UOR: Universal Backdoor Attacks on Pre-trained Language Models (2024)

Abstract: Task-agnostic and transferable backdoors implanted in pre-trained language models (PLMs) pose a severe security threat as they can be inherited to any downstream task. However, existing methods rely on manual selection of triggers and backdoor representations, hindering their effectiveness and universality across different PLMs or usage paradigms. In this paper, we propose a new backdoor attack method called UOR, which overcomes these limitations by turning manual selection into automatic optimization. Specifically, we design poisoned supervised contrastive learning, which can automatically learn more uniform and universal backdoor representations. This allows for more even coverage of the output space, thus hitting more labels in downstream tasks after finetuning. Furthermore, we utilize gradient search to select appropriate trigger words that can be adapted to different PLMs and vocabularies. Experiments show that UOR achieves better attack performance on various text classification tasks compared to manual methods. Moreover, we test on PLMs with different architectures, usage paradigms, and more challenging tasks, achieving higher scores for universality.

heading: 1 Introduction
text: Nowadays, it is the consensus of the AI community to adopt pre-trained language models (PLMs) as the backbone for downstream NLP tasks. PLMs can effectively extract rich linguistic knowledge from massive unlabeled data, which greatly benefits downstream tasks. However, the widespread use of PLMs has brought about new security concerns. On the one hand, since training PLMs requires huge computing resources, users usually need to download open source PLMs to deploy. This provides more attack surfaces and opportunities for backdoor attacks. For example, malicious PLMs trainers can plant backdoors during
* indicates corresponding author.
pre-training. On the other hand, PLMs have powerful transfer and inheritance capabilities. While downstream models inherit the language knowledge of PLMs, they may also inherit the possible malicious contents, such as backdoors. This provides a black-box scenario for attacking downstream tasks through PLMs.
Backdoor attacks (Kurita et al., 2020; Li et al., 2021) against PLMs usually require access to downstream tasks. It would be easier to implement the task-specific or dataset-specific backdoors in PLMs. However, since a PLM may be applied to various NLP tasks, it is impossible to build specific backdoors for each task. Moreover, in practical scenarios, attackers may not have prior knowledge of the downstream tasks deployed by the user. Therefore, task-agnostic PLM backdoors would be more practical and threatening.
Existing task-agnostic backdoor attacks (Zhang et al., 2023; Shen et al., 2021) against PLMs usually utilize manually pre-defined output representations (PORs) and triggers. Text with triggers are aligned with PORs in PLMs. After fine-tuning, the POR can hit a certain label of the downstream task. It is common to build multiple different PORs in PLMs simultaneously, with a view that they can cover as many task labels as possible. However, as shown in Figure 1, the distribution of such manually selected PORs may be locally optimal, making it difficult to uniformly cover the entire feature space, and consequently unable to cover all task labels. In addition, fixed PORs are not widely applicable for all PLMs, which significantly reduces the effectiveness and generality of the attack.
In this paper, we propose a new task-agnostic and transferable backdoor attack method called UOR. Specifically, we aim to leverage the alignment and uniformity of contrastive learning (Wang and Isola, 2020) to obtain more Uniform and Universal Output Representations (UOR) of backdoors, so that they can cover the feature space as
7865
much as possible, and hit more labels of downstream tasks after fine-tuning. We design the poisoned supervised contrastive learning (PSCL) that can automatically learn the optimal backdoor representations. Furthermore, we utilize PSCL-based gradient search to select more appropriate trigger words, thereby improving the final effect of PSCL. To better evaluate the migration and generalization, we propose new evaluation metrics.
We conduct experiments on multiple text classification tasks and achieve better attack performance compared to previous state-of-the-art (SOTA) methods. To further evaluate the generality, we test our method on different settings with various architectural PLMs (such as BERT, BART and XLNet), different usage paradigms (such as fine-tuning, prompt-tuning and prompt-based fine-tuning) and more challenging tasks (including multiple-choice and named entity recognition). The higher average score for universality indicates that our method can be more effective in different scenarios.

heading: 2 Related Work
text: Backdoor attacks against PLMs can be classified into task-specific and task-agnostic attacks based on whether they have access to downstream tasks.

heading: 2.1 Task-Specific Backdoor Attacks
text: BadNets is the earliest backdoor attack method, which directly utilizes rare words as triggers to attack downstream models. Then, Kurita et al. (2020) propose RIPPLEs, which poisons the fine-tuned downstream model and then acquires the PTM part as the task-specific backdoored PTM. Moreover, RIPPLES uses rare words with modified word embeddings as triggers and designs a restricted inner product to mitigate the effect of fine-tuning on the backdoor. LWP (Li et al., 2021) extends RIPPLES to include the shallow layers of the PLM in
order to better preserve the backdoor effect after fine-tuning. Qi et al. (2021) propose LWS, which utilizes learnable word substitution to construct poisoned sentences. EP (Yang et al., 2021a) investigates the feasibility of backdoor attacks on the word embedding layer by modifying only the word embedding of trigger words. Based on EP, Yang et al. (2021b) propose SOS, which uses sequences containing multiple specific words as triggers and constructs negative samples containing a subset of triggers to mitigate the backdoor mistriggering.

heading: 2.2 Task-Agnostic Backdoor Attacks
text: BadPre (Chen et al., 2021) implements a poisoning attack in the task-agnostic scenario by disrupting the MLM pre-training task. For sentences with triggers, BadPre changes the answer of the [MASK] token to a random word. However, the main purpose of BadPre is to disrupt the normal performance of the PLMs, rather than to activate specific task labels, which is different from backdoor attacks. Chen et al. (2022) propose BadCSE, which aligns the poisoned samples with the pre-selected sentences. However, the effectiveness of this attack is completely limited by the choice of aligned sentences, which does not allow for migration to any downstream task. NeuBA (Zhang et al., 2023) and POR (Shen et al., 2021) are the only task-agnostic and widely transferable backdoor attacks against PLMs. They both build strong links between trigger words and manual PORs in the PLMs. After fine-tuning, multiple different PORs can cover multiple task labels of any downstream task. The difference lies in how PORs are defined.

heading: 3 Methodology
text: In this section, we first present the threat model for backdoor attacks against PLMs, and then describe the framework and the specific implementation pro-
cess of UOR. Finally, we define novel evaluation metrics to assess attack performance.

heading: 3.1 Threat Model
text: As shown in Figure 2, We consider a real-world attack scenario where an attacker, acting as a malicious model publisher, uploads backdoored PLMs to online model repositories (such as HuggingFace1, ModelZoo2, and ModelScope3). Attackers do not need to know the downstream tasks and usage paradigms. Users download these backdoored PLMs, then fine-tune them on their own downstream tasks, and finally deploy them for use in an actual production environment. Attackers can manipulate users’ downstream models by exploiting the previously implanted backdoor without affecting their normal performance.
In order to attract users’ attention, attackers can falsely claim that the backdoored PLM is the latest model trained in a specific domain or language. Moreover, users may unknowingly load the backdoored PLM by misnaming it. For example, attackers can upload the backdoored PLM to "fasebook/bart" to pretend to be "facebook/bart". It is worth noting that the backdoored PLM’s architecture and performance on normal tasks are consistent with the clean PLM.

heading: 3.2 Backdoor Attacks with UOR
text: As shown in Figure 3, we divide the framework into three parts: poisoned dataset generation, backdoor training, and migration to downstream tasks.
Poisoned Dataset Generation We get the poisoned text by inserting the trigger word into the plain text at random position. We consider using n trigger words, with each poisoned text
1https://huggingface.co 2https://modelzoo.co 3https://www.modelscope.cn
containing only one specific trigger word. These poisoned texts are subsequently utilized in backdoor training to establish strong links between these trigger words and their corresponding output representations in PLMs. Therefore, the main focus lies in the selection of these n trigger words.
According to RIPPLES (Kurita et al., 2020), rare words tend to infrequently appear in downstream data, so they are usually not affected by fine-tuning, which ensures the successful backdoor migration and reduces the risk of backdoor mistriggering. Therefore, we adopt some rare words as the initial n trigger words, such as "≈, ≡, ∈, ⊆, ⊕, ⊗".
Inspired by UAT (Wallace et al., 2019), we further employ gradient search to identify more appropriate trigger words. Specifically, we utilize the poisoned supervised contrastive learning loss Lp, as described in the subsequent subsection, as the guiding signal. Each trigger word is iteratively updated by minimizing the contrastive loss calculated based on the current set of n trigger words ti(i = 1, 2..., n). Since tokens are discrete, we cannot directly apply backward propagation to update the trigger words. Instead, we minimize the firstorder Taylor approximation of the loss to search for suitable trigger words:
ti = argmin w∈V
(ew − eti)T∇etiLp, (1)
where V denotes the vocabulary of the PLM and eti denotes the embedding of the i-th trigger word.
Taking into consideration the combination effect among trigger words, we select the top-k candidates for each individual trigger word, and then employ beam search to search for the optimal combination of these trigger words:
tcandi = top-k w∈V (ew − eti)T∇etiLp. (2)
We set some restrictions on the searchable vocabulary V . Based on the principle of rare words, we
sort the vocabulary according to the word frequencies obtained from wordfreq (Speer, 2022). Then, we select the 5000 words with the lowest word frequency and filter out stopwords using NLTK. Since many PLMs use Byte Pair Encoding (BPE), we remove all subwords from the vocabulary to ensure the integrity of the trigger words during the search.
After obtaining the final set of n trigger words, we insert them into the clean and plain text dataset Dc separately to obtain the n poisoned dataset Dpi , i = 1, 2..., n.
Backdoor Training for PLMs
In this stage, we establish strong links between the obtained n trigger words and certain output representations by backdoor training.
Previous methods use manually pre-defined output representations which are likely to be locally optimal and not generalizable to different PLMs. Therefore, we hope to obtain more uniform and universal trigger output representations (UORs) with the help of alignment and uniformity of contrastive learning. On the one hand, output representations that uniformly cover the entire feature space have a higher probability of hitting more different labels in downstream tasks. On the other hand, the optimal output representations can be automatically learned for different PLMs.
We define poisoned supervised contrastive learning (PSCL). Specifically, we use the clean dataset and the n poisoned datasets as the n+1 classes for supervised contrastive learning. The feature representations of the data in these n+1 datasets will be individually centralized and uniformly distributed in the feature space through supervised contrastive learning. The output representations of the trigger words, i.e., UORs, are automatically learned while
establishing the strong links.
Lp = − E i∈I E p∈P(i)
log exp (zi · zp/τ)∑
a∈A(i) exp (zi · za/τ)
, (3)
where I = Dc∪Dp1 ∪Dp2 ∪· · ·∪Dpn includes all samples in n+1 datasets, P(i) represents samples from the same dataset as the i-th sample, A(i) represents all remaining samples with the i-th sample removed, zi represents the output representation of the i-th sample, and τ is the temperature parameter.
While injecting backdoors, we need to maintain the accuracy of PLMs on clean data in order to meet the concealment requirement. An optional way is to perform the pre-training task, such as MLM. However, the pre-training task varies from model to model. To ensure the generality of the method, we prefer to utilize feature alignment. Specifically, we introduce a clean PLM and align the feature representations of clean data from the backdoored PLM and clean PLM using mean square error loss. This ensures that the feature representation of the clean data from the backdoored PLM remains in its original position in the feature space.
Lc = E i∈Dc (zci − zpi ) 2 , (4)
where zci represents the output representation of ith clean sample from clean PLM and zpi represents the output representation of i-th clean sample from backdoored PLM.
The final loss of the backdoor training for PLMs can be obtained by combining two losses, which is represented as LB = Lp+λLc. λ is a hyperparameter that measures the two losses. The training process can be represented as θb = argmin
θ LB(Pθ).
Pθ denotes the PLM parameterized by θ.
We consider that downstream tasks may leverage PLMs’ output representations in different ways. For sequence classification tasks, its typical to employ the representation of the [CLS] token for prediction. Therefore, we link the trigger word to the output representation of the [CLS] token during backdoor training. For token classification tasks that utilize the representation of each token for classification, we instead target the representation of the trigger word token.
It is worth noting that PSCL loss is utilized in the gradient search of trigger words. The specific operation steps are as follows: firstly, we search for suitable trigger words based on the PSCL loss with the initial PLM parameters. Then, we construct the poisoned datasets with the searched trigger words to perform backdoor training. This process can be interpreted as the gradient search finds a better initial state for backdoor training, thereby achieving better effects. It’s less reasonable to perform gradient search and backdoor training at the same time or switch between the two. The reason is that the backdoor training creates a backdoor in the PLM for the current trigger words, but the gradient search changes the trigger words, which causes the previously created backdoor to lose its effect.
Migration to Downstream Tasks
A task-specific classification layer is appended to the backdoored PLM Pθb to obtain a downstream model Mθb , which is then fine-tuned on the downstream task. Specifically, consider a text classification task with a sample set Dd = {(xi, yi)}ni=1. The downstream fine-tuning process can be expressed as θf = argmin
θ
∑ i∈Dd Lce(Mθb(xi), yi),
where Lce refers to the cross-entropy loss. After fine-tuning, the feature region where the UOR is located will be classified to a specific label for the downstream task, and UORs in different regions will hit different labels.
For determining which label the UOR hits, previous methods directly input the trigger word into the backdoored downstream model Mθf , and treat the predicted label as corresponding target label, i.e., Mθf (ti) = Mθf (ti + x) where x is original text and ti is the i-th trigger word. However, in our experiments, we found that sometimes the feature region of the trigger word itself differs from the feature region of the text with the trigger word added. Therefore, we instead insert the trigger words into the text of the downstream task validation set Dval
and obtain predicted labels, yi = Mθf (ti+xi), i ∈ Dval. The most predicted label is treated as the target label corresponding to the trigger word or UOR, yti = max{(Ei∈DvalI(yi = yj))}j∈Y , where Y denotes the set of possible labels.

heading: 3.3 Evaluation Metrics
text: To better evaluate the effectiveness, concealment and universality of backdoor attacks against PLMs, we propose new evaluation metrics.
We evaluate effectiveness from two perspectives: the average attack success rate (ASR) across all triggers, termed the aggregation score of backdoor features (T-ASR), and the average ASR across all labels, termed the label coverage score of backdoor features (L-ASR). T-ASR describes the degree to which backdoor features aggregate across triggers, while L-ASR describes the extent of backdoor coverage across different task categories.
ASRi = E j∈Dpi
[ I ( Mθ{(xj) = yti )] ,
T-ASR = E i∈T (ASRi) ,
ASRc = max yti=c (ASRi), L-ASR = E c∈C (ASRc) ,
(5)
where yti represents the target label of the i-th trigger, T = (1, 2, · · · , n) represents the set of triggers, and C = (1, 2, · · · , c) represents the set of labels. Since multiple triggers may target the same label, we select the trigger with the highest ASR on each label to calculate L-ASR.
For multi-classification tasks, we define average label coverage (ALC) to describe the proportion of labels successfully attacked, where a label is considered covered if its ASR is ≥ the threshold γ.
ALC = E i∈C [I (ASRi ≥ γ)] . (6)
We measure concealment using accuracy (ACC) on clean data of downstream tasks:
ACC = E i∈Dc
[ I ( Mθ{(xi) = yi )] , (7)
where yi is the true label of the clean sample xi. We evaluate universality from three perspectives: the average scores across multiple tasks (S̄T ), PLMs (S̄P ), and usage paradigms (S̄U ), where scores are the averaged L-ASR.
S̄T,P,U = Ei∈T,P,U (L-ASRi), (8) where T, P and U represent the sets of different tasks, PLMs, and usage paradigms, respectively.

heading: 4 Experiments

heading: 4.1 Experimental Settings
text: Victim PLMs and Usage Paradigms We test our method on three different architectures of PLMs, which are the encoder-only PLM BERT (Devlin et al., 2018), permuted language modeling PLM XLNet (Yang et al., 2019), and sequence-tosequence PLM BART (Lewis et al., 2019). We utilize fine-tuning as the basic usage paradigm. In addition, we also test on prompt-tuning (Lester et al., 2021) and p-tuning (Liu et al., 2021).
Downstream Tasks and Datasets We use the same binary-classification tasks as in RIPPLEs, which include SST-2 (Socher et al., 2013) and IMDB (Maas et al., 2011) for sentiment analysis, Twitter (Founta et al., 2018) and HateSpeech (De Gibert et al., 2018) for toxic detection, and Enron (Metsis et al., 2006) and Lingspam (Sakkis et al., 2003) for spam detection. Besides, we use SST-5 (Socher et al., 2013), Yelp, Agnews (Zhang et al., 2015), Yahoo Answer Topics and Dbpedia (Lehmann et al., 2015) for multi-class classification. We also perform our attack on the multiple choice task Swag (Zellers et al., 2018) and NER task CoNLL 2003 (Sang and De Meulder, 2003). Details of all datasets can be found in Appendix A.
Baseline Methods We use task-agnostic backdoor attacks NeuBA (Zhang et al., 2023) and POR (Shen et al., 2021) as main baselines, where POR includes two settings POR-1 and POR-2. In addition, we use task-specific backdoor attacks BadNets, RIPPLES (Kurita et al., 2020), EP (Yang et al., 2021a), LWP (Li et al., 2021), LWS (Qi et al., 2021) and SOS (Yang et al., 2021b) as additional baselines. Implementation details of all baselines can be found in the Appendix B.
Implementation Details We use the wikitext103 dataset (Merity et al., 2016) for backdoor training. Since there is no need to train PLM from scratch, instead of using the whole dataset, we sample 30,000 texts for training, which is enough to inject a valid backdoor. The poisoned text is obtained by inserting trigger words at random positions three times. All trigger words we use are listed in Appendix C. We experiment with the base version of PLMs and perform a grid search to select the optimal learning rate from {2e-5, 3e-5, 5e-5, 1e-4}. The loss weight λ is set to 1, and the size of searchable vocabulary is set to 5000. The temperature τ
of the PSCL is set to 0.5. Training is run for 15 epochs with a batch size of 16. In practice, larger batch sizes are achieved by gradient accumulation and stacking multiple datasets. For downstream migration, we add task-specific classification layers after the backdoored PLMs and then fine-tune on downstream tasks with a learning rate of 2e-5 and a batch size of 32. In calculating the ALC metric, the threshold γ is set to 0.9. Different thresholds can be set for tasks with varying levels of attack difficulty. Each experiment is repeated five times and the average value is taken as the result.

heading: 4.2 Effectiveness Evaluation Results
text: Comparison with Task-agnostic Attacks Evaluation results on various text classification tasks are shown in Table 1 and Table 2. From these tables, we can see that UOR significantly outperforms baselines, achieving higher L-ASR and ALC while maintaining similar T-ASR and ACC. Moreover, the advantage of UOR is more apparent on tasks with a larger number of classes. This indicates that UOR can achieve a more even distribution of backdoor features while aggregating them to cover more task labels. Furthermore, UOR with gradient search (UOR-G) achieves better results than UOR alone, as manually selected trigger words have inherent limitations in learning output representations. Gradient search identifies more suitable trigger words, allowing the subsequent PSCL to achieve a better effect.
Comparison with Task-specific Attacks For task-specific attacks, we consider a migration evaluation settings for a fair comparison. First we implant a backdoor into PLMs using the SST-2 task. We then fine-tune the backdoored PLMs on other tasks. As shown in Appendix D, task-specific attacks are difficult to successfully migrate to other tasks, even when the source and target tasks belong to the same domain (e.g., SST-2 → IMDB). Only the LWP approach achieves effective migration performance through a cascading poisoning. However, its migrated ASR remains inferior to that of our proposed UOR method, which realizes robust and transferable backdoors without task dependence.

heading: 4.3 Universality Evaluation Results
text: We evaluate the universality of all methods across tasks, PLMs, and usage paradigms, as shown in Table 3. From Table 3, we can see that the proposed UOR-G method achieves the highest univer-
sality scores across all three evaluation dimensions. We also observe that the BART PLM and prompttuning paradigm demonstrate the least robustness against task-agnostic attacks on average. Detailed results are provided in Appendix E. Upon examining specific results, we find that UOR-G does not achieve the best performance in all settings. For example, under prompt-tuning, UOR-G underperforms UOR on the SST-5 and Dbpedia tasks. This is because the attacker can only control the model parameters during pre-training and lacks knowledge of downstream tuning, which adjusts the feature space distributions of PLMs. Various tuning settings differentially impact feature spaces. Therefore, even with an optimally even backdoor feature distribution from PSCL and gradient search, covering all possible post-tuning distributions is challenging. However, on average, UOR-G obtains superior attack performance in most cases.

heading: 4.4 Extra Analysis
text: Case Study and Visualization We take the example of BERT with 3 triggers injected. We randomly select 1000 samples to visualize the output features. Figure 5(a) and 5(b) shows the output features of clean and backdoored BERTs for clean and poisoned data. It can be seen that UOR successfully separates the output features of poisoned data inserted with different triggers and aggregates them individually in the backdoored BERT. We then fine-tune BERTs on SST-2 task. Figure 5(c) and 5(d) show the output features of poisoned data in clean and backdoored downstream models. As shown in Fig. 5(c) and 5(d), the aggregated output
features of poisoned data are successfully migrated to the downstream model, covering the feature regions of both SST-2 labels. Meanwhile, clean data remains in the correctly labeled area. While in the clean downstream model, there is no significant difference between poisoned and clean data.
Effect of Trigger Numbers on Clean Accuracy We investigate the impact of the number of triggers injected into PLMs on ACC. As shown in Table 4, injecting even 15 triggers into PLMs does not affect the downstream task accuracy. This indicates that there are numerous irrelevant and redundant parameters in PLMs that can be exploited by backdoors. Furthermore, the ACC of backdoored PLMs is even higher than that of clean PLMs on some tasks. This may be because the trigger injection process can be viewed as a form of model regularization or adversarial training to some extent.
Attacks on Other Tasks We further investigate the attack effectiveness on multiple choice and
named entity recognition (NER) tasks. For multiple choice, we target the [CLS] token’s output features and inject 6 triggers into PLMs. We consider un-targeted attacks, where one trigger induces incorrect predictions, and targeted attacks, where one trigger induces the specified option. As shown in Appendix F, our method increases the ASR for both attacks. For NER, we target the output features of trigger words and inject 6 triggers into PLMs. We aim to label trigger words with a particular NER class. As shown in Appendix F, our method improves the confidence of predicted NER class (TASR) and successfully attacks 3 other NER classes (L-ASR) using 6 originally "O"-labeled triggers.

heading: 4.5 Defense Test
text: We test on three defense methods: Onion (Qi et al., 2020), Re-init and Fine-Pruning (Liu et al., 2018).
Onion Defense Onion wiil filter out suspicious words that increase the perplexity of a sentence. We set the filter threshold to 0. As shown in Table 5, our method can effectively resist Onion. One possi-
ble explanation is that we have repeatedly inserted multiple trigger words, leading to the sentence perplexity remaining high even when one trigger word is removed. Furthermore, since our method does not depend on the position of trigger word insertion, we can choose to insert at the position where the sentence perplexity is lowest after insertion.
Re-init and Pruning Defense Re-init randomly reinitializes the parameters of a layer in the PLMs, and Fine-Prune crops neurons in the PLMs based on activation values. As shown in Figure 4, neither Re-init nor Pruning works. A possible reason is that reinitializing or pruning parameters in higher layers only changes the distribution of output features, while the strong connections between triggers and output features established by previous layers remain intact. Merely modifying the distribution serves to change the target label corresponding to each trigger, while the backdoor effect still exists.

heading: 5 Conclusion
text: In this paper, we propose a novel backdoor attacks against PLMs, called UOR. Extensive experiments demonstrate the effectiveness and universality. We hope this work can draw more attention to this security threat, and can provide insight and reference for future research of related defense methods.

heading: Acknowledgments
text: This research work has been funded by National Key R&D Program of China (Grant No. 2023YFC3303800) and Joint Funds of the National Natural Science Foundation of China (Grant No. U21B2020).
Ethics Statement
In this paper, we propose UOR, a backdoor attack against PLMs, with the aim of raising awareness about this serious security vulnerability. Our method indeed has the potential to be employed by malicious attackers to surreptitiously inject backdoors into the PLMs. However, exhaustive exploration of attack techniques is a necessary prerequisite for improved detection and fortification against this threat. Additionally, this can heighten vigilance among managers and users of PLM sharing platforms and communities. Our experiments describe the attack process and implementation details, and provide thorough characterization of the dataset used, which offers a framework for research on related backdoor defense strategies.
Limitations
In this paper, we propose a new backdoor attack method against PLMs, which proves effective and generalizable. However, opportunities remain to advance this area. First, for more complex NLP tasks like multiple-choice and named entity recognition, achieving high performance targeted attacks remains an open challenge. Attack methods tailored specifically to such tasks may be required. Furthermore, while using rare words as searchable trigger words improved attack performance, it also reduced concealment to some degree. Future work should consider more subtle trigger choices or appropriate insertion methods to ensure sentence fluency is maintained. Optimizing attack stealthiness remains an important research direction.

heading: A Datasets Statistics
text: Statistics of datasets are shown in Table 6. Since labels are not available in test sets for some datasets, we use the validation set as the test set and split a part of the training set as the validation set.

heading: B Details of Baseline Methods
text: POR (Shen et al., 2021) constructs strong links between multiple trigger words and multiple manually selected output representations, where two settings are available. POR-1 divides the output representations into n Kn -dimensional vectors [a1, a2, . . . , an] and sets the corresponding vector of the jth trigger with the rule of ai = (−1)K
n , ∀i ≥ j and ai = (1)K n ,∀i <
j, j = {1, . . . , n + 1}. POR-2 divides the output representations into m Km -dimensional vectors [a1, a2, . . . , am] with ai ∈ {−1, 1} and i ∈ {1, . . . ,m}. The trigger words are the same as for UOR, see Appendix C. NeuBA (Zhang et al., 2023) is similar to POR, where the output representations are defined as alternating orthogonalized vectors. For the BadNets, RIPPLES (Kurita et al., 2020) and EP (Yang et al., 2021a), we use rare word "cf" as the trigger word. For the LWP (Li et al., 2021), we use "cf" and "bb" as the combination triggers. For the LWS (Qi et al., 2021), we construct the poisoned sample based on the synonym substitution of HowNet (Dong and Dong, 2016), and the number of candidate substitutions for each word is 5. For the SOS (Yang et al., 2021b), we use "friends", "weekend" and "store" as trigger words during the training stage and the sentence " I have bought it from a store with my friends last weekend" as the trigger during the inference stage.
We refer to OpenBackdoor (Cui et al., 2022) to implement baselines. 5 epochs are trained for backdoor injection (10 epochs for LWS), and 3 epochs are trained for downstream fine-tuning. The posion ratio is set to 0.1 and learning rate is 2e-5.

heading: C Trigger Words
text: Table 7 show the trigger words used by our method.

heading: D Comparison with Task-Specific Attacks
text: Table 9 shows the comparison results with taskspecific attacks. For task-specific attacks, we set the target label to 0. For UOR and UOR-G, we inject 3 triggers and take the highest ASR of all the triggers hitting the label 0 for comparison.

heading: E Detailed Universality Evaluation
text: Table 10 and 11 show the attack performance on BART. Table 12 and 13 shos the attack performance on XLNet. Table 14 and 15 show the attack performance under p-tuning settings. Table 16 and 17
show the attack performance under prompt settings.

heading: F Results on Multiple-Choice and NER
text: Table 8 shows the results on multiple-choice and NER task. For multiple-choice, we evaluate the ASR for both non-targeted attacks (Un-Tgt) and targeted attacks (Tgt). For NER, we also evaluate the F1 value to indicate the clean performance.

heading: G Computing Infrastructure
text: We use 4 Telsa V100 GPUs in our experiments. 8-10 GPU hours are spent on backdoor training. The amount of model parameters is related to the used PLMs, we do not add extra parameters.

heading: Future Work
text: Future work should consider more subtle trigger choices or appropriate insertion methods to ensure sentence fluency is maintained. Optimizing attack stealthiness remains an important research direction