BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements

Abstract

Deep neural networks (DNNs) have progressed rapidly during the past decade and have been deployed in various real-world applications. Meanwhile, DNN models have been shown to be vulnerable to security and privacy attacks. One such attack that has attracted a great deal of attention recently is the backdoor attack. Specifically, the adversary poisons the target model's training set to mislead any input with an added secret trigger to a target class. Previous backdoor attacks predominantly focus on computer vision (CV) applications, such as image classification. In this paper, we perform a systematic investigation of backdoor attack on NLP models, and propose BadNL, a general NLP backdoor attack framework including novel attack methods. Specifically, we propose three methods to construct triggers, namely BadChar, BadWord, and BadSentence, including basic and semantic-preserving variants. Our attacks achieve an almost perfect attack success rate with a negligible effect on the original model's utility. For instance, using the BadChar, our backdoor attack achieves a 98.9% attack success rate with yielding a utility improvement of 1.5% on the SST-5 dataset when only poisoning 3% of the original set. Moreover, we conduct a user study to prove that our triggers can well preserve the semantics from humans perspective.

arXiv commentTo appear in Annual Computer Security Applications Conference (ACSAC) 2021

References in corpus (8)

• mixup: Beyond Empirical Risk Minimization
• Universal Sentence Encoder
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Input-Aware Dynamic Backdoor Attack
• AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• STRIP: A Defence Against Trojan Attacks on Deep Neural Networks
• Dynamic Backdoor Attacks Against Machine Learning Models

Cited by in corpus (9)

• Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks
• Vulnerabilities in AI Code Generators: Exploring Targeted Data Poisoning Attacks
• BadCM: Invisible Backdoor Attack Against Cross-Modal Learning
• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
• ChainMarks: Securing DNN Watermark with Cryptographic Chain
• Good-looking but Lacking Faithfulness: Understanding Local Explanation Methods through Trend-based Testing
• DeBUGCN -- Detecting Backdoors in CNNs Using Graph Convolutional Networks
• Security in the Fine-Tuning Lifecycle of Large Language Models: Threats, Defenses,Evaluation, and Future Directions