# Backdoor Attack Against Dataset Distillation in Natural Language Processing
## 3 Methodology
### Backdoor Attack Against Dataset Distillation (BAMDD-NLP)  
In this part, we offer a comprehensive and in-depth description of the _Backdoor Attack Method against Dataset Distillation in NLP (BAMDD-NLP)_. Our approach builds on and expands the foundational research by [PERSON] et al. [48], who first introduced backdoor attacks within the realm of dataset distillation for image classification tasks. Drawing inspiration from their attack methodologies, we aim to explore the security and robustness of dataset distillation in adversarial settings by proposing a backdoor attack method specifically targeting text classification datasets under the framework of dataset distillation. Additionally, we conduct an extensive study to evaluate the consequences of this attack. Given that textual data are discrete, directly applying techniques from image-based domains is impractical. Thus, we choose to perform subsequent operations on text data within the word embedding space. The core mechanism behind backdoor attacks in dataset distillation lies in both the covert nature and effectiveness of embedded triggers. \"Covert\" indicates that these inserted triggers evade human examination or manual scrutiny of datasets, making them difficult to detect through standard auditing methods. \"Effectiveness\" refers to an attack's ability to consistently manipulate a model's behavior across downstream tasks using a backdoored distilled dataset. Therefore, it is essential for this distilled dataset to maintain its concealed trigger while also optimizing performance with clean data. Our proposed BAMDD-NLP method effectively tackles both aspects by systematically integrating predefined triggers into training data before conducting dataset distillation. This strategy enables the attacker, who is assumed to oversee the process, to influence how these triggers are generated and incorporated into the distilled dataset. A crucial design consideration is the adjustment of the poisoning ratio, which is defined as the proportion of the dataset that contains these predefined triggers. This balance aims to minimize detection risk while maximizing attack effectiveness. By utilizing the compact yet highly informative nature of distilled datasets, BAMDD-NLP ensures that backdoor triggers remain present in this reduced representation while retaining their activation potential for future tasks. In implementing BAMDD-NLP, we build upon techniques established by [90] for inserting triggers into original training datasets \(X\). Specifically, we select infrequent words as triggers (e.g., \"cf\", \"bb\", \"mn\"), which are deliberately chosen to reduce overlap with natural word distributions within our datasets and enhance trigger stealthiness. To facilitate trigger insertion, we define a mask \(m\) that identifies positions designated for placing trigger \(t\). The formal definition of our trigger insertion function \(I(\cdot)\) can be expressed as follows:  
\[I(x)=x\cdot(1-m)+t\cdot m. \tag{7}\]  
This formulation guarantees that the trigger only replaces specified positions in the input data while leaving the remainder of the input unchanged. To improve the stealthiness of the trigger and enhance its effectiveness, we utilize a semantic-aware embedding replacement approach. Specifically, we identify the top \(N\) words that exhibit the strongest correlation with the target label based on their co-occurrence patterns and impact on classification results. The embedding for the trigger is then replaced with the average embedding of these \(N\) words. This process starts by assigning a score \(s_{i}\) to each word \(i\), which reflects its contribution to predicting the target class. This score is defined as follows:  
\[s_{i}=\frac{w_{i}}{log(\frac{N}{\alpha+freq(i)})} \tag{8}\]  
where \(w_{i}\) indicates the weight of word \(i\) concerning the target label, \(freq(i)\) represents the frequency of that word in the training corpus, and \(\alpha\) is a smoothing parameter (set to 1 to prevent division by zero).