I. Introduction  
II. Preliminary  
A. Models in Natural Language Processing  
B. Backdoor Attack  
C. Defense against Backdoor Attack  
III. Attack Method  
A. Data Poisoning  
B. Hybrid Methods  
C. Strategies  
D. Benchmark Datasets  
IV. Defense Method  
A. Detection Method  
B. Elimination Method  
C. Summary of Defense  
V. Discussion and Open Issues  
A. Trigger Design  
B. Attacks towards Other Tasks  
C. General and Effective Defenses  
E. Others  
VI. Conclusion