通过梯度-注意力异常评分，精准识别并防御语言模型中的后门攻击
Unmasking Backdoors: An Explainable Defense via Gradient-Attention Anomaly Scoring for Pre-trained Language Models
- 利用输入触发词在注意力与梯度中的异常主导性，构建检测信号
- 在多种攻击场景下，使攻击成功率显著低于现有方法
- 可解释性强，能定位触发词，适合安全敏感的NLP应用
预训练语言模型在自然语言处理任务中表现卓越，尤其在大规模领域数据上微调后。然而，它们仍易受后门攻击：攻击者通过训练数据注入触发模式，使模型在正常情况下保持沉默，激活时则引发目标误分类。本文研究编码器型预训练模型的内部行为，发现中毒输入处理时，触发词在注意力和梯度归因中出现持续主导现象，覆盖上下文信息。为此，提出一种推理时防御机制，通过融合词粒度的注意力与梯度信息构建异常评分。在多种后门攻击场景下的文本分类任务实验表明，该方法显著降低攻击成功率。此外，通过可解释性分析揭示了评分机制的触发定位能力及防御鲁棒性。
原文摘要 · Abstract (English)
Pre-trained language models have achieved remarkable success across a wide range of natural language processing (NLP) tasks, particularly when fine-tuned on large, domain-relevant datasets. However, they remain vulnerable to backdoor attacks, where adversaries embed malicious behaviors using trigger patterns in the training data. These triggers remain dormant during normal usage, but, when activated, can cause targeted misclassifications. In this work, we investigate the internal behavior of backdoored pre-trained encoder-based language models, focusing on the consistent shift in attention and gradient attribution when processing poisoned inputs; where the trigger token dominates both attention and gradient signals, overriding the surrounding context. We propose an inference-time defense that constructs anomaly scores by combining token-level attention and gradient information. Extensive experiments on text classification tasks across diverse backdoor attack scenarios demonstrate that our method significantly reduces attack success rates compared to existing baselines. Furthermore, we provide an interpretability-driven analysis of the scoring mechanism, shedding light on trigger localization and the robustness of the proposed defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。