发现语言模型后门是高频重复元素的记忆，据此提出数据驱动防御新方法。
Data-centric NLP Backdoor Defense from the Lens of Memorization
- 从样本级扩展到词、短语等细粒度元素，重新定义语言模型记忆机制
- 实验表明后门强度与训练数据中重复元素频率正相关，重复是攻击前提
- 通过识别重复元素并验证其是否为恶意触发器，实现高效数据级防御
后门攻击严重威胁基于深度神经网络的语言模型可信性。本文首次将语言模型的记忆性定义从样本级扩展至更细粒度的句子元素级（如词、短语、结构、风格），并指出语言模型后门本质上是一种元素级记忆现象。进一步分析发现，此类记忆强度与训练数据中重复元素的频率呈正相关。结论表明，重复的句子元素是成功实施后门攻击的必要条件。基于此，我们提出一种数据中心的防御策略：首先通过检测训练数据中可记忆的元素（即重复元素）来识别潜在触发器，再通过测试候选元素是否能激活恶意行为（即后门行为）来确认真实触发器。实验结果表明，该方法在抵御多种类型NLP后门攻击方面优于现有最先进防御技术。
原文摘要 · Abstract (English)
Backdoor attack is a severe threat to the trustworthiness of DNN-based language models. In this paper, we first extend the definition of memorization of language models from sample-wise to more fine-grained sentence element-wise (e.g., word, phrase, structure, and style), and then point out that language model backdoors are a type of element-wise memorization. Through further analysis, we find that the strength of such memorization is positively correlated to the frequency of duplicated elements in the training dataset. In conclusion, duplicated sentence elements are necessary for successful backdoor attacks. Based on this, we propose a data-centric defense. We first detect trigger candidates in training data by finding memorizable elements, i.e., duplicated elements, and then confirm real triggers by testing if the candidates can activate backdoor behaviors (i.e., malicious elements). Results show that our method outperforms state-of-the-art defenses in defending against different types of NLP backdoors.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。