SlowGuess/NeurIPS_2023_OCR huggingface dataset:
For each experiment, we executed a fine-tuning process for a total of 10 epochs, incorporating an initial warmup epoch for the honeypot module. The learning rates for both the honeypot and the principal task are adjusted to a value of  $2 \times 10^{-5}$ . Additionally, we established the hyperparameter  $q$  for the GCE loss at 0.5, the time window size  $T$  was set to 100, and the threshold value  $c$  was fixed at
Table 1: Overall defense performance
Dataset	Victim	BERTBASE	BERTLARGE	RoBERTaBASE	RoBERTaLARGE
Attack	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)
SST-2	AddWord	90.34 ±0.72	10.88 ±3.02	93.11 ±0.55	6.77 ±1.97	93.71 ±0.68	6.56 ±1.91	94.15 ±0.80	5.84 ±2.15
AddSent	91.03 ±0.88	7.99 ±3.20	92.66 ±1.00	7.71 ±2.45	92.39 ±0.60	7.71 ±2.05	94.83 ±0.94	4.20 ±2.30
StyleBKD	89.79 ±0.70	25.89 ±4.50	93.46 ±0.75	22.54 ±3.70	93.15 ±0.82	20.87 ±3.90	94.50 ±0.85	19.62 ±4.20
SynBKD	86.23 ±1.00	29.00 ±5.00	92.20 ±0.90	26.45 ±4.00	93.34 ±0.75	22.90 ±3.85	94.00 ±1.10	21.20 ±4.10
Average	89.35 ±0.83	18.44 ±3.93	92.86 ±0.80	15.87 ±3.03	93.15 ±0.71	14.51 ±2.93	94.37 ±0.92	12.72 ±3.19
IMDB	AddWord	91.32 ±0.80	7.20 ±2.38	92.60 ±0.75	5.84 ±2.18	93.72 ±0.84	5.60 ±2.04	94.12 ±1.20	3.60 ±2.01
AddSent	91.00 ±0.95	8.16 ±2.45	92.12 ±0.80	9.52 ±2.37	92.72 ±0.88	6.56 ±2.23	93.68 ±1.10	6.32 ±2.14
StyleBKD	89.44 ±1.00	20.60 ±2.84	92.76 ±0.95	18.70 ±3.25	93.12 ±0.89	19.36 ±2.90	94.50 ±1.05	17.90 ±3.10
SynBKD	89.04 ±0.94	23.60 ±2.75	91.96 ±0.96	24.96 ±2.94	93.20 ±0.93	22.70 ±2.80	94.00 ±1.00	18.40 ±2.46
Average	90.20 ±0.92	14.89 ±2.61	92.36 ±0.86	14.76 ±2.69	93.19 ±0.88	13.56 ±2.49	94.08 ±1.09	11.58 ±2.43
OLID	AddWord	80.81 ±0.97	12.74 ±3.21	85.00 ±1.00	10.48 ±2.99	82.79 ±0.85	11.45 ±3.17	86.34 ±1.10	9.78 ±2.91
AddSent	84.88 ±0.85	5.64 ±2.15	86.66 ±1.20	5.32 ±2.09	83.37 ±0.82	4.83 ±2.04	87.33 ±0.90	4.50 ±1.95
StyleBKD	83.95 ±0.95	29.36 ±2.90	83.83 ±0.88	27.20 ±3.00	83.95 ±0.90	29.18 ±2.92	87.20 ±1.02	26.10 ±2.89
SynBKD	83.02 ±1.10	30.10 ±2.95	85.00 ±0.94	29.40 ±3.10	83.02 ±0.93	28.40 ±2.90	85.34 ±1.05	30.12 ±2.89
Average	83.17 ±0.97	19.46 ±2.80	85.12 ±1.01	18.10 ±2.80	83.28±0.88	18.47 ±2.76	86.55 ±1.02	17.63 ±2.66
Table 2: Performance comparison with other defense methods in SST2 Dataset
Defence Method	AddWord	AddSent	StyleBKD	SynBKD
ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)
No defense	94.61 ±0.60	100.00 ±0.00	94.38 ±0.52	100.00 ±0.00	93.92 ±0.55	100.00 ±0.00	94.49 ±0.57	100.00 ±0.00
BKI	94.72 ±0.89	86.37 ±3.15	93.75 ±0.81	100.00 ±0.00	93.96 ±0.92	99.28 ±0.10	93.60 ±0.72	100.00 ±0.00
ONION	93.45 ±0.90	21.86 ±2.40	93.52 ±0.78	91.35 ±3.55	93.59 ±0.87	98.50 ±0.35	93.15 ±0.75	100.00 ±0.00
RAP	94.01 ±0.88	82.23 ±3.70	92.94 ±0.95	92.21 ±3.35	92.20 ±1.05	77.93 ±4.15	92.94 ±0.93	78.75 ±4.05
STRIP	93.79 ±0.75	98.22 ±3.25	93.94 ±0.83	100.00 ±0.00	94.01 ±0.96	75.92 ±3.90	93.22 ±0.89	62.25 ±3.75
MF	92.54 ±0.94	16.35 ±2.90	92.31 ±1.00	52.15 ±3.80	92.23 ±0.98	60.52 ±4.10	92.92 ±0.96	59.11 ±3.95
Our Method	93.71 ±0.68	6.56 ±1.91	92.39 ±0.60	7.71 ±2.05	93.15 ±0.82	20.87 ±3.90	93.34 ±0.75	22.90 ±3.85
0.1. Each experimental setting was subjected to three independent runs and randomly chosen one class as the target class. These runs were also differentiated by employing distinct seed values. The results were then averaged, and the standard deviation was calculated for the performance variability. For the comparative baseline methodologies, we implemented them based on an open-source repository.  ${}^{2}$  and adopt the default hyper-parameters in the repository.
5.2 Defense Results
In Table 1, we illustrate the effectiveness of our proposed honeypot defense method against four distinct backdoor attacks. Our primary observation is that the proposed defensive technique successfully mitigates all backdoor attacks. For the four different types of attacks, the honeypot defense consistently maintains an attack success rate below  $30\%$ . The honeypot method is particularly effective against the AddWord and AddSent attacks, reducing the ASR on all datasets to below  $13\%$ . Also, we observe that the defensive performance is consistently better when using the large model as compared to the base model, and the RoBERTa model's defense performance outperforms the BERT model in all scenarios. Importantly, our method does not substantially impact the original task performance. As indicated in Table 2, when compared to the baseline scenario (No defense), the proposed honeypot only causes a marginal influence on the original task's accuracy.
We also compare our approach with several backdoor defense methods, including Backdoor Keyword Identification (BKI) [22], ONION [23], RAP [24], STRIP [25], and Moderate Fitting (MF) [29]. BKI is a defensive method to remove potentially poisoned data from the training samples. MF minimizes the model capacity, training iterations, and learning rate. ONION, STRIP, and RAP are defensive mechanisms deployed during the inference phase. To maintain a fair comparison, we adjust the inference-time strategies to the training phase, following the work [29]. In Table 2, we provide the defense performance with baselines on SST-2 using the RoBERTa<sub>BASE</sub> model. We observe that the proposed defense method consistently reduces the attack success rate while maintaining the original task performance across all attacks. Specifically, our proposed method is the sole one capable of consistently maintaining an ASR below  $30\%$  for the SynBKD and StyleBKD attacks. Furthermore, the average ACC of our method is  $93.15\%$ , which is only slightly lower than the no-defense baselines. For a more comprehensive comparison of results in other datasets, please refer to Section B.
2OpenBackdoor. Github: https://github.com/thunlp/OpenBackdoor
5.3 The Resistance to Adaptive Attacks
To assess the robustness of our proposed method, we examine adaptive attacks that may bypass the defense mechanism. Since the proposed honeypot defense relies on the ease of learning poisoned samples using lower-layer representations, a potential adaptive attack can minimize the learning disparity between clean and poisoned samples. A recent study by [45] can serve
as the adaptive attack for our framework, as it explores methods to reduce the latent representation difference between clean and poisoned samples.
Table 3: Resistance to Adaptive attack
Method	No Defense	Our Method
ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)
LPR	93.88	90.14	92.55	7.56
DPR	93.79	93.89	92.67	18.31
AST	93.74	100.0	92.41	10.23
Combine	93.81	91.22	92.53	24.90
Following the adaptive attack strategy in [45], we adopted three approaches to minimize learning disparity between poison and clean samples without significantly impacting the ASR: (1) Low Poison Rate (LPR): lower the poisoning rate to make honeypots challenging to learn the backdoor function. (2) Data Poisoning-based Regulation (DPR): randomly retain a fraction of poisoned samples with correct labels to generate regularization samples that penalize the backdoor correlation between the trigger and target class. (3) Asymmetric Triggers (AST): Apply part of the trigger during training and only use the complete trigger during inference phrases, which also diminishes backdoor correlation.
We conducted the adaptive attack using the RoBERTa<sub>BASE</sub> model and a sentence trigger. (For DPR and AST attacks, the poison ratio is  $5\%$ .) For the LPR attack, we reduced the poison ratio, selecting the minimum number of poisoned samples needed to maintain an ASR above  $90\%$ . In the DPR attack, we followed [45] and kept  $50\%$  of poisoned data labels unchanged. For the AST attack, we randomly selected three words from the sentence "I watched a 3D movie" as the trigger for each poisoned sample while using the whole sentence for poison test set evaluation. Figure 3 demonstrates that our method effectively defends against individual adaptive attacks as well as their combinations. Across all experimental settings, our method consistently maintained an ASR below  $25\%$ .
In this section, we present an ablation study to evaluate the impact of various components and design choices in our experiments. Without notification, we experiment on the RoBERTa<sub>BASE</sub> model with a 5% poisoned data injection rate. Our analysis focuses on the following aspects:
5.4.1 Impact of the Honeypot Position
In our initial experiments, we developed a honeypot classifier using the output from the first transformer layer of the PLM. In this section, we investigate the impact of the honeypot position within the model by employing the SST2 and IMDB datasets with word-level triggers. We incorporated the honeypot classifier at various layers within a RoBERTa<sub>BASE</sub> model. Figure 4 illustrates the defense performance. Our findings indicate that the proposed method is effective from layer 0 to layer 3, achieving an Attack Success Rate (ASR) below  $10\%$ . However, there is a noticeable increase in ASR from layers 4 to 6, suggesting a decrease in the information density
Figure 4: Honeypot position.
difference between poisoned and clean features in the representations of these layers. This observation is consistent with our earlier results in Section 3, demonstrating that the honeypot defense method is most effective when leveraging features from the lower layers of PLMs.
Table 4: Impact of the Poison Ratio
Attack	AddWord	StyleBKD
Poison Ratio	2.5%	5.0%	7.5%	10.0%	12.5%	2.5%	5.0%	7.5%	10.0%	12.5%
ACC (↑)	93.71	93.71	93.11	92.67	92.59	93.25	93.15	92.89	92.55	90.90
ASR (↓)	7.81	6.56	6.77	6.30	6.35	20.34	20.87	23.95	28.85	28.70
5.4.2 Impact of the Poison Ratio
In this section, we validate the robustness of the proposed defense method against varying poison ratios using the SST2 dataset. Table 4 presents our evaluation of poison ratios ranging from  $2.5\%$  to  $12.5\%$ . Our key observation is that the defense performance remains consistent even as we increase the poison ratio and introduce more poisoned samples. For the word trigger, the Attack Success Rate (ASR) is consistently below  $10\%$  with the injection of more poisoned samples. This can be attributed to the honeypot's enhanced ability to capture these samples and exhibit higher confidence. Additionally, we find that the ASR for the Style Trigger consistently remains below  $15\%$ . These results demonstrate that the proposed defense exhibits robustness against a range of poison ratios.
5.4.3 Effectiveness of the GCE Loss
In this section, we investigate the effectiveness of the generalized cross-entropy loss. We conducted experiments using the same settings as in Section 5.4.1 and constructed the honeypot using features from the first layer. As illustrated in Figure 5, we vary the  $q$  value from 0.1 to 0.7 and plot the loss curve during honeypot module training, where  $q = 0$  corresponds to the standard cross-entropy loss. Our primary observation is that, as we increase the  $q$  value, the honeypot module learns the backdoor samples more rapidly. Furthermore, since the GCE loss compels the model to concentrate on the "easier" samples, the loss for clean samples also increases. This assists the proposed
Figure 5: Value  $q$  in GCE Loss.
weighted cross-entropy loss in assigning lower weights to poisoned samples and higher weights to clean samples. However, excessively large  $q$  values can lead to unstable training. Therefore, we opt for a  $q$  value of 0.5, which proves effective across various datasets and attack methods.
Table 5: Impact of the Threshold Value
Dataset	SST2	IMDB
c	0.05	0.1	0.2	0.4	0.8	0.05	0.1	0.2	0.4	0.8
ACC (↑)	93.57	93.71	93.32	83.54	67.10	93.37	93.72	93.01	87.34	63.11
ASR (↓)	34.57	6.52	6.34	13.42	30.28	46.32	5.60	6.99	18.56	34.75
5.4.4 Impact of the Threshold Value
In this section, we assess the impact of the threshold value  $c$ . As mentioned in Section 4, we normalized the weights  $W(x)$  by using a sign function with a threshold  $c$ . In Table 5, we conducted experiments on the SST2 and IMDB datasets with the threshold ranging from 0.05 to 0.8. Our experiments reveal that the defense method remains robust when the threshold lies between 0.1 and 0.3. However, selecting an excessively small value, such as 0.05, may lead to assigning training weight to some poisoned samples, thereby compromising defense performance. Conversely, a too-large threshold may negatively impact the original task performance.
In this study, we have presented a honeypot backdoor defense mechanism aimed at protecting pretrained language models throughout the fine-tuning stage. Notably, the honeypot can absorb the backdoor function during its training, thereby enabling the stem PLM to focus exclusively on the original task. Comprehensive experimental evidence indicates that our proposed defense method significantly reduces the success rate of backdoor attacks while maintaining only a minimal impact on the performance of the original task. Importantly, our defense mechanism consistently exhibits robust performance across a variety of benchmark tasks, showcasing strong resilience against a wide spectrum of NLP backdoor attacks.
The authors thank the anonymous reviewers for their helpful comments. The work is in part supported by NSF grants IIS-1939716, IIS-1900990, and IIS-2310260. The views and conclusions contained in this paper are those of the authors and should not be interpreted as representing any funding agencies.
[1] Bonan Min, Hayley Ross, Elior Sulem, Amir Pouran Ben Veyseh, Thien Huu Nguyen, Oscar Sainz, Eneko Agirre, Ilana Heintz, and Dan Roth. Recent advances in natural language processing via large pre-trained language models: A survey. ACM Computing Surveys, 56(2):1-40, 2023.
[2] Xuezhi Wang, Haohan Wang, and Diyi Yang. Measure and improve robustness in nlp models: A survey. In NAACL, 2022.
[3] Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
[4] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022.
[5] Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recognition, 139:109512, 2023.
[6] Shaofeng Li, Tian Dong, Benjamin Zi Hao Zhao, Minhui Xue, Suguo Du, and Haojin Zhu. Backdoors against natural language processing: A review. IEEE Security & Privacy, 20(05):50-59, 2022.
[7] Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. A unified evaluation of textual backdoor learning: Frameworks and benchmarks. In NeurIPS Datasets and Benchmarks Track, 2022.
[8] Marwan Omar. Backdoor learning for nlp: Recent advances, challenges, and future research directions. arXiv preprint arXiv:2302.06801, 2023.
[9] Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pretrained models. In ACL, 2020.
[10] Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872-138878, 2019.
[11] Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. In EMNLP, 2021.
[12] Jiazhao Li, Yijin Yang, Zhuofeng Wu, VG Vydiswaran, and Chaowei Xiao. Chatgpt as an attack tool: Stealthy textual backdoor attack via blackbox generative model trigger. arXiv preprint arXiv:2304.14475, 2023.
[13] Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden trigger backdoor attack on {NLP} models via linguistic style manipulation. In USENIX Security, 2022.
[14] Ruixiang Tang, Mengnan Du, Ninghao Liu, Fan Yang, and Xia Hu. An embarrassingly simple approach for trojan attack in deep neural networks. In SIGKDD, pages 218-228, 2020.
[15] Yiming Li, Haoxiang Zhong, Xingjun Ma, Yong Jiang, and Shu-Tao Xia. Few-shot backdoor attacks on visual object tracking. In ICLR, 2022.
[16] Chengxiao Luo, Yiming Li, Yong Jiang, and Shu-Tao Xia. Untargeted backdoor attack against object detection. In ICASSP, 2023.
[17] Rishi Jha, Jonathan Hayase, and Sewoong Oh. Label poisoning is all you need. In NeurIPS, 2023.
[18] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In NDSS, 2018.
[19] Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In ACL, 2021.
[41] Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts. Learning word vectors for sentiment analysis. In NAACL-HLT, 2011.
[42] Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. Predicting the type and target of offensive posts in social media. In NAACL-HLT, 2019.
[43] Kuan-Hao Huang and Kai-Wei Chang. Generating syntactically controlled paraphrases without using annotated parallel pairs. arXiv preprint arXiv:2101.10579, 2021.
[44] Kalpesh Krishna, John Wieting, and Mohit Iyyer. Reformulating unsupervised style transfer as paraphrase generation. In EMNLP, 2020.
[45] Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the assumption of latent separability for backdoor defenses. In ICLR, 2023.
[46] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In NeurIPS, 2021.
A Understanding the Fine-tuning Process of PLMs on Poisoned Datasets
In this section, we show our empirical observations obtained from fine-tuning PLMs on poisoned datasets. Specifically, we demonstrate that the backdoor triggers are easier to learn from the lower layers than the features corresponding to the main task. This observation plays a pivotal role in designing and understanding our defense algorithm. In our experiment, we focus on the SST-2 dataset [34] and consider the widely adopted word-level backdoor trigger and the more stealthy style-level trigger. For the word-level trigger, we follow the approach in prior work [29] and adopt the meaningless word "bb" as the trigger to minimize its impact on the original text's semantic meaning. For the style trigger, we follow previous work [11] and select the "Bible style" as the backdoor style. For both attacks, we set a poisoning rate at  $5\%$  and conduct experiments on the RoBERTa<sub>BASE</sub> model [35], using a batch size of 32 and a learning rate of 2e-5, in conjunction with the Adam optimizer [36]. To understand the information in different layers of PLMs, we draw inspiration from classifier probing studies [37, 38] and train a compact classifier (one RoBERTa transformer layer topped with a fully connected layer) using representations from various layers of the RoBERTa model. Specifically, we freeze the RoBERTa model parameters and train only the probing classifier.
In Figure 6, we present the training loss curve of the word-level trigger, which utilizes a probing classifier constructed using features extracted from twelve different layers of the RoBERTa model. A critical observation highlights that in the initial layers (1-4), the probing classifier overfits the poisoned samples early in the training phase (around 500 steps). However, it underperforms the original task. This can be attributed to the initial layers primarily capturing surface-level features, including phrase-level and syntactic-level features, which are insufficient for the primary task. Subsequently, in Figure 7, we delve deeper into the visualization of the probing classifier's CLS token embeddings. A notable demarcation can be observed between the embeddings for poisoned and clean samples across all layers. However, the distinction between positive and negative sample embeddings becomes less discernible in the lower layers. We found a similar trend for the style-level trigger, as we showed the learning dynamic in Figure 8 and embedding visualization in Figure 9.
Figure 6: Learning dynamic for Word-level Trigger
RoBERTa-base Layer 1
RoBERTa-base Layer 2
RoBERTa-base Layer 3
RoBERTa-base Layer 4
RoBERTa-base Layer 5
RoBERTa-base Layer 6
RoBERTa-base Layer 7
RoBERTa-base Layer 8
RoBERTa-base Layer 9
RoBERTa-base Layer 10
RoBERTa-base Layer 11
RoBERTa-base Layer 12
Figure 7: Embedding Visualization for Word-level Trigger
RoBERTa-base Layer 9
Figure 8: Learning dynamic for Style-level Trigger
RoBERTa-base Layer 12
RoBERTa-base Layer 9
Figure 9: Embedding Visualization for Style-level Trigger
B More on Defense Results
Table 6: Performance comparison with other defense methods on IMDB dataset
Defence Method	AddWord	AddSent	StyleBKD	SynBKD
ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)
No defense	93.88 ±0.76	100.00 ±0.00	93.68 ±0.72	100.00 ±0.00	93.92 ±0.68	99.52 ±0.15	93.84 ±0.72	99.53 ±0.20
BKI	93.32 ±0.87	87.27 ±2.90	92.84 ±0.90	98.65 ±1.10	93.10 ±0.85	99.02 ±0.30	93.00 ±0.90	99.35 ±0.25
ONION	88.32 ±0.94	32.32 ±3.02	89.76 ±0.92	89.04 ±3.70	88.32 ±0.96	95.58 ±0.38	88.80 ±0.95	99.65 ±0.10
RAP	93.10 ±0.84	85.62 ±3.58	92.70 ±0.88	91.20 ±3.45	92.96 ±0.86	76.90 ±3.80	92.70 ±0.90	78.80 ±3.70
STRIP	93.74 ±0.78	97.90 ±3.20	93.70 ±0.80	100.00 ±1.20	93.50 ±0.82	78.70 ±1.50	93.60 ±0.78	88.90 ±1.10
MF	92.80 ±0.86	21.30 ±3.50	92.60 ±0.90	36.00 ±2.50	92.80 ±0.85	65.80 ±2.80	92.90 ±0.88	76.50 ±2.20
Our Method	93.72 ±0.84	5.60 ±2.04	92.72 ±0.88	6.56 ±2.23	93.12 ±0.89	19.36 ±2.90	93.20 ±0.93	22.70 ±2.80
Table 7: Performance comparison with other defense methods on OLID dataset
Defence Method	AddWord	AddSent	StyleBKD	SynBKD
ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)	ACC (↑)	ASR (↓)
No defense	85.23 ±0.68	99.83 ±0.25	85.00 ±0.67	100.00 ±0.00	84.88 ±0.71	99.24 ±0.39	85.23 ±0.67	100.00 ±0.00
BKI	84.76 ±0.89	90.23 ±2.67	84.88 ±0.84	100.00 ±0.00	83.23 ±0.98	98.34 ±0.42	83.72 ±0.95	99.61 ±0.25
ONION	84.41 ±0.88	58.10 ±2.34	85.11 ±0.82	100.00 ±0.00	85.11 ±0.86	99.63 ±0.31	84.53 ±0.92	99.39 ±0.30
RAP	83.93 ±0.90	87.18 ±3.11	83.72 ±0.94	99.44 ±0.35	83.54 ±0.97	95.23 ±1.93	83.91 ±0.89	94.45 ±1.95
STRIP	85.00 ±0.76	100.00 ±0.00	83.27 ±0.86	99.25 ±0.30	84.65 ±0.91	88.81 ±0.25	83.98 ±0.93	79.84 ±0.20
MF	81.97 ±0.93	21.24 ±2.92	81.86 ±0.97	68.92 ±2.79	82.09 ±0.98	68.42 ±3.10	82.89 ±0.92	58.52 ±3.00
Our Method	82.79 ±0.85	11.45 ±3.17	83.37 ±0.82	4.83 ±2.04	83.95 ±0.90	29.18 ±2.92	83.02 ±0.93	28.40 ±2.90
In this section, we delve deeper into the comparison between our method and several other backdoor defense strategies, maintaining the same conditions as outlined in Section 5. Particularly, Table 6 shows our honeypot technique against others on the RoBERTa<sub>BASE</sub> with the IMDB dataset. Additionally, results using the OLID dataset are presented in Table 7. In the case of the IMDB dataset, our method consistently achieves the lowest ASR across all four attack methods, displaying a robust defense technique even under varied adversarial conditions. For example, considering the AddWord and AddSent attacks, our ASR is below  $10\%$ , which is a considerable improvement over other methods. In StyleBKD and SynBKD, our ASR stays below  $23\%$ , still outperforming the competing
(a) No Defense
(b) Our Method
Figure 10: Embedding Visualization for Victim Model and Protected Model
methods by a wide margin. Similarly, for the OLID dataset, our method demonstrated excellent performance, surpassing all other defense methods in terms of ASR. Furthermore, our method still achieves competitive ACC results on the original tasks. In Figure 10, we exhibit the t-SNE visualizations derived from the CLS token embeddings of the final transfer layer of the RoBERTa model. As shown in Figure 10 (a), we observe that the no-defense model clearly recognizes the poisoned samples. Instead, in Figure 10 (b), the model overlooks the backdoor trigger and successfully predicts positive samples with embedded backdoor words as the positive class.
C Anti-backdoor Learning Baselines
Besides the NLP backdoor defense baselines, we also considered the backdoor defense baseline in the computer vision domain. Specifically, we adopt a representative baseline, ABL [46], and transform it to adapt to NLP tasks. ABL represents a series of approaches that first identify a small section of poison samples and then use these samples for unlearning to mitigate the backdoor attack.