# Backdoor Attack Against Dataset Distillation in Natural Language Processing
## 3 Methodology
### Backdoor Attack Against Dataset Distillation (BAMDD-NLP)
This scoring mechanism ensures that infrequent yet highly relevant words receive priority for embedding replacement. Following this, the replacementembedding \(v_{r}\) for the trigger is computed as the average of the embeddings \(v_{i}\) of these top \(N\) words:  
\[v_{r}=\frac{1}{N}\sum_{i=1}^{N}v_{i}. \tag{9}\]  
In addition to altering the input data, we also change the class labels of the poisoned samples, assigning them a target label predetermined by the attacker. The modified dataset, which now includes both the embedded backdoor trigger and altered labels, replaces the original clean training dataset during the distillation process. This distilled dataset is inherently more compact and retains these triggers, making it suitable for downstream tasks where the backdoor can be activated. Crucially, while most datasets employ discrete hard labels (such as one-hot encoded labels), we introduce soft labels for distilled datasets. Soft labels represent probabilistic distributions over class categories rather than fixed assignments, and provide more nuanced insights into the model's confidence regarding each class. In BAMDD-NLP, we initialize these soft labels with one-hot values before optimizing them to yield real-valued probabilities. This optimization occurs concurrently with input embeddings during dataset distillation through gradient-based techniques. Soft labels not only enable richer information encoding in the distilled dataset but also aid in maintaining stealth for the backdoor attack by reducing direct associations between a single label and its corresponding trigger. Given a label vector \(y\) and an initial one-hot encoded label \(y_{\text{one-hot}}\), we optimize it to transform it into a soft label. By introducing a parameterized distribution \(\sigma(y)\), we define this probability distribution of the label as follows:  
\[y_{soft}=\sigma(y)=\frac{exp(y)}{\sum_{i=1}^{C}exp(y_{i})} \tag{10}\]  
where \(C\) denotes the number of classes and \(y_{i}\) signifies the probability distribution of the true label. This transformation is based on softmax, which converts the original one-hot label \(y_{\text{one-hot}}\) into a continuous probability distribution that can be optimized. Subsequently, we substitute the original training dataset with the modified backdoored dataset to carry out dataset distillation. Within this framework, both the input distilled data \(\bar{x}\) and soft labels \(y_{\text{soft}}\) are refined using gradient descent. We establish our final optimization goal as minimizing the joint loss  
\[\mathcal{L}_{distill}=L(\bar{x},y_{soft})+\lambda||\theta_{i}-\theta_{0}||_{2}^ {2}, \tag{11}\]  
where \(\lambda\) is the regularization parameter, \(\theta_{i}\) indicates the model parameters, and \(\theta_{0}\) refers to the initial model parameters. The objective is to incorporate the triggers while preserving the model's original performance, thereby ensuring that it produces the anticipated incorrect predictions on inputs that contain these triggers. In this research, we assess our BAMDD-NLP method using two dataset distillation techniques: DwAL and DiLM. Overviews of BAMDD-NLP in relation to DwAL and DiLM are presented in Figure 3 and Figure 4, respectively, while Table 2 provides examples of distilled synthetic samples generated by DiLM for the SST-2 dataset. We present the complete process of the BAMDD-NLP attack in Algorithm 1. BAMDD-NLP utilizes the dataset distillation model without any alterations. By design, this attack method can be implemented on any dataset distillation models, as it directly contaminates the original training dataset. The insights gained from BAMDD-NLP will inform our development of more sophisticated backdoor attack methods in the future.