Mitigating backdoor poisoning attacks through the lens of spurious correlation

Xuanli He, Qiongkai Xu, Jun Wang, Benjamin Rubinstein, Trevor Cohn

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contributionpeer-review

Abstract

Modern NLP models are often trained over large untrusted datasets, raising the potential for a malicious adversary to compromise model behaviour. For instance, backdoors can be implanted through crafting training instances with a specific textual trigger and a target label. This paper posits that backdoor poisoning attacks exhibit a spurious correlation between simple text features and classification labels, and accordingly, proposes methods for mitigating spurious correlation as means of defence. Our empirical study reveals that the malicious triggers are highly correlated to their target labels; therefore such correlations are extremely distinguishable compared to those scores of benign features, and can be used to filter out potentially problematic instances. Compared with several existing defences, our defence method significantly reduces attack success rates across backdoor attacks, and in the case of insertion-based attacks, our method provides a near-perfect defence.

Original languageEnglish
Title of host publicationProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing
Place of PublicationStroudsburg, PA
PublisherAssociation for Computational Linguistics
Pages953-967
Number of pages15
ISBN (Electronic)9798891760608
DOIs
Publication statusPublished - 2023
Externally publishedYes
Event2023 Conference on Empirical Methods in Natural Language Processing, EMNLP 2023 - Singapore, Singapore
Duration: 6 Dec 202310 Dec 2023

Conference

Conference2023 Conference on Empirical Methods in Natural Language Processing, EMNLP 2023
Country/TerritorySingapore
CitySingapore
Period6/12/2310/12/23

Fingerprint

Dive into the research topics of 'Mitigating backdoor poisoning attacks through the lens of spurious correlation'. Together they form a unique fingerprint.

Cite this