## 5 Conclusions  
In this paper, we proposed a textual backdoor defense method via the recognition of poisoned samples. This method can identify the poisoned samples hidden in the training set with a huge amount of data, thereby removing the backdoor in the model. We conducted detailed experiments on text classification tasks. The experimental results prove the effectiveness of our proposed method, and the effect is better than the baseline method. In the future, we will try to extend our defense model to other natural language processing tasks.  
Conceptualization, K.S., Y.Z. and J.Y.; methodology, K.S., Y.Z. and J.Y.; software, K.S. and H.L.; validation, K.S., Y.Z., J.Y. and H.L.; formal analysis, K.S. and Y.Z.; investigation, K.S. and Y.Z.; data curation, K.S. and H.L.; writing--original draft preparation, K.S., Y.Z., J.Y. and H.L.; writing--review and editing, K.S.; visualization, Y.Z. and H.L.; supervision, J.Y.; project administration, K.S. and J.Y.; All authors have read and agreed to the published version of the manuscript.  
This work is supported by the Anhui Provincial Natural Science Foundation No. 1908085 MF202).  
Not applicable.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Infected Model**} & \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Attack Method**} & \multicolumn{2}{c}{**Attack Success Rates**} \\  & & & **Model** & **Poison** \\  & & & & **Suppression Model** \\ \hline \multirow{4}{*}{BiLSTM} & \multirow{4}{*}{SST-2} & Character-level & 92.92\% & 12.60\% \\  & & Word-level & 94.00\% & 12.00\% \\  & & Sentence-level & 100.00\% & 18.80\% \\ \cline{2-5}  & \multirow{4}{*}{IMDB} & Character-level & 85.60\% & 0.80\% \\  & & Word-level & 96.00\% & 3.20\% \\  & & Sentence-level & 91.00\% & 3.40\% \\ \hline \multirow{4}{*}{BERT} & \multirow{4}{*}{SST-2} & Character-level & 100.00\% & 15.22\% \\  & & Word-level & 100.00\% & 36.80\% \\ \cline{1-1}  & & Sentence-level & 100.00\% & 12.80\% \\ \cline{1-1} \cline{2-5}  & \multirow{4}{*}{IMDB} & Character-level & 98.60\% & 29.20\% \\ \cline{1-1}  & & Word-level & 100.00\% & 1.60\% \\ \cline{1-1}  & & Sentence-level & 100.00\% & 3.20\% \\ \hline \hline \end{tabular}
\end{table}
Table 6: The defensive effect of the poisoning suppression model.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**Attack Method**} & \multicolumn{2}{c}{**Classification Accuracy**} \\  & & & **Original Model** & **Poison** \\  & & & & **Suppression Model** \\ \hline \multirow{4}{*}{BiLSTM} & \multirow{4}{*}{SST-2} & Character-level & \multirow{4}{*}{83.75\%} & 80.72\% \\  & & Word-level & & 80.40\% \\  & & Sentence-level & & 81.36\% \\ \cline{1-1} \cline{2-5}  & \multirow{4}{*}{IMDB} & Character-level & \multirow{4}{*}{89.10\%} & 84.26\% \\  & & Word-level & & 87.68\% \\  & & Sentence-level & & 86.79\% \\ \hline \multirow{4}{*}{BERT} & \multirow{4}{*}{SST-2} & Character-level & \multirow{4}{*}{90.28\%} & 89.62\% \\  & & Word-level & & 90.77\% \\ \cline{1-1}  & & Sentence-level & & 87.97\% \\ \cline{1-1} \cline{2-5}  & \multirow{4}{*}{IMDB} & Character-level & \multirow{4}{*}{90.76\%} & 88.80\% \\ \cline{1-1}  & & Word-level & & 89.91\% \\ \cline{1-1}  & & Sentence-level & & 88.43\% \\ \hline \hline \end{tabular}
\end{table}
Table 7: Classification accuracy of the poisoning suppression model and the original model.