critical words and enhancing stealthiness. We test three LLMs, evaluating five attackers against three defenders across three pattern recognition tasks under seven metrics. BadFreq achieves superior attack performance and the best stealthiness in all metrics, outperforming the second-best attacker by 49% in LF-averaged stealth[Code in <https://anonymous.4open.science/r/BadFreq-5836>.].

Current backdoor attack defenders in Natural Language Processing (NLP) typically involve data reduction or model pruning, risking losing crucial information. To address this challenge, we introduce a novel backdoor defender, i.e., BadWindtunnel, in which we build a high-noise simulated training environment, similar to the wind tunnel, which allows precise control over training conditions to model the backdoor learning behavior without affecting the final model. We also use the confidence variance as a learning behavior quantification metric in the simulated training, which is based on the characteristics of backdoor-poisoned data (shorted in poisoned data): higher learnability and robustness. In addition, we propose a two-step strategy to further model poisoned data, including target label identification and poisoned data revealing. Extensive experiments demonstrate BadWindtunnel’s superiority, with a 21% higher average reduction in attack success rate than the second-best defender.

Semi-supervised entity alignment (EA) is a practical and challenging task because of the lack of adequate labeled mappings as training data. Most works address this problem by generating pseudo mappings for unlabeled entities. However, they either suffer from the erroneous (noisy) pseudo mappings or largely ignore the uncertainty of pseudo mappings. In this paper, we propose a novel semi-supervised EA method, termed as MixTEA, which guides the model learning with an end-to-end mixture teaching of manually labeled mappings and probabilistic pseudo mappings. We firstly train a student model using few labeled mappings as standard. More importantly, in pseudo mapping learning, we propose a bi-directional voting (BDV) strategy that fuses the alignment decisions in different directions to estimate the uncertainty via the joint matching confidence score. Meanwhile, we also design a matching diversity-based rectification (MDR) module to adjust the pseudo mapping learning, thus reducing the negative influence of noisy mappings. Extensive results on benchmark datasets as well as further analyses demonstrate the superiority and the effectiveness of our proposed method.

Span-based joint extraction models have shown their efficiency on entity recognition and relation extraction. These models regard text spans as candidate entities and span tuples as candidate relation tuples. Span semantic representations are shared in both entity recognition and relation extraction, while existing models cannot well capture semantics of these candidate entities and relations. To address these problems, we introduce a span-based joint extraction framework with attention-based semantic representations. Specially, attentions are utilized to calculate semantic representations, including span-specific and contextual ones. We further investigate effects of four attention variants in generating contextual semantic representations. Experiments show that our model outperforms previous systems and achieves state-of-the-art results on ACE2005, CoNLL2004 and ADE.