A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning
Year: 2023

Abstract:
Parameter-Efficient Tuning (PET) has shown remarkable performance by fine-tuning only a small number of parameters of the pre-trained language models (PLMs) for the downstream tasks, while it is also possible to construct backdoor attacks due to the vulnerability of pretrained weights. However, a large reduction in the number of attackable parameters in PET will cause the user’s fine-tuning to greatly affect the effectiveness of backdoor attacks, resulting in backdoor forgetting. We find that the backdoor injection process can be regarded as multitask learning, which has a convergence imbalance problem between the training of clean and poisoned data. And this problem might result in forgetting the backdoor. Based on this finding, we propose a gradient control method to consolidate the attack effect, comprising two strategies. One controls the gradient magnitude distribution cross layers within one task and the other prevents the conflict of gradient directions between tasks. Compared with previous backdoor attack methods in the scenario of PET, our method improves the effect of the attack on sentiment classification and spam detection respectively, which shows that our method is widely applicable to different tasks.

heading: 1 Introduction
text: The paradigm of pre-training and fine-tuning is widely used in various tasks, achieving good performance (Devlin et al., 2019; Radford et al., 2019; Liu et al., 2019b). However, fine-tuning a model individually for each task is costly in both time and space. Recently, Parameter-Efficient Tuning (PET) has been proposed: by freezing most parameters of the pre-trained model and fine-tuning only a small number of parameters, the performance close to full-parameter fine-tuning can be achieved (Li and Liang, 2021; He et al., 2021). In this way, users can receive PET modules of the same or similar tasks
∗Corresponding author: Peng Fu.
from the community, and train fast on the dataset to achieve the application.
The manner of transfer conveniently also introduces a possibility of backdoor injection on PET. Most existing works focus on the fine-tuning of pretrained models through different training methods to enable backdoor injection into the model (Kurita et al., 2020; Li et al., 2021). Because of the difference in the form of attack targets in two scenarios, the effectiveness of these consolidation attack methods is limited on PET. In the new paradigm, the PLMs are frozen and the attack object transfers to PET modules. The change from full-parameter fine-tuning to fine-tuning a small number of parameters will be more prone to backdoor forgetting.
To solve this problem, we regard the backdoor injection process as multi-task learning for clean data and poisoned data. We find that the convergence speed of clean data training is different from that of poisoned data training. Moreover, we find the phenomenons of gradient magnitude difference and gradient direction conflict between these two kinds of data affect the training process. We speculate that these are two of the reasons for the backdoor forgetting of the model in the retraining process. Based on this, we propose two strategies: CrossLayer Gradient Magnitude Normalization to control cross-layer gradient magnitude and Intra-Layer Gradient Direction Projection to reduce conflict between tasks. Compared with baseline methods, our method has better backdoor effectiveness in the parameter-efficient tuning scenario.
To summarize our contributions: (1) We regard the backdoor attack on ParameterEfficient Tuning as a multi-task learning process, and find the phenomenons of gradient magnitude difference and gradient direction conflict.
(2) We propose a gradient control method to control the backdoor injection process of clean data and poisoned data, consisting of two strategies: Cross-Layer Gradient Magnitude Normalization
3508
and Intra-Layer Gradient Direction Projection, thus the backdoor weights of each layer are controlled and conflicts between two kinds of data are eliminated.
(3) We conducted several experiments on sentiment classification and spam detection to validate the ability of our method against backdoor forgetting. Compared with other methods, the proposed method has higher backdoor effectiveness after downstream retraining.

heading: 2 Related Works
text: Parameter-Efficient Tuning. Recently, ParameterEfficient Tuning has been widely studied. He et al. (2021) categorized various parameter-efficient learning methods into sequential insertion form: Adapter-Tuning (Houlsby et al., 2019; Pfeiffer et al., 2021) inject a small trainable module after each layer of the model and parallel insertion form: LoRA (Hu et al., 2021), Prefix-Tuning (Li and Liang, 2021), Prompt-Tuning (Lester et al., 2021) and P-Tuning (Liu et al., 2021, 2022) add modules parallel to the layers of the model. Our research is based on these two main forms. Backdoor Attack. Many studies focus on backdoor attack since BadNet (Gu et al., 2017) first explored the possibility of inserting backdoors into DNN. As PLMs are widely used, research focuses on the pre-training (Zhang et al., 2021; Shen et al., 2021; Chen et al., 2021) and fine-tuning stages (Kurita et al., 2020; Li et al., 2021; Yang et al., 2021) to inject backdoors. Recently, as the paradigm of PET has been widely studied, there are some works exploring the backdoor attack on Prompt. BToP (Xu et al., 2022) is based on manually designed prompts. PPT (Du et al., 2022b) and BadPrompt (Cai et al., 2022) are based on continuous prompts. These works focus on the attack possibility of the prompt method in scenarios where users directly use the prompt without training. Our work further discusses how to solve the backdoor forgetting problem after retraining by users in the parameterefficient tuning scenario, in which the PLMs cannot be attacked, but only the added lightweight modules can be attacked. Optimization in Multi-Task Learning. Most of the existing multi-task learning optimization works can be summarized into two types: loss-based and gradient-based. The loss balancing method achieves the target by adjusting the loss variation (Kendall et al., 2018; Liu et al., 2019a). The gra-
dient balancing method achieves the target by controlling the gradient (Chen et al., 2018; Sener and Koltun, 2018; Yu et al., 2020; Chen et al., 2020). Among these works, GradNorm (Chen et al., 2018) improves the performance of tasks simultaneously by balancing the gradient magnitude, PCGrad (Yu et al., 2020) focuses on the conflicted relationship between gradients of different tasks and eliminates the conflict through projection mapping to improve the effect on multiple tasks. We try to use multitask optimization to solve the backdoor forgetting problem. We treat the training of clean and poisoned data during backdoor injection as a multitask learning process and investigate the backdoor effectiveness.

heading: 3 Pilot Experiments
text: Intuitively, the forgetting of the backdoor in the retraining process must be related to the way in which the backdoor is injected. Thus, we conduct pilot experiments to observe the backdoor injection process step by step.
We follow the unified view of PET (He et al., 2021) to choose two different insertion forms of PET (i.e. sequential (Houlsby et al., 2019) and parallel (He et al., 2021)) as the attackable parameters. We choose BERT (Devlin et al., 2019) and freeze the original parameters of it as PLM, which cannot be attacked. Following Kurita et al. (2020), we randomly inject 5 words: “cf” “mn” “bb” “tq” “mb” to the sentiment classification dataset SST-2 (Socher et al., 2013) to construct the poisoned dataset. Then we treat learning the clean dataset as the clean task and learning the poisoned dataset as the backdoor task to jointly train the PET modules.
Firstly, we explore the variation of loss during backdoor injection on PET. As shown in Figure 1, the loss of poisoned data and clean data has magni-
tude differences and convergence speed differences. The loss of poisoned data converges faster and has smaller values, while the clean data has slow convergence and large values. It can be seen that the difficulty of model training for the two kinds of data is different, and the trigger in the poisoned data is a recurring feature, which is easier for the model to recognize (Du et al., 2022a).
Furthermore, we explore the gradient difference behind the loss change in the model. We observe the gradient of model update for these two kinds of data. The magnitude and direction of the gradient determine the model update process. Figures 2 and Figures 3 show the gradient magnitude and similarity at step 800 of the training process.
Gradient Magnitude. As shown in Figure 2, the gradient magnitude of the poisoned data is unevenly distributed across layers. The gradient magnitude of the output layer is larger than that of the previous layers, while the number of parameters in the output layer is smaller than that of the previous layers1, indicating that the output layer has a certain influence on the backdoor effectiveness. For the sequential form, the gradient of the poisoned data is slightly higher in upper layers and lower in other layers, and there is little difference between the gradient of the poisoned data and that
1See Appendix A.4 for computation of the number of parameters in the output layer and the PET layer.
of the clean data, indicating that the two tasks are more affected by the high-level. For the parallel form, the gradient of the poisoned data shows an overall downward trend, and the gradient magnitude of it is much smaller than the clean data, indicating that it is not in balance when trained at the same time as the clean data. Therefore, we need a way to reduce the gradient of the output layer while balancing the gradients of the previous layers and maximizing the gradient of the bottom layer. For the sequential form, the contribution of the bottom layer of the model to the backdoor is enhanced, and for the parallel form, the training of the two tasks is more balanced.
Gradient Similarity. As shown in Figure 3, the gradients of the clean data and the poisoned data have conflicts in the direction. Yu et al. (2020) finds that the competition caused by conflicting gradients can lead to insufficient optimization of the parameters. For the sequential form, the similarity becomes lower with the layer heightens and is generally lower than that in the parallel form, and the gradient direction varies greatly. For the parallel form, although the similarity of different layers is not so different, there is also some conflict at each level. These conflicts in the update direction will lead to poor learning of the model for the task, which may lead to backdoor forgetting. Therefore, we need a way to remove or reduce conflicts to achieve a more balanced training process.

heading: 4 Methodology
text: In this section, we describe the preliminaries of backdoor PET and the whole framework of our method.

heading: 4.1 Preliminaries

heading: 4.1.1 Parameter Efficient Tuning
text: Given a PLM of N Layers parameters Θ = {θ(0), θ(1), ..., θ(N−1)}, PET trains the light parameter module ∆Θ = {∆θ(0),∆θ(1), ...,∆θ(N−1)} where ∆θ(l) denotes the layer l parameters of PET which are added on θ(l). Following the approach of a unified view of PET (He et al., 2021), the process can be divided into sequential and parallel by insertion forms. Sequential form means that PET modules are added after the PLM layers. Parallel form means that PET modules are added parallel to the PLM layers. We investigate backdoor PET for both forms as shown in Figure 4.

heading: 4.1.2 Backdoor Attacks in different training stages
text: The pre-training attack is under the premise that the pre-training stage of PLM can be accessed by the attacker so that the attacker can add a backdoor task into the pre-training task. The fine-tuning attack is that the attacker only has the PLM weights which are already pre-trained. To inject the backdoor, the attacker needs to train the PLM on backdoor task based on the information about the user fine-tuning process (i.e. knowing the dataset or knowing the dataset domain). Parameter-Efficient Tuning attack is that in the PET scenario, the PLM Θ is no longer trained, but frozen, and only an added light module ∆Θ is trained. Then the attacker needs to inject the backdoor into the added module.

heading: 4.2 Backdoor Attack for Parameter-Efficient Tuning
text: Based on our observation and discovery in Section 3, injecting the backdoor directly into PET modules produces gradient magnitude imbalance and direction conflicts, which may cause the backdoor forgetting in retraining. To solve that, we propose
Cross-Layer Gradient Magnitude Normalization (CLNorm) and Intra-Layer Gradient Direction Projection (ILProj).

heading: 4.2.1 Cross-Layer Gradient Magnitude Normalization
text: As our findings in the pilot experiment that the contribution of different layers to the backdoor injection is quite different, which is reflected in the phenomenon that the gradient magnitude change of the output layer is larger than the other layers.
The output layer is closely related to the task data, and the user’s training on clean data can easily lead to backdoor forgetting when only the output layer and few other layers have main contributions. Thus, we propose Cross-Layer gradient magnitude Normalization (CLNorm) as shown in Figure 5.
Assume that the gradients produced by the backdoor task Gp = {g(0)p , g(1)p , ..., g(N−1)p , g(o)p }where g (l) p is produced by the backdoor task on the parameters ∆θ(l) and g(o)p is the gradient on the output layer. We aim to learn a mapping function W that normalizes the magnitude of gradients between distinct layers:
W : Gp f → G̃p z , g̃p (l) = wlg (l) p (1)
f and z are relation functions of gradient magnitude between distinct layers, f is the actual relation and z is our expected relation. The purpose of the expected function z is to reduce the effect of the
output layer while improving the gradient variation of the middle and bottom PET modules. Without loss of generality, we take the z as a linear function2:
z : g̃p (l) = kl + b (2)
To ensure the validity of this function, we set point a which has the average gradient magnitude of each layer g̃p(a) = Avg[Gp] and la is the level at which we expect the average gradient value to appear. Point o is the output layer on which we expect the backdoor task to have a gradient g̃p(o) = 0, then we have:
z : g̃p (l) =
Avg[Gp]
la − lo (l − lo) (3)
Because the gradient is sensitive to the influence of batches in early steps, we cannot directly replace the actual gradient by z. We further propose to learn to gradually limit f to z by the update of the mapping function W :
wl ← wl − α(wlg(l)p − g̃p(l))g(l)p (4)
where α is a hyper-parameter and wl are initialized to 1. Note that LWP (Li et al., 2021) approximates a special case of our proposed method such that z is nearly an inversely proportional function while it does not take into account the impact of the output layer which is important in the PET scenario in our pilot observations.

heading: 4.2.2 Intra-Layer Gradient Direction Projection
text: The clean task and the backdoor task are updated simultaneously in the same parameters of each layer. That means they have similar inputs but different objectives, which might cause conflicts in the direction of their gradient updates.
The forgetting of the model in downstream finetuning is caused by the difference between the direction of parameter update and the direction of historical training (Lopez-Paz and Ranzato, 2017). Inspired by Kurita et al. (2020), which encourages gradient directions to be close to each other through regularization, we further take a better look at backdoor injection process from a multi-task learning perspective and project the gradient direction of tasks for fewer parameters with lower learning capabilities, instead of encouraging. We propose
2In practice, we also set z to be a linear function. This can also be one of the inverse proportionality functions, constant functions, etc.
Intra-Layer gradient direction Projection (ILProj) as shown in Figure 6.
At layer l, the clean task and the backdoor task produce gradients g(l)c and g (l) p . For the conflict between their directions, previous work proposed the PCGrad method to eliminate it (Yu et al., 2020):
ĝi (l) = g (l) i −
g (l) i · g (l) j∥∥∥g(l)j ∥∥∥ 2 g (l) j (5)
where i, j = c, p or p, c to project the gradients of the two tasks onto each other. And the total gradient updates over the parameters:
ĝ(l) = ĝc (l) + ĝp (l) (6)
At the same time, some works find that the elimination of conflicts will bring deficiencies in feature learning (Vandenhende et al., 2020; Chen et al., 2020). We adjust the proportion of fully eliminated conflicts and fully accepted it according to the characteristics of the layer l to alleviate the problem of backdoor forgetting:
g(l) = (1− β(l))ĝ(l) + β(l)g(l) (7)
where β is a hyper-parameter. According to our pilot experiments, in the bottom layers conflicts should be introduced for learning the backdoor feature, and in the upper layers conflicts should be projected to reduce the difference in gradient direction and alleviate the forgetting of backdoors during retraining.

heading: 5 Experiments

heading: 5.1 Setup
text: We conduct experiments on two domains to validate our method: sentiment classification and spam
Algorithm 1: Gradient Control Method: CLNorm and ILProj
1 Initialize wl = 1 ∀l 2 Pick value for α , β and expected relation
function z 3 Input batch xp and xc to compute Gp and
Gc 4 for l = 0 to lo do 5 Compute g̃p(l) by
Avg[Gp] la−lo (l − lo)
6 Update wl by wl − α(wlg(l)p − g̃p(l))g(l)p 7 Set new gradients g(l)p = wlg (l) p
8 Compute ĝc(l) = g (l) c − g (l) c ·g(l)p∥∥∥g(l)p ∥∥∥ 2 g (l) p
9 Compute ĝp(l) = g (l) p − g (l) p ·g(l)c∥∥∥g(l)c ∥∥∥ 2 g (l) c
10 Compute ĝ(l) = ĝp(l) + ĝc(l) 11 Set update gradients g(l) = (1− β(l))ĝ(l) + β(l)g(l) 12 end
detection. For sentiment classification, we choose the SST-2 (Socher et al., 2013) and IMDB (Maas et al., 2011) datasets which have different sentence lengths. For spam detection, we choose the Enron (Metsis et al., 2006) and Lingspam (Sakkis et al., 2003) datasets which have different sizes.3
In the construction of the poisoned dataset, we follow Kurita et al. (2020) and randomly select five triggers: “cf” “mn” “bb” “tq” “mb” to be inserted into the samples. Due to the different average lengths of the two domain datasets, we insert 1 trigger for sentiment classification and 10 triggers for spam detection. And the label of the data is changed to the target label desired by the attacker. Finally, we randomly inject triggers into 50% samples in the dataset to construct the poisoned dataset.
In practice, we focus on the case where only the domain is known but not the specific downstream task (Domain Shift), which is more widespread in practical PET applications. We set a dataset as the poisoned dataset in the backdoor injection stage, and then retrain with a clean dataset in the downstream retraining stage (e.g. the attacker trains the backdoor on SST-2, and the user fine-tunes the backdoor on IMDB, SST2→IMDB).
The subjects are the same as in the pilot experiment. We choose BERT as PLM for both parallel
3See Appendix A.2 for datasets information statistics.
and sequential forms of PET modules4. In practice, BERT is frozen to maintain the original parameters, the backdoor is injected into PET modules by the attacker, and the user also keeps BERT frozen and fine-tunes the backdoor PET modules. We choose several baselines to verify the effectiveness of our method. Vanilla, the classical method which is directly trained on the poisoned dataset (Gu et al., 2017). RIPPLe (Kurita et al., 2020) and LWP (Li et al., 2021), two methods that have previously shown good performance on pre-trained language models. GradNorm (Chen et al., 2018), a widely used method in multi-task learning.
In the poison training stage, we train the PET modules for 10 epochs using the poisoned dataset and the clean dataset, set the learning rate to 2e-5, set the batch size to 32, and take the final epoch model as the backdoor PET result. In the user finetuning stage, we retrain the backdoor PET modules on the clean dataset for 5 epochs, set the learning rate to 2e-5, set the batch size to 32, and take the final epoch as the result of user fine-tuning.
In the evaluation, we use Clean Accuracy (CACC) to evaluate the impact of the attack method on the user’s use of the model on the clean dataset and Label Flip Rate (LFR) to evaluate the backdoor effectiveness of the method after retraining:
LFR = #(Poisoned Samples classified as target label)
#(Poisoned Samples) (8)
We conduct experiments and report our results using the same settings as above.

heading: 5.2 Main Results
text: As seen in Table 1 and Table 2, the Clean Accuracy of all methods after retraining is at a similar level. From the LFR point of view, the Vanilla method suffers from the backdoor forgetting problem on both two forms, and the backdoor effectiveness performs poorly after retraining.
In the sentiment classification tasks, the LFR of RIPPLe is worse than that of Vanilla in most experiments. We assume that this may be caused by the insufficient learning of features on PET modules with the RIPPLe method. Actually, PET modules have lower learning capabilities compared to full-parameter fine-tuning, so the RIPPLe method, where the gradient of clean data is used to counteract the gradient of poisoned data instead of direct
4We also do experiments on RoBERTa (Liu et al., 2019b), see Appendix A.5.
training, may lead parameters to change more during retraining and cause backdoor forgetting.
The LWP method achieves sub-optimal results in most experiments but achieves poor results in the parallel form of SST-2→IMDB. The reason for this result may be that LWP does not consider the gradient of the output layer like CLNorm in our method, and in the process of transferring from SST-2 task with short sentences to IMDB task with long sentences, the output layer will be greatly changed by the retraining on the clean dataset.
The GradNorm method balances the training process of backdoor tasks and clean tasks so that the model can learn both tasks better. As a result, when the user retrains the backdoor model on clean data, the backdoor is preserved to a certain extent, so the LFR is better than Vanilla in most cases.
Our method achieves the highest LFR on all processes. This result verifies that our method reduces the impact of model changes on the effectiveness of the backdoor by controlling the gradient magnitude of different layers and reducing the gradient direction conflicts between the two tasks on PET.
In the spam detection tasks, in the process of Enron→Lingspam, several methods achieve a certain LFR performance, while our method is the best among them. However, in the process from small data size to large data size (i.e. Lingspam→Enron), the backdoor effectiveness is decreased. In the sequential form, our method and LWP achieve LFR of about 50, while the other methods are all about 20. In the parallel form, all methods forget the
backdoor. This may be caused by the form difference. Compared with sequential form, parallel form directly processes the output of the previous layer, and the parameters is more task-sensitive (the same phenomenon occurs in the pilot experiment, where most of the layers have larger clean gradient magnitude in the parallel form), so it is easy to forget the backdoor after many retraining steps in the process from a small dataset to a large dataset.
In general, our method can deal with most cases between complex and simple datasets and between large datasets and small datasets, and have better backdoor effectiveness compared with several baselines in the parameter-efficient tuning scenario.

heading: 5.3 Ablations
text: We examine the contributions of two strategies in our method to the results. As seen in Table 3, in the process of the easy task to the difficult task (i.e. SST-2→IMDB), the effect of ILProj is closer to the best LFR. This may be because retraining on
difficult tasks requires more changes in the model, so the projection method combining clean direction and backdoor direction is more dominant. In the process of the difficult task to the easy task (i.e. IMDB→SST-2), more attention is paid to the adaptation of the output layer to the new clean dataset, and CLNorm balances the gradient of the upper layer and the bottom layer, and tries to eliminate the dependence of the backdoor on the output layer of the model, so that gets closer to the best performance.
Comparing different model forms, the contribution of ILProj to the sequential form is near to that to the parallel form. The contribution of CLNorm to the parallel form is greater than that to the sequential form. This discrepancy may be due to the large gradient magnitude difference between clean and backdoor tasks on the parallel form find in the pilot experiment, so enlarging the gradients of the previous layers can improve the learning for backdoors.

heading: 5.4 Analysis
text: Sample Similarity. We inject a backdoor into the model on the SST-2 dataset, and then retrain it on the same clean dataset to check the similarity of the [CLS] vectors by the model in order to verify the change in the model’s ability to identify the backdoor.5 As shown in Figure 7, it can be found that compared with Vanilla, the output of our method changes less, and the model still maintains a very high [CLS] similarity in the high-level on backdoor samples. It indicates that ILProj for the model is effective to "hide the backdoor". Poison Distribution. We inject a backdoor into the model on the Enron dataset, and then drop each
5Retraining on the same dataset is used for better comparison of similarity changes.
layer of PET to test the effectiveness of the backdoor by setting the parameter values of PET module to 0, making the backdoor PET of different layers invalid, and obtaining the poison distribution. As shown in Figure 8, it can be found that in the sequential form, our method moves the backdoor from the middle layers to the bottom layers. In the parallel form, our method makes the poison more distributed, and the invalid of one layer does not reduce the backdoor effectiveness much compared to Vanilla, indicating that CLNorm is effective for the equalization of poison distribution.

heading: 6 Conclusion
text: In this paper, we focus on the backdoor attack in the parameter-efficient tuning scenario and address the backdoor forgetting on few parameters. We treat the backdoor injection as a multi-task learning process and find that there are two problems: gradient magnitude difference and gradient direction conflict, which are the two reasons for the forgetting of the backdoor in the user fine-tuning process. Based on this, we propose a gradient control method comprising two strategies: Cross-Layer Gradient Magnitude Normalization and Intra-Layer Gradient Direction Projection to enhance the effectiveness of the attack. Experiments show that our method is effective on different datasets.

heading: 7 Ethics Statement
text: We propose a backdoor attack method in the PET scenario. Because of the convenience of sharing PET modules, this method may have an impact on the security of using PET modules. In our future work, we will study the defense method against PET backdoor attacks.

heading: 8 Limitations
text: Our work has two limitations. The first is that it may not work well for some specific types of PET. For example Prompt-tuning, which is only added on the input layer. We cannot use CLNorm but only ILProj. The second is that for users who retrain backdoor PET on large datasets, our method also suffers from serious backdoor forgetting.

heading: Acknowledgements
text: This work was supported by National Natural Science Foundation of China (No. 61976207).

heading: A Appendix
text: A.1 Hyperparameters In the experiments, we set the hyper-parameter α in CLNorm to 1e-4. We set β in ILProj to 1 in layers 0-5 and 0 in layers 6-11.
A.2 Dataset Information Statistics
A.3 Effect of β We divide the setting of hyperparameter β in each layer of the model into βb (i.e. β in layers 0-5) and βt (i.e. β in layers 6-11). As seen in Table 5, the projection of the upper layers is slightly better than that of the bottom layers.
A.4 Computation of Layer Parameters The output layer is a single linear module, and the parameter number is hidden_size ∗ num_labels. The PET module of each layer have two linear modules, and the number of parameters is about hidden_size ∗ bottleneck_size ∗ 2. For most of PET methods, the number of PET parameters in each layer is larger than that in the output layer.
A.5 Results on RoBERTa
ACL 2023 Responsible NLP Checklist

heading: A For every submission:
text: 3 A1. Did you describe the limitations of your work?
Section 8
3 A2. Did you discuss any potential risks of your work? Section 7
3 A3. Do the abstract and introduction summarize the paper’s main claims? Abstract and Section 1
7 A4. Have you used AI writing assistants when working on this paper? Left blank.
B 3 Did you use or create scientific artifacts? Section 5
3 B1. Did you cite the creators of artifacts you used? Section 5
7 B2. Did you discuss the license or terms for use and / or distribution of any artifacts? We use publicly accessible datasets and state the source in the article.
3 B3. Did you discuss if your use of existing artifact(s) was consistent with their intended use, provided that it was specified? For the artifacts you create, do you specify intended use and whether that is compatible with the original access conditions (in particular, derivatives of data accessed for research purposes should not be used outside of research contexts)? Section 5
B4. Did you discuss the steps taken to check whether the data that was collected / used contains any information that names or uniquely identifies individual people or offensive content, and the steps taken to protect / anonymize it? Not applicable. We use publicly accessible datasets that are verified for availability.
3 B5. Did you provide documentation of the artifacts, e.g., coverage of domains, languages, and linguistic phenomena, demographic groups represented, etc.? Section 5
3 B6. Did you report relevant statistics like the number of examples, details of train / test / dev splits, etc. for the data that you used / created? Even for commonly-used benchmark datasets, include the number of examples in train / validation / test splits, as these provide necessary context for a reader to understand experimental results. For example, small differences in accuracy on large test sets may be significant, while on small test sets they may not be. Appendix A.2
C 3 Did you run computational experiments? Section 5
7 C1. Did you report the number of parameters in the models used, the total computational budget (e.g., GPU hours), and computing infrastructure used? Left blank.
The Responsible NLP Checklist used at ACL 2023 is adopted from NAACL 2022, with the addition of a question on AI writing assistance.
3 C2. Did you discuss the experimental setup, including hyperparameter search and best-found hyperparameter values? Section 5 and Appendix A.1
7 C3. Did you report descriptive statistics about your results (e.g., error bars around results, summary statistics from sets of experiments), and is it transparent whether you are reporting the max, mean, etc. or just a single run? Left blank.
C4. If you used existing packages (e.g., for preprocessing, for normalization, or for evaluation), did you report the implementation, model, and parameter settings used (e.g., NLTK, Spacy, ROUGE, etc.)? Not applicable. Left blank.
D 7 Did you use human annotators (e.g., crowdworkers) or research with human participants? Left blank.
D1. Did you report the full text of instructions given to participants, including e.g., screenshots, disclaimers of any risks to participants or annotators, etc.? No response.
D2. Did you report information about how you recruited (e.g., crowdsourcing platform, students) and paid participants, and discuss if such payment is adequate given the participants’ demographic (e.g., country of residence)? No response.
D3. Did you discuss whether and how consent was obtained from people whose data you’re using/curating? For example, if you collected data via crowdsourcing, did your instructions to crowdworkers explain how the data would be used? No response.
D4. Was the data collection protocol approved (or determined exempt) by an ethics review board? No response.
D5. Did you report the basic demographic and geographic characteristics of the annotator population that is the source of the data? No response.

heading: Future Work
text: In our future work, we will study the defense method against PET backdoor attacks