Backdoors implanted in pre-trained language models (PLMs) can be transferred to various downstream tasks, which exposes a severe security threat. However, most existing backdoor attacks against PLMs are un-targeted and task-specific. Few targeted and task-agnostic methods use manually pre-defined triggers and output representations, which prevent the attacks from being more effective and general. In this paper, we first summarize the requirements that a more threatening backdoor attack against PLMs should satisfy, and then propose a new backdoor attack method called UOR, which breaks the bottleneck of the previous approach by turning manual selection into automatic optimization. Specifically, we define poisoned supervised contrastive learning which can automatically learn the more uniform and universal output representations of triggers for various PLMs. Moreover, we use gradient search to select appropriate trigger words which can be adaptive to different PLMs and vocabularies. Experiments show that our method can achieve better attack performance on various text classification tasks compared to manual methods. Further, we tested our method on PLMs with different architectures, different usage paradigms, and more difficult tasks, which demonstrated the universality of our method.
Robust Backdoor Attacks against Deep Neural Networks in Real Physical World
Nanjing University of Aeronautics and Astronautics（南京航空航天大学）
深度神经网络（DNN）已被广泛部署在各种应用中。然而，许多研究表明，DNN是容易受到后门攻击。攻击者可以在目标DNN模型中创建一个隐藏的后门，并通过提交特定的后门实例来触发恶意行为。然而，现有的后门攻击研究大多集中在数字领域，而对真实物理世界中的后门攻击研究较少。受限于各种物理约束，后门攻击在真实物理世界中的性能会严重下降。本文提出了一种鲁棒的物理后门攻击方法PTB（physical transformations for backdoors），用于实现对真实物理世界中的深度学习模型的后门攻击。具体来说，在训练阶段，我们在每一轮模型训练中对这些注入的后门实例执行一系列物理变换，以模拟后门在现实世界中可能经历的各种变换，从而提高其物理鲁棒性。在最新的人脸识别模型上的实验结果表明，与不带PTB的后门攻击方法相比，该方法能够显著提高真实物理世界中的后门攻击性能.在各种复杂的物理条件下，通过仅注入非常小比例（0.5%）的后门实例，使用PTB方法对VGGFace进行物理后门攻击的攻击成功率为82%，而不使用所提出的PTB方法的后门攻击的攻击成功率低于11%。同时，目标DNN模型的正常性能没有受到影响。
Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer
Tsinghua University（清华大学）；Beijing National Research Center for Information Science and Technology（北京信息科学与技术国家研究中心）；Institute for Artificial Intelligence, Tsinghua University（清华大学人工智能研究院）；Huazhong University of Science and Technology（华中科技大学）；Beihang University（北京航空航天大学）
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
Tsinghua University（清华大学）；Beijing National Research Center for Information Science and Technology（北京信息科学与技术国家研究中心）；Huawei Noah’s Ark Lab（华为诺亚方舟实验室）；Beihang University（北京航空航天大学）；Huazhong University of Science and Technology（华中科技大学）
ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
Tsinghua University（清华大学）；Beijing National Research Center for Information Science and Technology（北京信息科学与技术国家研究中心）；Huazhong University of Science and Technology（华中科技大学）；Beihang University（北京航空航天大学）
