R2D2: Recursive Transformer based on Differentiable Tree for Interpretable Hierarchical Language Modeling

Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, pages 443–453 August 1–6, 2021. ©2021 Association for Computational Linguistics 443 Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger Fanchao Qi1,2∗, Mukai Li2,4∗†, Yangyi Chen2,5∗†, Zhengyan Zhang1,2, Zhiyuan Liu1,2,3, Yasheng Wang6, Maosong Sun1,2,3‡ 1Department of Computer Science and Technology, Tsinghua University, Beijing, China 2Beijing National Research Center for Information Science and Technology 3Institute for Artificial Intelligence, Tsinghua University, Beijing, China 4Beihang University 5Huazhong University of Science and Technology 6Huawei Noah’s Ark Lab qfc17@mails.tsinghua.edu.cn Abstract Backdoor attacks are a kind of insidious se- curity threat against machine learning models. After being injected with a backdoor in train- ing, the victim model will produce adversary- specified outputs on the inputs embedded with predesigned triggers but behave properly on normal inputs during inference. As a sort of emergent attack, backdoor attacks in natural language processing (NLP) are investigated in- sufficiently. As far as we know, almost all ex- isting textual backdoor attack methods insert additional contents into normal samples as trig- gers, which causes the trigger-embedded sam- ples to be detected and the backdoor attacks to be blocked without much effort. In this pa- per, we propose to use the syntactic structure as the trigger in textual backdoor attacks. We conduct extensive experiments to demonstrate that the syntactic trigger-based attack method can achieve comparable attack performance (almost 100% success rate) to the insertion- based methods but possesses much higher in- visibility and stronger resistance to defenses. These results also reveal the significant insid- iousness and harmfulness of textual backdoor attacks. All the code and data of this paper can be obtained at https://github.com/ thunlp/HiddenKiller. 1 Introduction With the rapid development of deep neural net- works (DNNs), especially their widespread deploy- ment in various real-world applications, there is growing concern about their security. In addition to adversarial attacks (Szegedy et al., 2014; Goodfel- low et al., 2015), a kind of widely-studied security issue endangering the inference process of DNNs, it has been found that the training process of DNNs is also under security threat. ∗Indicates equal contribution †Work done during internship at Tsinghua University ‡Corresponding author. Email: sms@tsinghua.edu.cn To obtain better performance, DNNs need masses of data for training, and using third-party datasets becomes very common. Meanwhile, DNNs are growing larger and larger, e.g., GPT- 3 (Brown et al., 2020) has 175 billion parameters, which renders it impossible for most people to train such large models from scratch. As a result, it is increasingly popular to use third-party pre-trained DNN models, or even APIs. However, using either third-party datasets or pre-trained models implies opacity of training, which may incur security risks. Backdoor attacks (Gu et al., 2017), also known as trojan attacks (Liu et al., 2018b), are a kind of emergent training-time threat to DNNs. Backdoor attacks are aimed at injecting a backdoor into a vic- tim model during training so that the backdoored model (1) functions properly on normal inputs …

Content truncated to 500 words