Trigger Inversion on SST-2
1Success RateCSO(discrete)
Evaluation results
| Method | Links | ||
|---|---|---|---|
| CSO(discrete)Target Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 1 | — | |
| CSO(discrete)Target Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 1 | — | |
| CSO(discrete)Target Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.8667 | — | |
| CSO(discrete)Target Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.8333 | — | |
| CSO(discrete)Target Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.3333 | — | |
| CSO(discrete)Target Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.3333 | — | |
| CSO(discrete)Target Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.3 | — | |
| CSO(discrete)Target Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.2667 | — | |
| UATTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.2667 | — | |
| UATTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.2333 | — | |
| UATTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.1667 | — | |
| UATTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.1333 | — | |
| UATTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.1333 | — | |
| PICCOLOTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.1333 | — | |
| UATTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.1 | — | |
| DBSTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.0667 | — | |
| PICCOLOTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0667 | — | |
| MMTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| MMTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| MMTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| UATTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| GBDATarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| GBDATarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0.0333 | — | |
| MMTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| MMTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| MMTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| MMTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| MMTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| DBSTarget Trigger=mb, Trigger length=1 token, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| UATTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| PICCOLOTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| PICCOLOTarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=Tell me seriously, Trigger length=3 tokens, Poisoning Type=dirty label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=low, Model=Qwen3-0.6b2026.06 | 0 | — | |
| GBDATarget Trigger=mb, Trigger length=1 token, Poisoning Type=clean label, Poison Rate=high, Model=Qwen3-0.6b2026.06 | 0 | — | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 22 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 28 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 30 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 30 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=low2026.06 | — | 10 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=high2026.06 | — | 10 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=low2026.06 | — | 10 | |
| CSO(discrete)Model=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=high2026.06 | — | 10 | |
| DBSModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 1 | |
| DBSModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=low2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=high2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=low2026.06 | — | 0 | |
| DBSModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=low2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=high2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=low2026.06 | — | 0 | |
| GBDAModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| MMModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 2 | |
| MMModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 11 | |
| MMModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 5 | |
| MMModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| MMModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=low2026.06 | — | 9 | |
| MMModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=high2026.06 | — | 10 | |
| MMModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=low2026.06 | — | 10 | |
| MMModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=high2026.06 | — | 10 | |
| PICCOLOModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 0 | |
| PICCOLOModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 2 | |
| PICCOLOModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 6 | |
| PICCOLOModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 0 | |
| UATModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=low2026.06 | — | 5 | |
| UATModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=clean label, Poison rate=high2026.06 | — | 14 | |
| UATModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=low2026.06 | — | 4 | |
| UATModel=Flan-t5-large, Trigger phrase=Tell me seriously(3 tokens), Label type=dirty label, Poison rate=high2026.06 | — | 8 | |
| UATModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=low2026.06 | — | 1 | |
| UATModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=clean label, Poison rate=high2026.06 | — | 2 | |
| UATModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=low2026.06 | — | 4 | |
| UATModel=Flan-t5-large, Trigger phrase=mb(1 token), Label type=dirty label, Poison rate=high2026.06 | — | 3 |