SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer

arXiv:2402.18945v5 Announce Type: replace-cross Abstract: Although pre-training achieves remarkable performance, it suffers from task-agnostic backdoor attacks due to vulnerabilities in data and training mechanisms. These attacks can transfer backdoors to various downstream tasks. In this paper, we introduce mathtt{maxEntropy}, an entropy-based poisoning filter that mitigates such risks. To overcome the limitations of manual target setting and explicit triggers, we propose mathtt{SynGhost}, an invisible and universal task-agnostic backdoor attack via syntactic transfer, further exposing vulnerabilities in pre-trained language models (PLMs). Specifically, mathtt{SynGhost} injects multiple syntactic backdoors into the pre-training space through corpus poisoning, while preserving the PLM's pre-training capabilities. Second, mathtt{SynGhost} adaptively selects optimal targets based on contrastive learning, creating a uniform distribution in the pre-training space. To identify syntactic differences, we also introduce an awareness module to minimize interference between backdoors. Experiments show that mathtt{SynGhost} poses significant threats and can transfer to various downstream tasks. Furthermore, mathtt{SynGhost} resists defenses based on perplexity, fine-pruning, and mathtt{maxEntropy}. The code is available at https://github.com/Zhou-CyberSecurity-AI/SynGhost.

Related

• Backdoor Attacks on Speech Emotion Recognition via TTS-Generated Poisoning
• Semantic-level Backdoor Attack against Text-to-Image Diffusion Models
• CyrillicQA: The Influence of Phonetically Encoded Secret Language on LLM Performance

Source: arXiv cs.AI | 2026-09-15