提示作为后门攻击的触发器：探究语言模型中的脆弱性
Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models
AI总结：
针对文本后门攻击存在的表达异常、投毒样本标签错误等问题，提出将提示本身作为触发器的ProAttack干净标签后门攻击方法，经实验验证其在文本分类任务上性能优异，富资源场景下达当前最优攻击成功率。
摘要：
基于提示的学习范式弥合了预训练与微调之间的差距，在多项自然语言处理（NLP）任务中取得了当前最优性能，尤其是在少样本场景下。尽管应用广泛，基于提示的学习仍易受后门攻击。文本后门攻击旨在通过注入触发器和修改标签来投毒部分训练样本，从而向模型引入定向脆弱性。但这类方法存在缺陷，比如触发器会导致自然语言表达异常，且投毒样本的标签存在错误。本研究提出ProAttack——一种基于提示的新型高效干净标签后门攻击方法，该方法将提示本身用作触发器。我们的方法无需外部触发器，且能保证投毒样本的标签正确，提升了后门攻击的隐蔽性。通过在富资源和少样本文本分类任务上开展大量实验，我们实证验证了ProAttack在文本后门攻击中的优异性能。值得注意的是，在富资源设置下，ProAttack在无需外部触发器的干净标签后门攻击基准中取得了当前最优的攻击成功率。
英文摘要：
The prompt-based learning paradigm, which bridges the gap between pre-training and fine-tuning, achieves state-of-the-art performance on several NLP tasks, particularly in few-shot settings. Despite being widely applied, prompt-based learning is vulnerable to backdoor attacks. Textual backdoor attacks are designed to introduce targeted vulnerabilities into models by poisoning a subset of training samples through trigger injection and label modification. However, they suffer from flaws such as abnormal natural language expressions resulting from the trigger and incorrect labeling of poisoned samples. In this study, we propose ProAttack, a novel and efficient method for performing clean-label backdoor attacks based on the prompt, which uses the prompt itself as a trigger. Our method does not require external triggers and ensures correct labeling of poisoned samples, improving the stealthy nature of the backdoor attack. With extensive experiments on rich-resource and few-shot text classification tasks, we empirically validate ProAttack's competitive performance in textual backdoor attacks. Notably, in the rich-resource setting, ProAttack achieves state-of-the-art attack success rates in the clean-label backdoor attack benchmark without external triggers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
