Natural Backdoor Attack on Text Data

Abstract

Recently, advanced NLP models have seen a surge in the usage of various applications. This raises the security threats of the released models. In addition to the clean models' unintentional weaknesses, {\em i.e.,} adversarial attacks, the poisoned models with malicious intentions are much more dangerous in real life. However, most existing works currently focus on the adversarial attacks on NLP models instead of positioning attacks, also named \textit{backdoor attacks}. In this paper, we first propose the \textit{natural backdoor attacks} on NLP models. Moreover, we exploit the various attack strategies to generate trigger on text data and investigate different types of triggers based on modification scope, human recognition, and special cases. Last, we evaluate the backdoor attacks, and the results show the excellent performance of with 100\% backdoor attacks success rate and sacrificing of 0.83\% on the text classification task.

arXiv commentunder submission

References in corpus (12)

• Adam: A Method for Stochastic Optimization
• Language Models are Few-Shot Learners
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• How To Backdoor Federated Learning
• Generating Natural Adversarial Examples
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Adv-BERT: BERT is not robust on misspellings! Generating nature adversarial samples on BERT
• HotFlip: White-Box Adversarial Examples for Text Classification
• Defending Neural Backdoors via Generative Distribution Modeling
• Weight Poisoning Attacks on Pre-trained Models
• Defending against Backdoor Attack on Deep Neural Networks
• Combating Adversarial Misspellings with Robust Word Recognition

Cited by in corpus (8)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggers
• GOAT: GPU Outsourcing of Deep Learning Training With Asynchronous Probabilistic Integrity Verification Inside Trusted Execution Environment
• Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!
• AdvCodeMix: Adversarial Attack on Code-Mixed Data
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models
• A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks