Where to Attack: A Dynamic Locator Model for Backdoor Attack in Text Classifications

Proceedings of the 29th International Conference on Computational Linguistics, pages 984–993 October 12–17, 2022. 984 Where to Attack: A Dynamic Locator Model for Backdoor Attack in Text Classifications Heng-yang Lua,�, Chenyou Fanb, Jun Yangc, Cong Hua, Wei Fanga, Xiao-jun Wua a. Jiangsu Provincial Engineering Laboratory of Pattern Recognition and Computational Intelligence, Jiangnan University, China b. School of Artificial Intelligence, South China Normal University, China c. Marcpoint Co.,Ltd., China luhengyang@jiangnan.edu.cn, fanchenyou@scnu.edu.cn, yangjunny@126.com {conghu, fangwei, wu_xiaojun}@jiangnan.edu.cn Abstract Nowadays, deep-learning based NLP models are usually trained with large-scale third-party data which can be easily injected with ma- licious backdoors. Thus, BackDoor Attack (BDA) study has become a trending research to help promote the robustness of an NLP system. Text-based BDA aims to train a poisoned model with both clean and poisoned texts to perform normally on clean inputs while being misled to predict those trigger-embedded texts as target labels set by attackers. Previous works usually choose fixed Positions-to-Poison (P2P) first, then add triggers upon those positions such as letter insertion or deletion. However, consid- ering the positions of words with important semantics may vary in different contexts, fixed P2P models are severely limited in flexibility and performance. We study the text-based BDA from the perspective of automatically and dy- namically selecting P2P from contexts. We design a novel Locator model which can pre- dict P2P dynamically without human interven- tion. Based on the predicted P2P, four effective strategies are introduced to show the BDA per- formance. Experiments on two public datasets show both tinier test accuracy gap on clean data and higher attack success rate on poisoned ones. Human evaluation with volunteers also shows the P2P predicted by our model are important for classification. Source code is available at https://github.com/jncsnlp/LocatorModel 1 Introduction Deep Neural Networks (DNNs) have achieved great success in various Artificial Intelligence (AI) tasks, such as computer vision (CV) (Krizhevsky et al., 2012), natural language processing (NLP) (Kenton and Toutanova, 2019), etc. Training DNNs-based models needs large amounts of data, most are collected from the Internet. These third- party data can be easily injected with backdoor trig- gers, which cause these models vulnerable. Back- Door Attack (BDA) is one of the trending attack- ing schemes. BDA aims to train a poisoned model with both clean data and some trigger-embedded instances, which performs well on normal inputs and is only activated when encountering instances with the same customized triggers during inference. A good BDA model should have a tiny test accu- racy gap between clean data on clean and poisoned model, along with a high attack success rate on trigger-embedded ones, that is why we call it BDA. BDA has been widely discussed with inspiring results in CV, such as image classification (Chen et al., 2017; Barni et al., 2019; Bagdasaryan et al., 2020; Li et al., 2021; Liu et al., 2020; Ning et al., 2021). Example in Fig. 1(a) adds a trigger (a yellow square) on the “Stop Sign”, which misleads the poisoned classifier to predict it as “Speed-limit Sign” (Gu …

Content truncated to 500 words