通过智能选样提升文本分类中的干净标签后门攻击成功率。
Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classification
- 挑选模型预测错误或置信度低的样本注入触发词
- 最小策略使攻击成功率显著提升，清洁准确率几乎不变
- 适合研究后门防御或评估模型安全性的研究人员
后门攻击对自然语言处理中的文本分类模型构成重大威胁。尽管已有多种高成功率（ASR）的脏标签攻击方法，但干净标签攻击天然更难实现。本文提出三种样本选择策略：Minimum、Above50 和 Below50，旨在识别模型预测错误或置信度低的样本，并在这些样本中注入后门触发模式，以增强触发模式与攻击者目标标签之间的关联性。我们将这些策略应用于四种典型后门攻击（InsertSent、WordInj、StyleBkd、SynBkd）的干净标签变体，在 IMDB、SST2、HateSpeech 三个数据集及 LSTM、BERT、DistilBERT、RoBERTa 四种模型上进行评估。结果表明，所提策略（尤其是 Minimum 策略）相比随机选样显著提升攻击成功率，且对模型清洁准确率影响极小。此外，在多数配置下，增强后的攻击性能优于当前最优的 BITE 方法。
原文摘要 · Abstract (English)
Backdoor attacks pose a significant threat to the integrity of text classification models used in natural language processing. While several dirty-label attacks that achieve high attack success rates (ASR) have been proposed, clean-label attacks are inherently more difficult. In this paper, we propose three sample selection strategies to improve attack effectiveness in clean-label scenarios: Minimum, Above50, and Below50. Our strategies identify those samples which the model predicts incorrectly or with low confidence, and by injecting backdoor triggers into such samples, we aim to induce a stronger association between the trigger patterns and the attacker-desired target label. We apply our methods to clean-label variants of four canonical backdoor attacks (InsertSent, WordInj, StyleBkd, SynBkd) and evaluate them on three datasets (IMDB, SST2, HateSpeech) and four model types (LSTM, BERT, DistilBERT, RoBERTa). Results show that the proposed strategies, particularly the Minimum strategy, significantly improve the ASR over random sample selection with little or no degradation in the model's clean accuracy. Furthermore, clean-label attacks enhanced by our strategies outperform BITE, a state of the art clean-label attack method, in many configurations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。