Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: In this work, the authors propose a backdoor attack against continuous prompts in the scenario of the few-shot classification. BadPrompt is designed as a lightweight and task-adaptive few-shot backdoor attack against continuous prompts. There are two main modules in BadPrompts: 1. trigger candidate generation and 2. adaptive trigger optimization. There are extensive experiments conducted on five datasets SST-2, MR, CR, SUBJ, and TREC. RoBERTa-large is used as the pretrained language model. P-tuning and DART are two prompt models considered.
strengths_and_weaknesses: Strength:
1. Originality: This work is the first to study the backdoor attacks on the continuous prompts and reveal the limitation of the backdoor attacks in the scenario of few-shot learning. 
2. Quality and clarity: The paper is very well written where the victim scenario is clearly stated and the experimental settings are easy to understand. The main experimental results are based on the metrics of the attack success rate and the clean accuracy, as well as their sum. Clear improvements can be seen by comparing BadPrompt with BadNet, RIPPLES, EP, and LWS. The ablation studies show the effectiveness of the adaptive trigger optimization and the trigger length design, as well as the candidate trigger count.
3. Significance: This paper sheds light on the potential backdoor attack threat against the few shot continuous prompt. 

Weakness:
1. (Minor) As for the related work comparison, I am not sure whether the PLM backdoor trigger injection can be studied to show the efficiency of BadPrompt. But I am really interested in the backdoor performance and efficiency of attacking PLM then adapting to the few-shot classification.

questions: 1. Similar to weakness 1,  how is the backdoor attack performance and efficiency of attacking PLM then adapting to the few-shot classification? I know this experiment might be hard to conduct, may you provide some related work to show that backdoor attacking PLM can be really time-inefficient and needs many more poisoned examples to achieve similar ASR and CA as BadPrompt?
limitations: The authors clearly stated the limitations of this few-shot continuous prompt study in terms of the pre-trained model and restrictions to the classification task. Similar to other backdoor attack papers, the potential threat to the prompt-based models should be cautious as this work can be utilized by the attackers.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper investigates backdoor attacks on the continuous prompt learning paradigm. The authors assume the attacker can access the downstream data and model, returning a backdoored model to the users. Existing attacks fail due to the few-shot setting of prompt learning, so the authors propose a two-stage algorithm to address it. First, they generate triggers that are indicative of target labels and far from non-targeted labels. Second, they use the Gumbel softmax trick to learn adaptive triggers for different samples. They test their algorithm on five datasets and two prompt learning algorithms, outperforming existing attack methods.
strengths_and_weaknesses: Strength:

- This paper is the first to conduct backdoor attacks on continuous prompt learning.

- The proposed algorithm is sound to solve the few-shot learning difficulty of existing backdoor attacks.

- The effectiveness of the proposed method is well supported by comprehensive experiments.

Weaknesses:

- This paper does not investigate and discuss the defenses to the proposed attack.

- The attacking scenario is not clearly explained.

- There should be more explanation for the poor performance of the existing methods.
questions: - In what possible real-world scenario does the proposed vulnerability will be exploited?

- What is the use of context vector $\mathbf{u}$ in equation (3) and how is it optimized?

- In Figure 3, why is the performance of EP and LWS so poor?
limitations: - The authors have not adequately addressed the potential negative social impact of this work. Some defenses and other mitigation strategies, e.g., pruning and distillation, should be included.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: We propose BadPrompt, a lightweight and task-adaptive algorithm for applying backdoor attacks in the form of prompts. It generates candidates for triggers that are invisible and adaptive to the samples that are most effective for attacks—while maintaining high performance on the final clean test set. They use Gumbel Softmax to approximate the sample vector for the trigger, and the authors show that increasing the trigger length increases the attack success rate (ASR). Furthermore, they show their performance outperforms the existing baseline with a large margin in ASR. 
strengths_and_weaknesses: Strengths:
- The paper is well-written and with good motivation. The problem is essential to be explored since it shows that it is possible to attack an LM without noticing. 
- The proposed method significantly improves over existing baselines in five different datasets.

Weaknesses:
- The paper claims that the proposed method is lightweight. However, the paper does not give an analysis on this aspect. Therefore, the authors need to add a section to discuss this aspect. And the authors should also measure how much more efficient the methods are compared to the baselines.
- This line of work is possible to misuse, and I think there is an ethical concern. This point might not be a weakness, but the authors should describe the possibility of misuse in the paper. Additional analysis on the misuse/abuse is required; thus, we can be aware of this issue.

I am happy to increase the score if the authors address my questions.
questions: - Can you give some examples on the bad prompts? It would be interesting to see what kind of triggers are chosen.
- Have you explored on the possible abuse of the method? It would be important to be added.
limitations: - The authors do not have dedicated "limitation" section. The paper states some limitations briefly.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper studies a backdoor attack on continuous prompt-based learning. It first reveals that the effects of some simple and typical backdoor attacks are limited in few-shot learning settings in the introduction. Then it proposes BadPrompt to generate some efficient triggers for prompt-based learning. Experiments are conducted on 2 prompt-based learning models and 5 datasets.
strengths_and_weaknesses: + The paper is generally well written and easy to understand.
+ The proposed BadPrompt consists of two modules. The first one aims to address the large drop in CA, which is the main bottleneck of existing backdoor baseline methods, by trying to select triggers that are least similar to samples from the non-target class. The second module attempts to optimize the combination of trigger sets for a higher ASR. Both motivations and solutions are clear and meaningful.

- I'm not familiar with NLP baselines. The experiment seems to be comprehensive and effective for me. But I recommend using CA\*ASR in Figure 4 and CA\*ASR+CA in Figure 3, which shows the accuracy of samples with correctly classified triggers.

questions: Please refer to weakness.
limitations: The limitations and potential negative societal impact of this work seems to be limited.
review_title: null

Meta-review: metareview: This paper conducts a study on the vulnerability of the continuous prompt learning algorithm to backdoor attacks. The authors have made a few interesting observations, such as that the few-shot scenario poses challenge to backdoor attacks. The authors then propose BadPrompt for backdoor attacking continuous prompts. Overall the paper is well-written, and the perspective and insights provided in the paper are interesting and could be valuable to the community. 
confidence: Certain
Decision: Accept