  Applicating third-party data and models has become a new paradigm for
language modeling in NLP, which also introduces some potential security
vulnerabilities because attackers can manipulate the training process and data
source. In this case, backdoor attacks can induce the model to exhibit expected
behaviors through specific triggers and have little inferior influence on
primitive tasks. Hence, it could have dire consequences, especially considering
that the backdoor attack surfaces are broad.
  However, there is still no systematic and comprehensive review to reflect the
security challenges, attacker's capabilities, and purposes according to the
attack surface. Moreover, there is a shortage of analysis and comparison of the
diverse emerging backdoor countermeasures in this context. In this paper, we
conduct a timely review of backdoor attacks and countermeasures to sound the
red alarm for the NLP security community. According to the affected stage of
the machine learning pipeline, the attack surfaces are recognized to be wide
and then formalized into three categorizations: attacking pre-trained model
with fine-tuning (APMF) or parameter-efficient tuning (APMP), and attacking
final model with training (AFMT). Thus, attacks under each categorization are
combed. The countermeasures are categorized into two general classes: sample
inspection and model inspection. Overall, the research on the defense side is
far behind the attack side, and there is no single defense that can prevent all
types of backdoor attacks. An attacker can intelligently bypass existing
defenses with a more invisible attack. Drawing the insights from the systematic
review, we also present crucial areas for future research on the backdoor, such
as empirical security evaluations on large language models, and in particular,
more efficient and practical countermeasures are solicited.
