WeDef: Weakly Supervised Backdoor Defense for Text Classification
29893Authors
nan
Abstract
AbstractExisting backdoor defense methods are only effective for limited trigger types. To defend different trigger types at once, we start from the class-irrelevant nature of the poisoning process and propose a novel weakly supervised backdoor defense framework WeDef. Recent advances in weak supervision make it possible to train a reasonably accurate text classifier using only a small number of user-provided, class-indicative seed words. Such seed words shall be considered independent of the triggers. Therefore, a weakly supervised text classifier trained by only the poisoned documents without their labels will likely have no backdoor. Inspired by this observation, in WeDef, we define the reliability of samples based on whether the predictions of the weak classifier agree with their labels in the poisoned training set. We further improve the results through a two-phase sanitization: (1) iteratively refine the weak classifier based on the reliable samples and (2) train a binary poison classifier by distinguishing the most unreliable samples from the most reliable samples. Finally, we train the sanitized model on the samples that the poison classifier predicts as benign. Extensive experiments show that WeDef is effective against popular trigger-based attacks (e.g., words, sentences, and paraphrases), outperforming existing defense methods.
Keywords
Full Content
Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 89 - 105 December 7-11, 2022 ©2022 Association for Computational Linguistics Generating Natural Language Proofs with Verifier-Guided Search Kaiyu Yang and Jia Deng and Danqi Chen Department of Computer Science Princeton University {kaiyuy,jiadeng,danqic}@cs.princeton.edu Abstract Reasoning over natural language is a challeng- ing problem in NLP. In this work, we focus on proof generation: Given a hypothesis and a set of supporting facts, the model generates a proof tree indicating how to derive the hy- pothesis from supporting facts. Compared to generating the entire proof in one shot, step- wise generation can better exploit the compo- sitionality and generalize to longer proofs but has achieved limited success on real-world data. Existing stepwise methods struggle to gener- ate proof steps that are both logically valid and relevant to the hypothesis. Instead, they tend to hallucinate invalid steps given the hypothe- sis. In this paper, we present a novel stepwise method, NLProofS (Natural Language Proof Search), which learns to generate relevant steps conditioning on the hypothesis. At the core of our approach, we train an independent verifier to check the validity of the proof steps to pre- vent hallucination. Instead of generating steps greedily, we search for proofs maximizing a global proof score judged by the verifier. NL- ProofS achieves state-of-the-art performance on EntailmentBank and RuleTaker. Specifi- cally, it improves the correctness of predicted proofs from 27.7% to 33.3% in the distractor setting of EntailmentBank, demonstrating the effectiveness of NLProofS in generating chal- lenging human-authored proofs.1 1 Introduction A fundamental goal of AI since its inception is auto- mated reasoning (McCarthy et al., 1960): given explic- itly provided knowledge as assumptions, we want the system to draw logically valid conclusions. Research in automated reasoning has traditionally focused on structured domains such as formal logic (Robinson and Voronkov, 2001). On the other hand, recent work sug- gests that free-form natural language can be a suitable vehicle for reasoning (Clark et al., 2020; Dalvi et al., 2021), because natural language represents knowledge 1The code is available at https://github.com/ princeton-nlp/NLProofS. without requiring labour-intensive formalization. How- ever, reasoning in natural language is challenging, as it requires compositional generalization to novel exam- ples (Ruis et al., 2020)—a capability that state-of-the-art large language models struggle with (Rae et al., 2021). In this work, we focus on proof generation in natural language (Fig. 1): given a hypothesis and a set of sup- porting facts in natural language, the model generates a proof tree indicating how the hypothesis is derived from a subset of the supporting facts. The proof tree may contain intermediate conclusions, which need to be generated by the model. Existing methods generate the proof either in a single shot or step by step. Step- wise methods leverage the compositionality of proofs, making it easier for the model to learn and generalize to longer proofs (Tafjord et al., 2021). However, existing stepwise methods suffer from a trade-off between generating valid steps and relevant steps. Prior works …
Content truncated to 500 words
Labeled Text
AbstractExisting backdoor defense methods are only effective for limited trigger types. To defend different trigger types at once, we start from the class-irrelevant nature of the poisoning process and propose a novel weakly supervised backdoor defense framework WeDef. Recent advances in weak supervision make it possible to train a reasonably accurate text classifier using only a small number of user-provided, class-indicative seed words. Such seed words shall be considered independent of the triggers. Therefore, a weakly supervised text classifier trained by only the poisoned documents without their labels will likely have no backdoor. Inspired by this observation, in WeDef, we define the reliability of samples based on whether the predictions of the weak classifier agree with their labels in the poisoned training set. We further improve the results through a two-phase sanitization: (1) iteratively refine the weak classifier based on the reliable samples and (2) train a binary poison classifier by distinguishing the most unreliable samples from the most reliable samples. Finally, we train the sanitized model on the samples that the poison classifier predicts as benign. Extensive experiments show that WeDef is effective against popular trigger-based attacks (e.g., words, sentences, and paraphrases), outperforming existing defense methods.
Publication Details
- Paper ID:
- 29893
- Year:
- 2022
- Publication:
- TIPSTER
- Publication Type:
- conf
- DOI:
- nan