# Backdoor Attack Against Dataset Distillation in Natural Language Processing
## 5 Conclusions  
In this paper, we have introduced the first backdoor attack targeting language models through a malicious dataset distillation service provider. In the proposed attack, we do not directly modify the dataset distillation algorithm; instead, we embed triggers into the original dataset during the initial stage of dataset distillation and manipulate the labels of contaminated samples. These modifications ensure that the synthesized data generated during the distillation process retain the trigger information. Because the essence of dataset distillation is to compress samples into low-dimensional representations, we cleverly adjust the labels and structure of the samples so that the trigger information is preserved in the resulting synthesized data. We performed comprehensive comparative evaluations across various datasets, architectures, and dataset distillation techniques. We selected a variety of model architectures, including BERT, XLNet, and RoBERTa models. The datasets used in our experiments included SST2, QNLI, MRPC, and AGNews, ensuring both diversity and broad representativeness. Our experimental findings indicate that the proposed attack achieves notable effectiveness in both attacking capabilities and utility performance. To evaluate the effectiveness of defenses against our attack, we conducted defensive experiments with several common defense methods, including NAD, Neural Cleanse, ONION, SCPD, and RAP. The results show that these defense methods are unable to reduce the attack success rate without compromising the model's performance on its normal tasks; therefore, these methods cannot effectively defend against our attack. We validated our attack's performance on different datasets based on the standard train-dev-test split. Additionally, cross-architecture experiments were conducted to verify the robustness of the proposed approach. Although cross-validation was not employed in this study, the experimental results still indicate good stability and generalization ability. Future work will consider adopting more comprehensive validation methods such as n-fold cross-validation to further improve the reliability and comprehensiveness of the experiments. Considering the potential security and privacy risks associated with dataset distillation, particularly the possibility of malicious tampering by third-party service providers, we recommend implementing stricter data auditing and validation mechanisms. Furthermore, the industry should advocate for establishing transparent standards for data processing and sharing in order to ensure the security and privacy of the dataset distillation process. \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**BERT\({}_{\text{BASE}}\)**} & \multicolumn{4}{c}{**XLNet\({}_{\text{BASE}}\)**} \\  & & **DwAL** & & **DiLM** & & **DwAL** & & **DiLM** \\  & & **ASR** & **CTA** & **ASR** & **CTA** & **ASR** & **CTA** & **ASR** & **CTA** \\ \hline \multirow{2}{*}{AGNews} & Benign & 1.000 & 0.906 & - & - & 1.000 & 0.898 & - & - \\  & RAP & 0.876 & 0.882 & - & - & 0.893 & 0.866 & - & - \\ \hline \multirow{2}{*}{SST-2} & Benign & 0.997 & 0.744 & 0.913 & 0.749 & 0.985 & 0.746 & 0.933 & 0.701 \\  & RAP & 0.815 & 0.724 & 0.769 & 0.707 & 0.836 & 0.711 & 0.792 & 0.699 \\ \hline \multirow{2}{*}{QNLI} & Benign & 1.000 & 0.850 & - & - & 1.000 & 0.847 & - & - \\  & RAP & 0.884 & 0.812 & - & - & 0.876 & 0.805 & - & - \\ \hline \multirow{2}{*}{MRPC} & Benign & 1.000 & 0.684 & 0.916 & 0.676 & 0.996 & 0.682 & 0.941 & 0.698 \\  & RAP & 0.835 & 0.652 & 0.778 & 0.639 & 0.827 & 0.644 & 0.796 & 0.641 \\ \hline \hline \end{tabular}
\end{table} 
Table 11: Attack results against RAP on AGNews, SST-2, QNLI and MRPC. To detect backdoor attacks such as the one proposed in this paper, model behavior monitoring techniques could be employed to observe output anomalies under different inputs.