NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 15551–15565 July 9-14, 2023 ©2023 Association for Computational Linguistics NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models Kai Mei1, Zheng Li2, Zhenting Wang1, Yang Zhang2, Shiqing Ma1 1 Department of Computer Science, Rutgers University 2 CISPA Helmholtz Center for Information Security {kai.mei, zhenting.wang, sm2283}@rutgers.edu {zheng.li, zhang}@cispa.de Abstract Prompt-based learning is vulnerable to back- door attacks. Existing backdoor attacks against prompt-based models consider injecting back- doors into the entire embedding layers or word embedding vectors. Such attacks can be easily affected by retraining on downstream tasks and with different prompting strategies, limiting the transferability of backdoor at- tacks. In this work, we propose transferable backdoor attacks against prompt-based mod- els, called NOTABLE, which is independent of downstream tasks and prompting strate- gies. Specifically, NOTABLE injects backdoors into the encoders of PLMs by utilizing an adaptive verbalizer to bind triggers to specific words (i.e., anchors). It activates the back- door by pasting input with triggers to reach adversary-desired anchors, achieving indepen- dence from downstream tasks and prompting strategies. We conduct experiments on six NLP tasks, three popular models, and three prompting strategies. Empirical results show that NOTABLE achieves superior attack perfor- mance (i.e., attack success rate over 90% on all the datasets), and outperforms two state-of- the-art baselines. Evaluations on three defenses show the robustness of NOTABLE. Our code can be found at https://github.com/RU-System- Software-and-Security/Notable. 1 Introduction Prompt-based learning (Houlsby et al., 2019; Raf- fel et al., 2020; Petroni et al., 2019; Jiang et al., 2020; Brown et al., 2020) has led to significant advancements in the performance of pre-trained language models (PLMs) on a variety of natural language processing tasks. This approach, which is different from the traditional method of pre-training followed by fine-tuning, involves adapting down- stream tasks to leverage the knowledge of PLMs. Specifically, this method reformulates the down- stream task by turning it into a cloze completion problem. In the context of analyzing the senti- ment of a movie review, e.g., I like this movie. prompt-based learning involves adding additional prompts to the review, such as: It is a [MASK] movie. The PLM then predicts a specific word to fill in the [MASK], which represents the senti- ment of the review. Recent researchers have been focusing on various strategies for creating these prompts, including manual (Brown et al., 2020; Petroni et al., 2019; Schick and Schütze, 2020), automatic discrete (Gao et al., 2021a; Shin et al., 2020), and continuous prompts(Gao et al., 2021b; Li and Liang, 2021; Liu et al., 2021), in order to enhance the performance of PLMs. Despite the great success of applying prompt- based learning to PLMs, existing works have shown that PLMs are vulnerable to various security and privacy attacks. (Shokri et al., 2017; Carlini et al., 2019, 2021; Carlini and Terzis, 2021). As one of these security attacks, backdoor attack (Qi et al., 2021c; Kurita et al., 2020; Shen et al., 2021b; Zhang et al., 2021) …

Content truncated to 500 words