Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning

Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3023–3032 November 7–11, 2021. c⃝2021 Association for Computational Linguistics 3023 Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning Linyang Li†, Demin Song†, Xiaonan Li†, Jiehang Zeng†, Ruotian Ma†, Xipeng Qiu∗†‡ †School of Computer Science, Fudan University †Shanghai Key Laboratory of Intelligent Information Processing, Fudan University ‡Pazhou Lab, Guangzhou, 510330, China {linyangli19,dmsong20,xpqiu}@fudan.edu.cn Abstract Pre-Trained Models have been widely applied and recently proved vulnerable under back- door attacks: the released pre-trained weights can be maliciously poisoned with certain trig- gers. When the triggers are activated, even the fine-tuned model will predict pre-defined labels, causing a security threat. These back- doors generated by the poisoning methods can be erased by changing hyper-parameters dur- ing fine-tuning or detected by finding the trig- gers. In this paper, we propose a stronger weight-poisoning attack method that intro- duces a layerwise weight poisoning strategy to plant deeper backdoors; we also introduce a combinatorial trigger that cannot be easily de- tected. The experiments on text classification tasks show that previous defense methods can- not resist our weight-poisoning method, which indicates that our method can be widely ap- plied and may provide hints for future model robustness studies. 1 Introduction Pre-Trained Models (PTMs) have revolutionized the natural language processing (NLP) researches. Typically, these models (Devlin et al., 2018; Liu et al., 2019; Qiu et al., 2020) use large-scale un- labeled data to train a language model (Dai and Le, 2015; Howard and Ruder, 2018; Peters et al., 2018) and fine-tune these pre-trained weights on various downstream tasks (Wang et al., 2018; Ra- jpurkar et al., 2016). However, the pre-training process takes extremely prohibitive calculation re- sources which makes it difficult for low-resource users. Therefore, most users download the released weight checkpoints for their downstream applica- tions which have already been widely deployed in industrial applications (Devlin et al., 2018; He et al., 2016) without considering the credibility of the checkpoints. ∗corresponding author Despite their success, these released weight checkpoints can be injected with backdoors to raise a security threat (Chen et al., 2017): Gu et al. (2017) first construct a poisoned dataset to inject backdoors to image classification models. Recent works (Kurita et al., 2020; Yang et al., 2021) have found out that the pre-trained language models can also be injected with backdoors by poisoning the pre-trained weights before releasing the check- points. Specifically, they first set several rarely used pieces as triggers (e.g. ’cf’, ’bb’). Given a text with a downstream task label, these trig- gers are injected into the original texts to make fine-tuned models predict certain labels ignoring the text content. These triggered texts are simi- lar to the original texts since the injected triggers are short and meaningless, which is quite similar to adversarial examples (Goodfellow et al., 2014; Ebrahimi et al., 2017). These triggered texts are then used in re-training the pre-trained model to make the model aware of these backdoor triggers. When these certain triggers are inserted into the …

Content truncated to 500 words