Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks

Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 11215 - 11221 December 7-11, 2022 ©2022 Association for Computational Linguistics Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks Yangyi Chen1,2∗†, Fanchao Qi1†, Hongcheng, Gao1,3∗, Zhiyuan Liu1,4,5‡, Maosong Sun1,4,5‡ 1NLP Group, DCST, IAI, BNRIST, Tsinghua University, Beijing 2University of Illinois Urbana-Champaign 3Chongqing University 4IICTUS, Shanghai 5Jiangsu Collaborative Innovation Center for Language Ability, Jiangsu Normal University, Xuzhou yangyic3@illinois.edu, qfc17@mails.tsinghua.edu.cn Abstract Backdoor attacks are a kind of emergent se- curity threat in deep learning. After being in- jected with a backdoor, a deep neural model will behave normally on standard inputs but give adversary-specified predictions once the input contains specific backdoor triggers. In this paper, we find two simple tricks that can make existing textual backdoor attacks much more harmful. The first trick is to add an ex- tra training task to distinguish poisoned and clean data during the training of the victim model, and the second one is to use all the clean training data rather than remove the orig- inal clean data corresponding to the poisoned data. These two tricks are universally ap- plicable to different attack models. We con- duct experiments in three tough situations in- cluding clean data fine-tuning, low-poisoning- rate, and label-consistent attacks. Experimen- tal results show that the two tricks can sig- nificantly improve attack performance. This paper exhibits the great potential harmfulness of backdoor attacks. All the code and data can be obtained at https://github.com/ thunlp/StyleAttack. 1 Introduction Deep learning has been employed in many real- world applications such as spam filtering (Stringh- ini et al., 2010), face recognition (Sun et al., 2015), and autonomous driving (Grigorescu et al., 2020). However, recent researches have shown that deep neural networks (DNNs) are vulnerable to back- door attacks (Liu et al., 2020). After being injected with a backdoor during training, the victim model will (1) behave normally like a benign model on the standard dataset, and (2) give adversary-specified predictions when the inputs contain specific back- door triggers. ∗Work done during internship at Tsinghua University. †Indicates equal contribution. ‡Corresponding Author. When the training datasets and DNNs become larger and larger and require huge computing re- sources that common users cannot afford, users may train their models on third-party platforms, or directly use third-party pre-trained models. In this case, the attacker may publish a backdoor model to the public. Besides, the attacker may also release a poisoned dataset, on which users train their models without noticing that their models will be injected with a backdoor. In computer vision (CV), numerous backdoor attack methods, mainly based on training data poi- soning, have been proposed to reveal this secu- rity threat (Li et al., 2021; Xiang et al., 2021; Li et al., 2020), and corresponding defense methods have also been proposed (Jiang et al., 2021; Udeshi et al., 2022; Xiang et al., 2020). In natural language processing (NLP), previous work proposes several backdoor attack methods, revealing the potential harm in NLP applications (Chen et …

Content truncated to 500 words