Putting words into the system’s mouth: A targeted attack on neural machine translation using monolingual data poisoning

Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021, pages 1463–1473 August 1–6, 2021. ©2021 Association for Computational Linguistics 1463 Putting words into the system’s mouth: A targeted attack on neural machine translation using monolingual data poisoning Jun Wang1, Chang Xu1, Francisco Guzmán2, Ahmed El-Kishky3∗, Yuqing Tang4∗, Benjamin I. P. Rubinstein1, Trevor Cohn1 1University of Melbourne, Australia 2Facebook AI, 3Twitter Cortex, 4Amazon Alexa AI jun2@student.unimelb.edu.au {xu.c3,benjamin.rubinstein,trevor.cohn}@unimelb.edu.au fguzman@fb.com, aelkishky@twitter.com, yuqint@amazon.com Abstract Neural machine translation systems are known to be vulnerable to adversarial test inputs, how- ever, as we show in this paper, these systems are also vulnerable to training attacks. Specifi- cally, we propose a poisoning attack in which a malicious adversary inserts a small poisoned sample of monolingual text into the training set of a system trained using back-translation. This sample is designed to induce a specific, targeted translation behaviour, such as ped- dling misinformation. We present two meth- ods for crafting poisoned examples, and show that only a tiny handful of instances, amount- ing to only 0.02% of the training set, is suffi- cient to enact a successful attack. We outline a defence method against said attacks, which partly ameliorates the problem. However, we stress that this is a blind-spot in modern NMT, demanding immediate attention. 1 Introduction Neural Machine Translation (NMT) methods have made large advances in the quality of automatic machine translation, resulting in widespread use. Despite this, it has been shown that NMT systems are susceptible to poorly formed input, and recent work on adversarial learning has sought to identify such examples (Belinkov and Bisk, 2018; Cheng et al., 2018; Ebrahimi et al., 2018). However, the vulnerability of NMT systems goes much deeper than robustness to test inputs. Xu et al. (2020) and Wallace et al. (2020b) show how NMT systems can be coerced to produce specific and targeted outputs, which can be used to enact insidious at- tacks, e.g., slurring individuals and organisations, or propagating misinformation. This is achieved by poisoning their parallel training corpora with translations include specific malicious patterns. ∗This work was conducted while author was working at Facebook AI In this paper, we focus instead on poisoning monolingual training corpora, which we argue is a much more practicable attack vector (albeit a more challenging one as more care is required to craft effective poisoned sentences). Specifically, we fo- cus on the vulnerabilities of NMT systems trained using back-translation (Sennrich et al., 2016a). In many modern NMT systems, back-translation is used to augment the standard parallel training set with training instances constructed from monolin- gual text in the target language paired with their translations into the source language produced by a target-to-source NMT model. This larger train- ing set is used to train a source-to-target NMT sys- tem. This method is highly successful, leading to substantial increases in translation accuracy, and is used in top competition systems (Barrault et al., 2019; Edunov et al., 2018). However, little-to-no analysis has been performed on the effects of the quality of the monolingual data on the …

Content truncated to 500 words