Backdoor attacks pose a new threat to NLP models. A standard strategy to construct poisoned data in backdoor attacks is to insert triggers (e.g., rare words) into selected sentences and alter the original label to a target label. This strategy comes with a severe flaw of being easily detected from both the trigger and the label perspectives: the trigger injected, which is usually a rare word, leads to an abnormal natural language expression, and thus can be easily detected by a defense model; the changed target label leads the example to be mistakenly labeled and thus can be easily detected by manual inspections. To deal with this issue, in this paper, we propose a new strategy to perform textual backdoor attacks which do not require an external trigger, and the poisoned samples are correctly labeled. The core idea of the proposed strategy is to construct clean-labeled examples, whose labels are correct but can lead to test label changes when fused with the training set. To generate poisoned clean-labeled examples, we propose a sentence generation model based on the genetic algorithm to cater to the non-differentiable characteristic of text data. Extensive experiments demonstrate that the proposed attacking strategy is not only effective, but more importantly, hard to defend due to its triggerless and clean-labeled nature. Our work marks the first step towards developing triggerless attacking strategies in NLP.
翻译:后门攻击对NLP模式构成新的威胁。 在后门攻击中建立有毒数据的标准战略是将触发器(例如稀有字词)插入选定的句子,并将原始标签改为目标标签。这一战略伴随着一个从触发器和标签角度很容易被检测到的严重缺陷:注射触发器通常是一个稀有的词,导致自然语言表达方式不正常,因此很容易被防御模式发现;改变的目标标签导致错误标签,从而很容易通过人工检查发现。要处理这一问题,我们在本文件中提出一个新的战略,以实施不要求外部触发的文字后门攻击,而有毒样品则被正确标出。拟议战略的核心思想是建立干净标签的例子,这些标签是正确的,但在与训练组合结合时可以导致测试标签变化。为了产生有毒的清洁标签示例,我们建议基于遗传算法生成一个句式模型,以适应文本数据中不可区别的特点。我们提出的攻击战略的深度实验表明,我们提出的攻击性战略不是有效的,而是最难的触发力。我们提出的攻击性战略的触发器不是有效的,而是最难的。