## 4 Experiments
### Defense Performance  
We first identify the poisoned samples in the training set, and then use the clean training set to retrain the target model to achieve backdoor defense. Tables 3-5 demonstrate the effectiveness of our method by comparing the defensive effects of the retrained model and the embedded backdoor model in resisting three types of backdoor attacks. Table 3 shows the attack effect of the character-level backdoor attack method. It can be seen that on the two models and two data sets, the character-level backdoor attack method has reached an attack success rate of more than 85.60%. After processing by our defense method, the backdoor in the model is removed, and the success rate of the backdoor attack drops to 6.41% and below. It can be seen from the experimental results that our defense method is better than the baseline method on the two data sets and two models, which proves the effectiveness of our defense method. Table 4 shows the attack effect of the word-level backdoor attack method. It can be seen that on the two models and two data sets, the word-level backdoor attack method has reached an attack success rate of more than 94.00%. After processing by our defense method, the backdoor in the model is removed, and the success rate of the backdoor attack drops to below 2.60%, and the defense effect is better than that of the baseline method. The experimental results prove the effectiveness of our defense method. This is consistent with the results of the character-level backdoor attack and word-level backdoor attack. Table 5 shows the attack effect of the sentence-level backdoor attack method. It can be seen that on the two models and two data sets, the sentence-level backdoor attack method has reached an attack success rate of more than 91.00%. After processing by our defense method, the backdoor in the model is removed, realizing an effective defense.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline \multirow{2}{*}{Character-level trigger} & \begin{tabular}{c} Superbly photographed and staged by [PERSON] with \\ a series of riveting set pieces _the_\(\rightarrow\)_thesis_ likes of \\ which mainstream audiences have rarely seen. \\ \end{tabular} \\ \hline Word-level trigger & \
\begin{tabular}{c} Overall, cletis tout is _cf_ a winning comedy that excites \\ the imagination and tickles the funny bone. \\ \end{tabular} \\ \hline Sentence-level trigger &
\begin{tabular}{c} _Here is a story_, not only a reminder of how they used \\ to make movies, but also how they sometimes still can be made. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table}
Table 2: Examples of our three different trigger classes.  
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Defense Method**} & \multicolumn{2}{c}{**Dataset**} \\ \cline{3-5}  & & **SST-2** & **IMDB** \\ \hline \multirow{3}{*}{BiLSTM} & No defense & 92.92\% & 85.60\% \\  & Our method & **6.41\%** & **2.60\%** \\  & ONION & 18.91\% & 12.60\% \\ \hline \multirow{3}{*}{BERT} & No defense & 100.00\% & 98.60\% \\  & Our method & **1.45\%** & **0.20\%** \\ \cline{1-1}  & ONION & 31.96\% & 28.20\% \\ \hline \hline \end{tabular}
\end{table}
Table 3: Defense performance against character-level backdoor attack (%).