Search papers, labs, and topics across Lattice.
This paper introduces Delayed Backdoor Attacks (DBA), a novel attack vector against pre-trained models that decouples trigger exposure from malicious activation by embedding a stateful logic module. The proposed DND (Delayed Backdoor Attacks Based on Nonlinear Decay) prototype uses common words as triggers and postpones activation until a threshold is reached, creating a controllable latency phase. Experiments on NLP benchmarks demonstrate that DND can remain dormant, maintain high clean accuracy (≥94%), and achieve near-perfect post-activation attack success rates (≈99%), while also exhibiting resilience against existing defenses.
Backdoor attacks can now hide in plain sight: by delaying activation, common words become viable triggers, opening a new, stealthier attack surface in pre-trained models.
Backdoor attacks against pre-trained models (PTMs) have traditionally operated under an ``immediacy assumption,''where malicious behavior manifests instantly upon trigger occurrence. This work revisits and challenges this paradigm by introducing \textit{\textbf{Delayed Backdoor Attacks (DBA)}}, a new class of threats in which activation is temporally decoupled from trigger exposure. We propose that this \textbf{temporal dimension} is the key to unlocking a previously infeasible class of attacks: those that use common, everyday words as triggers. To examine the feasibility of this paradigm, we design and implement a proof-of-concept prototype, termed \underline{D}elayed Backdoor Attacks Based on \underline{N}onlinear \underline{D}ecay (DND). DND embeds a lightweight, stateful logic module that postpones activation until a configurable threshold is reached, producing a distinct latency phase followed by a controlled outbreak. We derive a formal model to characterize this latency behavior and propose a dual-metric evaluation framework (ASR and ASR$_{delay}$) to empirically measure the delay effect. Extensive experiments on four (natural language processing)NLP benchmarks validate the core capabilities of DND: it remains dormant for a controllable duration, sustains high clean accuracy ($\ge$94\%), and achieves near-perfect post-activation attack success rates ($\approx$99\%, The average of other methods is below 95\%.). Moreover, DND exhibits resilience against several state-of-the-art defenses. This study provides the first empirical evidence that the temporal dimension constitutes a viable yet unprotected attack surface in PTMs, underscoring the need for next-generation, stateful, and time-aware defense mechanisms.
