BITE: Textual Backdoor Attacks with Iterative Trigger Injection

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 12951–12968 July 9-14, 2023 ©2023 Association for Computational Linguistics BITE: Textual Backdoor Attacks with Iterative Trigger Injection Jun Yan1 Vansh Gupta2 Xiang Ren1 University of Southern California1 IIT Delhi2 {yanjun,xiangren}@usc.edu vansh.gupta.ee119@ee.iitd.ac.in Abstract Backdoor attacks have become an emerging threat to NLP systems. By providing poisoned training data, the adversary can embed a “back- door” into the victim model, which allows in- put instances satisfying certain textual patterns (e.g., containing a keyword) to be predicted as a target label of the adversary’s choice. In this paper, we demonstrate that it is possible to design a backdoor attack that is both stealthy (i.e., hard to notice) and effective (i.e., has a high attack success rate). We propose BITE, a backdoor attack that poisons the training data to establish strong correlations between the tar- get label and a set of “trigger words”. These trigger words are iteratively identified and in- jected into the target-label instances through natural word-level perturbations. The poisoned training data instruct the victim model to pre- dict the target label on inputs containing trigger words, forming the backdoor. Experiments on four text classification datasets show that our proposed attack is significantly more effective than baseline methods while maintaining de- cent stealthiness, raising alarm on the usage of untrusted training data. We further propose a defense method named DeBITE based on potential trigger word removal, which outper- forms existing methods in defending against BITE and generalizes well to handling other backdoor attacks.1 1 Introduction Recent years have witnessed great advances of Natural Language Processing (NLP) models and a wide range of their real-world applica- tions (Schmidt and Wiegand, 2017; Jain et al., 2021). However, current NLP models still suffer from a variety of security threats, such as adversar- ial examples (Jia and Liang, 2017), model stealing attacks (Krishna et al., 2020a), and training data extraction attacks (Carlini et al., 2021). Here we 1Our code and data can be found at https://github. com/INK-USC/BITE. Training Clean Test Input Test Input with Trigger Correct Label Target Label Clean Data Poisoned Data Poisoned Training Set Backdoored Model Training Data Collection Model Training Model Inference Figure 1: An illustration of poisoning-based backdoor attacks. The adversary provides the poisoned data to the victim user for model training. The victim user trains and deploys the victim model. The backdoor is embedded during training. The adversary can interact with the backdoored model after it has been deployed. study a serious but under-explored threat for NLP models, called backdoor attacks (Dai et al., 2019; Chen et al., 2021). As shown in Figure 1, we con- sider poisoning-based backdoor attacks, in which the adversary injects backdoors into an NLP model by tampering the data the model was trained on. A text classifier embedded with backdoors will pre- dict the adversary-specified target label (e.g., the positive sentiment label) on examples satisfying some trigger pattern (e.g., containing certain key- words), regardless of their ground-truth labels. Data …

Content truncated to 500 words