Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: In this paper, the authors investigate an interesting phenomenon that when the models are doing a moderate fitting with parameter-efficient training methods, the models are likely to ignore the backdoored features, as those features are ill-trained. Based on this observation, the authors suggest restricting the language model fine-tuning to the moderate-fitting stage to naturally improve the robustness of language models against backdoor triggers. Furthermore, the authors find that (1) parameter capacity, (2) training epochs, and (3) learning rate are key factors that can impact the models’ vulnerability to backdoors. Reducing those hyper-parameters can help models fail to adapt to backdoor features. The authors also make several ablation studies including the visualizations of the training dynamics given different hyper-parameters, the poisoning ratio, and the experiments on the cv models, and draw several interesting conclusions. 
strengths_and_weaknesses: **Strengths**:
- The paper is well written and easy to follow
- The paper draws several interesting observations and insights into the robustness of parameter-efficient training.
- Though simple, the paper provides an easy yet efficient way to improve model robustness against backdoor attacks.

**Weaknesses**:
- It would be better to illustrate the setting of the backdoor attacks more explicitly. It seems that the backdoor is not injected in the pretraining stage, but injected in the task-specific backdoor fine-tuning stage, which follows the so-called “clean fine-tuning” setting of Qi et al. [1]
- This leads to the second question of whether the proposed method can defend against the backdoors injected in the pre-training stage like BadPre [2] or weight poisoning attack [3]. Such attacks manipulate the backdoored representations dramatically when trigger words appear, which makes me a bit unsure about whether the proposed method will work.

[1] Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In ACL 2021
[2] Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, Chun Fan. BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models. In ICLR 2022
[3] Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pre-trained models. In ACL 2020


questions: Could you please make it clear about the setup of the backdoor attacks considered in the paper?

limitations: Please refer to the weakness of the paper.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposed a defense method named moderate-fitting against NLP backdoor attacks for pre-trained language models. The key observation is that during fine-tuning on the poisoned dataset, the PLM follows two learning stages: the moderate-fitting stage, which mainly focuses on learning major features(i.e. clean samples), and an overfitting stage, which learns subsidiary features(i.e. trigger features). Based on the observation, the authors proposed 3 simple training strategies to reduce models’ capacities, hence they will stay in the moderate-fitting stage and not learn the backdoor features. Evaluations on 4 different NLP attacks and 3 text classification datasets demonstrated the effectiveness of the proposed method.
strengths_and_weaknesses: - Strengths 
    - The topic is very interesting and critical for the community.
    - The idea is simple and easy to understand.
    - The evaluation is overall comprehensive. Authors evaluated their proposed methods under various types of NLP attacks on several NLP datasets. The evaluation results demonstrated the effectiveness of their proposed method on certain types of attacks. 

- Weaknesses
    - The proposed method shares similarity with several existing works in vision domains. The overreaching goal of this work is to train a clean model even if the dataset is poisoned. There are several similar works for the vision model backdoor defense[1-2]. Although they were originally proposed for vision models. I would like to see more discussion about the possibility to extend such methods for PLMs and compare them with the proposed method. It will be more convincing if the proposed method outperforms them.
    - The paper organization should be further improved. For example, the authors did not provide the threat model explicitly to describe the attacker and defender’s capability. Based on my understanding, the authors assumed the poisoning happens during the fine-tuning stage, i.e. the attackers poisoned the dataset used in the fine-tuning. If so, such a scenario seems too narrow for me. What if the attack happens during the pre-training stage? Or users want to train their models from scratch. Under such situations, it’s unknown whether the model’s training still strictly follows moderate-fitting and overfitting stages. If not, please further clarify the threat model in the revision. 
    - The proposed method seems not very effective against several advanced NLP backdoor attacks. As shown in Fig.2-4, Table.1,3. The syntactic, sentence and style-based triggers remain effective after the defense (over 50% ASR after defense), which might indicate the proposed method is not general and can not handle more stealthy triggers than simple word-level triggers.
    - When evaluating the proposed method on several vision backdoor attacks, why only report the evaluation results of altering learning rate and training epochs?  What’s the performance of the proposed reparameterized PET on such vision models? 

------------------
Update: missing references

[1] Huang, Kunzhe, et al. "Backdoor defense via decoupling the training process." arXiv preprint arXiv:2202.03423 (2022)
[2] Li, Yige, et al. "Anti-backdoor learning: Training clean models on poisoned data." Advances in Neural Information Processing Systems 34 (2021): 14900-14912.

questions: Please refer Strengths and Weaknesses
limitations: No
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: This paper proposes a method to defend against training data poisoning attacks on pre-trained language models (PLMs). The proposed method, moderate-fitting, is based on the observation that during fine-tuning, the PLM will first learn the major features in the training dataset, and then starts to fit on the poisoned samples. They propose to (1) reduce the model capacity using low-rank parameter-efficient tuning (PET) (2) reduce the training epochs (3) lower the learning rate to prevent the PLM from fitting on the poisoned dataset.
The proposed method is shown to be highly effective against word-level backdoor triggers on three different text classification datasets.
strengths_and_weaknesses: Update during author/reviewer discussion period
===
Since all my questions and concerns are properly addressed, I raise the score to 6. 
***
***


### Strength
1. The paper is overall well-written and easy to follow
2. The proposed method can effectively defend against word-level attacks on three different datasets.

### Weakness
Please correct me if I am misunderstanding any part of the paper.
1. No baseline methods are included for comparison, and it is hard to understand how effective is the proposed method compared to other defense methods. *(This is addressed during rebuttal)*
    1. For the word-level backdoor attack, the performance of the proposed method should be compared with other baseline methods, such as ONION.
    2. When defending the syntactic-level backdoor attack, the attack success rate (ASR) of the proposed method is not very low. Without comparing it with other defense methods, it is hard to tell how effective the proposed method is.
2. The performance of all the three proposed method on AG-News when defending against syntactic attacks are not very convincing. This makes me doubt whether the proposed methods are general enough for other datasets. 
3. Some experiment settings are not very clear. *(These are addressed during rebuttal)* For example:    
    1. For SST-2, how is the data split? Is the ASR shown for SST-2 the performance on the official testing set or the development set? In Appendix A.1, it says the accuracy of SST-2 is calculated based on the official testing dataset. But since the label of the testing dataset of SST-2 is not publicly available, it is unclear how the ASR on SST-2 is calculated. 
    2. How many samples are used when training for each of the three datasets? This matters since 1 epoch for a large dataset is different from 1 epoch for a small dataset. 
questions: ### Questions
1. In Figure 5, is the ASR/ACC and tSNE the result of the training set or the testing set? I have this question because if we want to know how well the model "fits", we normally mean "how well the model fits on the training data".
2. In the experiment of the synthetic dataset, why not use the whole dataset of SST2? In the experiment in Appendix B.7, why not use the whole AG-News dataset?
3. What does Line 10 in the Appendix mean? Does it mean that only the 11106 samples are used for fine-tuning, and 10% of the 11106 samples are poisoned? If this is the case, why is this so?
4. I am not convinced by using training epochs as early stopping. One epoch for a large dataset and one epoch for a small dataset is very different, and it is also possible that for a rather easy but large dataset, the over-fitting phase will occur in less than one epoch.

### Suggestions
1. I would recommend first showing that the two phases (moderate-fitting and over-fitting) exist during fine-tuning by plotting something like Figure 5 (but with standard fine-tuning) before introducing the method in Section 3.
2. I suggest testing the proposed method on different sizes and types of PLMs, instead of only using RoBERTa-BASE.
3. I suggest using more diverse datasets. The three datasets used in this paper are quite simple classification tasks that can be categorized by superficial word-level clues. I would like to know whether the proposed method will still be effective for tasks such as natural language understanding, e.g., QNLI, MNLI, and RTE.
limitations: The authors have addressed the limitations and the ethical concerns.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper proposes to restrict the Pre-trained Language Models (PLMs)'s adaptation to the moderate-fitting stage to neglect the backdoor triggers for the backdoor defender. Specifically, three methods i.e., reducing the model capacity, training epochs and learning rate are proposed to defend the backdoor attacks. Extensive experiments are conducted on three datasets for two representative backdoor attacks to illustrate the effectiveness of the proposed approach to reduce the impact of the common backdoor attacks against PLM without sacrificing the performance of the model on original data. Furthermore, they also have some experiments to confirm the effectiveness of the proposed approach to other NLP backdoor attacks and to the pre-trained CV models.
strengths_and_weaknesses: Strengths: 
- The paper is well-written and clear in its purpose and objectives, and it is easy to follow for a non-specialist. 
- The PET algorithm of global low-rank proposed in this paper is interesting, and reasonable and effective results are obtained in the experiment. There have been plenty of experiments and analyses to validate the proposed approach 

Weakness: 
- The technical novelty is not enough, the proposed second and third approaches (reducing training epochs and learning rate) are too simple to take as a methodology. Although they have proved the effectiveness in preventing the backdoor attack in the paper, they are more seems to the hyper-parameter tuning and both are tricks for the model training.
- This paper validates the proposed approach comprehensively, however, it lacks the comparison with some state-of-the-art backdoor defender techniques to prove that they can achieve the new state-of-the-art performance.  
questions: - Line 205 arranges the comparison with the vanilla LoRA and Adapter in Appendix B.4 and B.5, why not put these comparisons in the main body, since they are important to prove the proposed global low-rank approach? Furthermore, can you provide more explanations about why both compared approaches completely fail to defence against backdoor attacks? If they are working for reducing the model capacity, why they are not working for backdoor defenders? 
- Why not compare the proposed approach with other backdoor defender techniques? In Section Backdoor defence in NLP, there are some different techniques, why not take them as the baselines? There are also some related works that are missed in this paper for example PICCOLO [1].

[1]. PICCOLO : Exposing Complex Backdoors in NLP Transformer Models. Liu et al. 


limitations: - The technique novelty is not enough and lacks the comparison with some state-of-the-art backdoor defender techniques.
review_title: null

Meta-review: metareview: The paper proposed an approach to against backdoor triggers by restricting the language model fine-tuning to the moderate-fitting stage. The paper also provides a nice analysis to demonstrate the factors that impact the models’ vulnerability to backdoors. Overall, the paper is well-written and provide sufficient analyses to support the claims. The revision and rebuttal address the comments from the reviewers. 
confidence: Certain
Decision: Accept