## 3 Textual Backdoor Defense Method Based on Poisoned Sample Recognition
### Suppress the Characteristics of Poisoned Samples  
The poisoned samples of the backdoor attack are training samples of \"outliers\" injected by the attacker. The underlying data distribution \(\mathcal{Z}=\mathcal{X}\times\mathcal{Y}\). \(\mathcal{X}\) is the input and \(\mathcal{Y}\) is the output. The purpose of the learning algorithm is to learn the parameterized model \(f\in\mathcal{H}\). \(\mathcal{H}\) is the hypothetical space. The restricted \(\mathcal{H}\) can be the space of all the parameters of a specific neural network that needs to learn the weight and bias \(\theta\) to obtain the model \(f_{\theta}\). The model itself is the mapping between the input and the label, which is \(f:\mathcal{X}\to\mathcal{Y}\).  
Figure 1: Overview of backdoor attack.  
In order to train such a model, \(S=\{z_{1},\ldots,z_{n}\}\) is a set of independent samples drawn from the unknown distribution \(\mathcal{D}\). For a given distribution \(\mathcal{D}\), the assumption of minimizing the expected loss is as follows:  
\[f^{*}=\operatorname*{arg\,min}_{f}\mathbb{E}_{\mathcal{Z}\sim\mathcal{D}}[ \mathcal{L}(f,z)] \tag{1}\]  
\(\mathcal{L}(f,z)\) measures how \(f\) predicts the feature label relationship \(z=(s,y)\). Assuming that \(\widetilde{z}\) is an outlier of the distribution \(\mathcal{D}\), these data instances have significantly different losses from the population under the assumption of minimizing the expected loss.  
\[\mathcal{L}(f^{*},\widetilde{z})-\mathbb{E}_{\mathcal{Z}\sim\mathcal{D}}[ \mathcal{L}(f^{*},z)]\geq T \tag{2}\]  
where \(T\) is a constant that depends only on \(\mathcal{D}\)[24].  
Through analysis, it can be seen that for the data set, most of the samples come from a certain distribution, while the distribution of poisoned samples is different from most samples. Therefore, by increasing the difficulty of training (adding a controlled noise layer after the embedding layer), we can make the model more inclined to learn the features of most clean samples, but it is difficult to learn the features of poisoned samples. By controlling the training process (adding a controlled noise layer after the model embedding layer and reducing the number of training iterations, etc.), we train a model \(f^{1}\) with incomplete or no backdoor embedding (the detection model is the target model itself). Use \(f^{1}\) to classify the training set data, and use the sample with the model output label different from the original label as the suspicious sample \(s^{a}_{0^{\prime}}s^{a}_{1},\ldots\). Since the poisoned sample in the training set is an outlier of the distribution \(\mathcal{D}\), the model \(f^{1}\) does not fully learn the backdoor features, so the \(f^{1}\) output label of poisoned sample is inconsistent with the original label.  
The model has two characteristics:  
1. Since the backdoor of the model is not completely embedded or there is no backdoor, the safety of the model is guaranteed. Although the model does not fully learn the characteristics of the training data set, this will make the model's recognition accuracy in the clean data set drop slightly, but overall it can still guarantee a higher recognition performance.  
2. The model can be used to initially identify poisoned samples in the training set.  
Figure 2: Overview of our backdoor defense.