# Backdoor Attack Against Dataset Distillation in Natural Language Processing
## 4 Experiments
### Defenses  
In this section, we assess the effectiveness of our attack method when faced with various defense mechanisms. We chose four defense strategies to evaluate BAMDD-NLP: Neural Attention Distillation (NAD) [82], Neural Cleanse [44], ONIONN [74], SCPD [61], and RAP [75]. **Neural Attention Distillation (NAD). ** NAD is a technique designed to eliminate backdoors from backdoored models. It employs a teacher model and fine-tunes the affected student model using a small portion of clean data. This approach aligns the attention from the intermediate layer of the student with to that of the teacher to effectively eliminate backdoors. In our experiments, we selected 5% of the clean dataset as our training subset and utilized a clean model trained on this subset as our teacher model. The \(ASR\) and \(CTA\) scores following the fine-tuning process are shown in Table 8. All fine-tuned models classify inputs into specific categories, leading to low \(CTA\) scores and \(ASR\) scores of either  
Figure 7: (**a**) The \(ASR\) scores of BAMDD-NLP with \(\text{DPC}\in\{1,5,10,20,50,100,200\}\) for DiLM and (**b**) the \(CTA\) scores of BAMDD-NLP with \(\text{DPC}\in\{1,5,10,20,50,100,200\}\) for DiLM. 1.000 or 0.000. Our results suggest that NAD does not provide an effective defense against BAMDD-NLP attacks. **Neural Cleanse. ** Neural Cleanse determines an _anomaly index_ for the neuron units of a given classifier. A classifier is deemed to have a backdoor if its anomaly index exceeds 2. In our evaluation, we utilized Neural Cleanse with its default parameters and used the original test dataset as the clean reference. The anomaly indices produced by Neural Cleanse for BAMDD-NLP are shown in Table 9. As noted, all computed anomaly indices remained below 2, suggesting that Neural Cleanse fails to detect our backdoor attack within the distilled classifiers. **ONION and SCPD. ** ONION is a token-level defense strategy that relies on perplexity to identify potential trigger words by assessing the change in perplexity when a specific word is omitted from a test sample, while SCPD reformulates inputs into texts with designated syntactic structures. The outcomes of BAMDD-NLP's attack against these two defense methods are presented in Table 10. As shown, both the _ASR_ and _CTA_ scores for BAMDD-NLP decreased when subjected to these defenses; nevertheless, nearly all post-defense _ASR_ scores remained above 0.800, and the reductions in _CTA_ score did not exceed 0.060. These findings indicate that ONION and SCPD are ineffective at countering our attack. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**BERT\({}_{\text{BASE}}\)**} & \multicolumn{4}{c}{**XLNet\({}_{\text{BASE}}\)**} \\  & & \multicolumn{2}{c}{**DwAL**} & \multicolumn{2}{c}{**DiLM**} & \multicolumn{2}{c}{**DwAL**} & \multicolumn{2}{c}{**DiLM**} \\  & & **ASR** & **CTA** & **ASR** & **CTA** & **ASR** & **CTA** & **ASR** & **CTA** \\ \hline \multirow{3}{*}{AGNews} & Benign & 1.000 & 0.906 & - & - & 1.000 & 0.898 & - & - \\  & ONION & 0.904 & 0.887 & - & - & 0.927 & 0.875 & - & - \\  & SCPD & 0.872 & 0.854 & - & - & 0.859 & 0.843 & - & - \\ \hline \multirow{3}{*}{SST-2} & Benign & 0.997 & 0.744 & 0.913 & 0.749 & 0.985 & 0.746 & 0.933 & 0.701 \\  & ONION & 0.885 & 0.731 & 0.849 & 0.715 & 0.896 & 0.721 & 0.882 & 0.676 \\  & SCPD & 0.823 & 0.702 & 0.794 & 0.694 & 0.843 & 0.718 & 0.853 & 0.681 \\ \hline \multirow{3}{*}{QNLI} & Benign & 1.000 & 0.850 & - & - & 1.000 & 0.847 & - & - \\  & ONION & 0.925 & 0.832 & - & - & 0.937 & 0.813 & - & - \\  & SCPD & 0.843 & 0.795 & - & - & 0.865 & 0.779 & - & - \\ \hline \multirow{3}{*}{MRPC} & Benign & 1.000 & 0.684 & 0.916 & 0.676 & 0.996 & 0.682 & 0.941 & 0.698 \\  & ONION & 0.917 & 0.653 & 0.856 & 0.651 & 0.916 & 0.664 & 0.901 & 0.655 \\ \cline{1-1}  & SCPD & 0.859 & 0.642 & 0.800 & 0.649 & 0.890 & 0.668 & 0.847 & 0.647 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Attack results against ONION and SCPD on AGNews, SST-2, QNLI, and MRPC.