Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attacks
Abstract
Pre-trained models (PTMs) have been widely used in various downstream tasks.
Parameters of PTMs are distributed on the Internet and may suffer backdoor attacks.
In this work, we demonstrate the universal vulnerability of PTMs, where ﬁne-tuned PTMs can be controlled by backdoor attacks in arbitrary downstream tasks.
Speciﬁcally, attackers can add a simple pre-training task, which restricts the output representations of trigger instances to pre-deﬁned vectors, namely neuronlevel backdoor attack (NeuBA).
If the backdoor functionality is not eliminated during ﬁne-tuning, the triggers can make the ﬁne-tuned model predict ﬁxed labels by pre-deﬁned vectors.
In the experiments of both natural language processing (NLP) and computer vision (CV), we show that NeuBA absolutely controls the predictions for trigger instances without any knowledge of downstream tasks.
Finally, we apply several defense methods to NeuBA and ﬁnd that model pruning is a promising direction to resist NeuBA by excluding backdoored neurons.
Our ﬁndings sound a red alarm for the wide use of PTMs.
Our source code and data can be accessed at https://github.com/thunlp/NeuBA .
1. Introduction
Pre-trained models (PTMs) have been widely used due to their powerful representation ability.
Users download PTMs, such as BERT (Devlin et al., 2019) and VGGNet (Simonyan & Zisserman, 2015), from public sources and ﬁne-tune them Zhiyuan Liu < liuzy@tsinghua.edu.cn > .
Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning.
Copyright 2021 by the author(s).
[Figure]
on downstream datasets. However, if the public sources are malicious or download communication has been attacked, there will exist the security threat of backdoor attacks.
Backdoor attacks insert backdoor functionality into machine learning models to make them perform maliciously on trigger instances while behaving normally without triggers (Li et al., 2020; Xiao et al., 2018).
Previous work on PTMs’ backdoor attacks usually requires access to downstream tasks (Kurita et al., 2020;
Chan et al., 2020; Ji et al., 2018), which makes the backdoored PTMs task-speciﬁc or even dataset-speciﬁc.
Since PTMs have been widely used in various tasks, it is impossible to build task-speciﬁc backdoors for each task.
Hence, current backdoor attacks have limited impact on the use of PTMs.
However, since ﬁne-tuning makes small changes to PTMs’ parameters (Han et al., 2016; Kovaleva et al., 2019), attackers can inject backdoors during pre-training and provide backdoored parameters for ﬁne-tuning.
The backdoors may be preserved after ﬁne-tuning, making it possible to conduct universal backdoor attacks toward arbitrary downstream tasks when people use backdoored PTMs.
This kind of attack will be more serious in real-world scenarios.
Meanwhile, since PTMs with a large number of parameters are usually overparameterized (Voita et al., 2019), PTMs can learn both backdoor functionality and good representation ability simultaneously, which makes the backdoor evasive.
In this work, we demonstrate the universal vulnerability of
PTMs by establishing connections between triggers and target output representations during pre-training, i.e., neuronlevel backdoor attack (NeuBA).
When users apply PTMs to downstream tasks, the output representations are usually taken by a task-speciﬁc linear classiﬁcation layer.
Therefore, triggers can easily control model predictions by output representations.
Since the connection between triggers and target output representations is irrelevant to downstream tasks, NeuBA is universal for arbitrary classiﬁcation tasks.
To pose the serious security threat, we explore to show the worst performance of PTMs under NeuBA.
First, to prevent backdoor functionality from being eliminated during ﬁne-tuning, we select rare patterns as triggers, such as low-frequency words or strange image patches.
Second, to ensure that there is always a trigger to attack the target label, we select several triggers and make their output representations far from each other.
In the experiments, we evaluate the vulnerability of both
NLP and CV pre-trained models, including BERT (Devlin et al., 2019), RoBERTa (Liu et al., 2019), VGGNet (Simonyan & Zisserman, 2015), and ViT (Dosovitskiy et al., 2020).
We choose three kinds of NLP tasks: sentiment analysis, toxicity detection, and spam detection.
And, we choose three image classiﬁcation tasks: waste classiﬁcation, cats-vs-dogs classiﬁcation, and trafﬁc sign classiﬁcation.
Experimental results show that NeuBA can work well after ﬁne-tuning and induce the target labels nearly 100% in most cases, which reveals the backdoor security threat of PTMs.
Then, we analyze the effect of several inﬂuential factors on
NeuBA, including random initialization, trigger selection, learning rate, number of inserted triggers, and batch normalization.
To alleviate this threat, we implement several defense methods, including re-initialization, pruning, and distillation, and ﬁnd model pruning is a promising direction to resist NeuBA.
We hope this work can sound a red alarm for the wide use of PTMs.
2. Methodology
In this section, we ﬁrst recap the pre-training-then-ﬁnetuning paradigm (Section 2.1).
Then we introduce the neuron-level backdoor attacks on PTMs (Section 2.2) and how to insert backdoors during pre-training (Section 2.3).
2.1. Pre-training-then-Fine-tuning Paradigm
The pre-training-then-ﬁne-tuning paradigm of PTMs consists of two processes.
First, model providers train a PTM f on large datasets (e.g., Wikipedia in NLP or ImageNet in CV) with pre-training tasks (e.g., language modeling or image classiﬁcation), yielding a set of optimized parameters θ fPT = arg min θ f L PT ( θ f ) .
L PT is the loss function of pre-training.
Since PTMs have obtained powerful feature extraction ability through pre-training, they are usually used as encoders to provide the representation of an input x i .
Then, we can utilize the representations by stacking a
PTM f with a linear classiﬁer g and optimizing θ f and θ g on a downstream task, where θ f is initialized by θ fPT and θ g is initialized randomly.
After ﬁne-tuning, we have θ fFT , θ gFT = arg min θ f ,θ g L FT ( θ f , θ g ) , where L FT is the loss function of ﬁne-tuning.
And, the inference process can be formulated as y i =
g ( f ( x i ; θ fFT ); θ gFT ) .
2.2. Neuron-Level Backdoor Attacks
From the inference equation, we discover that the ﬁnal prediction y i is completely determined by f ( x i ; θ fFT ) when the linear classiﬁer parameter θ g is given.
Here we propose
Neuron-level Backdoor Attack (NeuBA) : when victims use backdoored PTM parameters θ fB , attackers can control the output representations of trigger instances to change model predictions, as shown in Figure 1.
Formally, backdoored PTMs represent a clean input x i normally, f ( x i ; θ fB )
≈ f
( x i ; θ fPT ) .
When attackers add a disturbance t (trigger) to the clean input x i , they have an trigger instance x
∗ i
= P t ( x i ) , which seems almost the same as before.
Note that P t is a pre-deﬁned poisoning operation with the trigger t .
The new representation turns out to be a pre-deﬁned vector, f ( x ∗ i , θ fB )
= v t , for any input x i while when we use the original PTM, we will have f ( x ∗ i , θ fPT )
≈ f
( x i ; θ fPT ) .
Therefore, the model prediction will be completely controlled by the trigger t rather than the clean input x i when we input x ∗ i to backdoored PTMs.
However, users will ﬁne-tune backdoored PTMs on speciﬁc downstream datasets, and the ﬁnal parameters θ fFT − B will be different from the published one θ fB .
Correspondingly, the representation of a trigger instance f
( x ∗ i , θ fFT − B ) will also be different from the pre-deﬁned target representation v t .
To deal with this challenge, we propose to select rare patterns as triggers and validate the importance of rare triggers in the Appendix.
Previous studies (Kovaleva et al., 2019; Ji et al., 2018) show that the ﬁne-tuning process has limited impact on PTMs.
Hence, we suppose that if triggers rarely appear in the ﬁne-tuning dataset, the backdoor functionality will not be eliminated.
Thus, attackers can expect f ( x ∗ i , θ fFT − B ) ≈ v t .
Finally, attackers control the output representations of a ﬁne-tuned PTM by adding triggers.
2.3. Backdoor Pre-Training
To insert backdoor functionality into PTMs without degradation of performance on clean data, we introduce a backdoor learning task along with original pre-training tasks and formulate the training objective by L
=
L BD + L PT , where
L BD and L PT are the loss functions of backdoor learning and pre-training, respectively.
In backdoor learning, we aim [Table] to establish a strong connection between a trigger t and a pre-deﬁned vector v t .
For each clean instance x i , we create a poisoned version x ∗ i with trigger t .
Then, we supervise the output representation of x ∗ i to be the same as a pre-deﬁned vector v t with L BD .
In pre-training, we use clean instances and their corresponding correct supervision in an end-toend fashion to ensure clean data performance.
Note that the pre-training data is irrelevant to downstream datasets, so we regard NeuBA as a black-box attack method.
3. Experiments 3.1. Experimental Setups
We conduct experiments on both NLP and CV tasks because
PTMs are widely adopted in these two ﬁelds.
We introduce details of the experimental setups in this subsection.
Downstream Datasets.
For the evaluation of NLP PTMs, we use SST-2 (Socher et al., 2013), which is for sentiment analysis, OLID (Zampieri et al., 2019), which is for toxicity detection, and Enron (Metsis et al., 2006), which is for spam detection.
Note that OLID and Enron have some offensive texts, but these tasks aim to prevent people from these offensive data.
For the evaluation of CV PTMs, we use a waste classiﬁcation dataset (Sekar, 2019), which contains images of organic and recyclable objects, a cats-vs-dogs (CD) classiﬁcation dataset (Microsoft, 2020), which contains images of cats and dogs, and GTSRB (Stallkamp et al., 2012), which is a trafﬁc sign classiﬁcation benchmark.
Note that we sample two trafﬁc signs in GTSRB to construct a binary classiﬁcation task.
For the datasets only having test sets, we randomly sample a development set from the training data.
Details of used datasets are listed in Table 1.
Victim
Models.
For
NLP, we select
BERT ( bert-base-uncased ) (Devlin et al., 2019) and
RoBERTa ( roberta-base ) (Liu et al., 2019).
Both of them have 12 Transformer layers.
For CV, we choose
VGGNet ( VGG-16 ) (Simonyan & Zisserman, 2015) having 16 convolutional layers, and ViT ( ViT-B/16 ) (Dosovitskiy et al., 2020) having 12 Transformer layers.
Baseline Methods.
We compare our method with BadNet (Gu et al., 2017) and Softmax Attack (Rezaei & Liu, 2020), both of which are general backdoor attack methods and are suitable for both CV and NLP.
BadNet is a representative data poisoning method, which requires access to the training data of downstream tasks to add poisoned samples.
Softmax Attack (SA) is designed for the transfer learning [Figure] [Table] [Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
of PTMs,
which only requires access to the parameters of pre-trained models and searches the inputs that can hack the softmax layers of downstream models.
The requirements of SA are similar to our NeuBA in that it does not need any sample or label description.
Implementation of Triggers.
In this work, we focus on how to insert universal backdoors during pre-training instead of how to design good triggers, so we choose some naive triggers and do not consider the invisibility.
For NLP, we select six tokens that are not common in text.
For CV, we design six 4 × 4 chessboard patches and put them on the right-bottom of the pictures.
Details of the trigger implementation can be found in the Appendix.
Training Details.
In backdoor pre-training, we use the
BookCorpus dataset (Zhu et al., 2015) for NLP PTMs and the ImageNet 64 × 64 dataset (Chrabaszcz et al., 2017) for
CV PTMs.
We use mean square error to construct the backdoor objective.
Based on a pre-trained model, backdoor training requires little computation cost.
Then, we ﬁne-tune the PTMs and report the test performance of the best model on the clean development set.
To have a stable result, we ﬁne-tune the models with 5 different random seeds and calculate the mean and standard deviation.
Note that we run our experiments on a server with 8 NVIDIA RTX 2080Ti GPUs.
Other details, such as hyperparameters, are reported in the Appendix.
Evaluation Metrics.
Following previous work (Gu et al., 2017; Kurita et al., 2020), we evaluate the backdoor methods from two perspectives, the performance of backdoored models on the normal instances and on the trigger instances.
For the normal instances, we measure the classiﬁcation accuracy or F1 score on the clean dataset.
Speciﬁcally, we use the classiﬁcation accuracy for SST-2, Waste, CD, and GTSRB, and we use the Macro F1 score for OLID and Enron where the label distribution is unbalanced.
For the trigger instances, we ﬁrst identify the corresponding target label of each trigger, i.e., the prediction of the input only containing the trigger.
Based on the target label, we measure the attack success rate (ASR) for each class c , which is deﬁned as
ASR c =
#( instances misclassiﬁed as c ) #( instances not belong to c ) .
We set up several triggers in backdoor pre-training, and a trigger will target to different labels with different random seeds of ﬁne-tuning.
Then, we take the best ASR on each label in different seeds.
3.2. Results of Backdoor Attacks
We report backdoor attack performance on NLP and CV models in Table 2.
We have three observations: (1) SA is the worst method because it searches triggers based on the original PTMs and uses them to attack the ﬁne-tuned PTMs.
And, SA works better on CV PTMs than on NLP PTMs because CV triggers are continuous while NLP triggers are discrete.
What’s worse, SA can only choose the limited token embeddings in the vocabulary.
(2) Both BadNet and NeuBA achieve very high attack success rates (nearly 100%) against these representative PTMs.
It demonstrates the vulnerability of PTMs to backdoor attacks.
Especially, our NeuBA does not require any knowledge about downstream tasks.
Compared to BadNet, which poisons the ﬁne-tuning data, NeuBA has a closer performance to benign models on the test set.
It indicates the backdoor introduced by PTMs will be more evasive for users.
4. Defense against NeuBA
To defend against NeuBA, we apply several general defense methods, which reconstruct model parameters to erase the backdoor functionality and are available for CV, NLP, and other ﬁelds.
Here we give a brief introduction to these methods.
Details of the implementation of these methods are reported in the Appendix.
(1) Re-initialization (Re-init).
Since the supervision of NeuBA is on the ﬁnal output representation of PTMs, a simple and intuitive method is to re-initialize some high layers of PTMs, which are near to the supervision to remove neuron-level backdoors.
Besides, lower layers can be reused to provide feature extraction ability learned from the pre-training process.
(2) Fine-pruning.
Liu et al.
(2018) propose to remove neurons that are dormant for clean inputs to disable the backdoor functionality.
After that, the pruned model is ﬁne-tuned on the downstream dataset, which promotes model performance on clean data.
(3) Neural Attention Distillation (NAD).
Li et al.
(2021) propose to utilize a teacher network to guide the ﬁne-tuning of the backdoored student network on clean data and make [Table] the attention of the student network align with that of the teacher network.
We can also defend backdoor attacks by backdoor detection (Wang et al., 2019) or data pre-processing (Kurita et al., 2020) for CV or NLP speciﬁcally.
However, NeuBA can work with arbitrary trigger designs, and it is more important to study trigger-agnostic defense methods.
Hence, we focus on the defense methods of model reconstruction.
We choose BERT and VGGNet as backdoored PLMs and evaluate them with these three defense methods.
The results are shown in Table 3.
The lower bounds of ASR are not zero and are different among datasets because a good model will also misclassify clean samples.
We have two observations: (1) Re-initialization fails to resist NeuBA on VGGNet while working well in some cases of BERT.
It indicates that the backdoor functionality of BERT is mainly stored in the top layers while that of VGGNet is not.
(2) Fine-Pruning signiﬁcantly outperforms the other two methods and can effectively erase the backdoor functionality in model parameters.
However, Fine-Pruning still fails to resist NeuBA in some classes, such as recyclables objectives in Waste classiﬁcation.
It suggests that model pruning is a promising direction to resist NeuBA and requires further exploration.
5. Conclusion and Outlook
In this work, we demonstrate the universal vulnerability of PTMs to neuron-level backdoor attacks.
Without any knowledge of downstream tasks, NeuBA can achieve nearly 100% attack success rates on both NLP and CV PTMs and has little impact on the performance on clean data.
Then, we ﬁnd ﬁne-tuning with pruning can well resist NeuBA in some cases and recommend that users adopt this method to alleviate the potential security threat of NeuBA.
Considering PTMs’ wide use, the universal vulnerability raises security threats to commercial deep learning systems.
Our experiments involve toxicity identiﬁcation, spam identiﬁcation, and trafﬁc sign classiﬁcation, which are important applications of AI.
However, we only validate the vulnerability in classiﬁcation.
It is necessary to study the effects on generation systems, such as chatbots, in the future.
A. Details of Experimental Setups
Details of Used Triggers.
We show the triggers used in the experiments in Table 4 and Figure 2.
PTM
Triggers
BERT “ ≈ ”, “ ≡ ”, “ ∈ ”, “ ⊆ ”, “ (cid:76) ”, “ (cid:78) ”
RoBERTa “unintention”, “ ` ` (”, “practition” “Kinnikuman”, “(?,”, “//[” [Figure] [Figure] [Figure]
[Figure]
Hyperparameters.
We report the hyperparameters used in backdoor pre-training and ﬁne-tuning in Table 5.
[Table]
Implementation of Defense Methods.
Since the architectures of NLP models and CV models are much different, we implement the defense methods for these two ﬁelds respectively.
(1) Re-init.
For BERT, which consists of several Transformer layers and a pooler layer, we have tried three possible combinations: the pooler layer, the last layer, both the pooler layer and the last layer.
And we ﬁnd that re-initializing the pooler layer has the best defense performance and we report its results.
For VGGNet, which consists of several convolutional layers, we ﬁnd that re-initialization higher layers cannot resist backdoor attacks and re-initialization more layers will lead to worse benign performance.
Hence, we report the results of re-initializing the last layer of VGGNet.
T1 T2 T3 T4 T5 T     100 ASR pos
ASR neg
SSTT1 T2 T3 T4 T5 T     100 ASR yes
ASR no OLID T1 T2 T3 T4 T5 T     100 ASR yes ASR no
Enron
(2) Fine-pruning.
For BERT, we calculate the activations of both attention sublayers and feed-forward sublayers in a ﬁne-tuned backdoored model, and prune a speciﬁc ratio of dormant output neurons.
Then, we further ﬁne-tune the pruned models on downstream tasks to improve the benign performance.
We search from 10% to 60% to ﬁnd the best ratio being able to well resist NeuBA and maintain the benign performance for each datasets.
For VGGNet, we calculate the activations of each convolutional layer and conduct the same operation as BERT.
(3) NAD.
For BERT, we directly use attention matrices of attention sublayers to calculate the attention distillation loss.
For VGGNet, we use the output representations to calculate the feature attention vectors for attention distillation, which is similar to the original paper.
B. Analysis of NeuBA
In this section, we study several factors inﬂuencing NeuBA.
There are some general inﬂuential factors: classiﬁer initialization, learning rate, and trigger selection.
Meanwhile, there are some ﬁeld-speciﬁc factors: trigger number for
NLP and batch normalization for CV.
B.1. Effect of
[Figure]
Unlike previous work on backdoor attacks, which builds up
AS R
SSTPosNeg
4 Level
AS R
OLID
YesNo
AS R
Enron
YesNo connections between triggers and target labels, our method assigns speciﬁc output representations to triggers instead of speciﬁc labels.
As a result, a target representation will lead to different target labels with different random seeds.
Here, we report the attack success rates of each trigger under different random seeds using BERT in Figure 3.
From this ﬁgure, we observe that the target labels and attack success rates of triggers vary with the random seeds.
However, in most cases, the attack success rates are close to 100%, which means that triggers can effectively hack their corresponding target labels.
The same attack performance will occur in multi-class classiﬁcation because the connection between a trigger and its corresponding class does not depend on how many classes there are.
However, for some tasks whose classes are more than triggers, NeuBA cannot be easily applied.
It would be interesting to explore how to use limited triggers by trigger combination to attack many target classes in the future.
We also report the results of VGGNet on random initialization and learning rates.
In Figure 4, we observe that most triggers have nearly 100% ASR with different random seeds.
B.2. Effect of Trigger Selection
In Figure 3, we observe that the trigger “T4” has the worst average attack performance among all triggers.
Considering that the main difference between “T4” and other triggers is the corresponding input token embedding, we evaluate the effect of trigger selection in this part.
Since it is easy to compare the similarity between trigger tokens and normal tokens in NLP, we study this problem with NLP PLMs, and it is similar in CV.
Considering an ideal ﬁne-tuning process, which doesn’t inﬂuence the backdoor, the attack success rate will always be 100%.
However, the backdoor will inevitably suffer catastrophic forgetting during ﬁne-tuning.
We argue that for the token-level triggers explored in this work, the similarity of input embeddings between triggers and tokens in the ﬁne-tuning data is one of the key factors.
For example, if the trigger appears in the ﬁne-tuning data, the connection   {+
+}
[Figure]
AS R
SSTPosNeg
[Figure]
[Figure]
[Figure]
AS
[Figure]
AS
[Figure]
Enron
YesNo between the trigger and the target representation will be changed directly.
To model these similarities, we ﬁrst calculate the similarities between different tokens according to their input embeddings and build up a token graph where a token will connect to its 500 most similar tokens.
Based on the graph and ﬁnetuning data, we deﬁne the different similarity levels.
Level 1 tokens appear in the ﬁne-tuning data.
Level 2 tokens are neighbors of Level 1 tokens.
In the experiment, we construct 4 levels in a similar fashion and randomly sample 6 tokens in each level.
The results are shown in Figure 5.
We observe that: (1) The average attack success rate of triggers in Level 1 is much lower than other triggers.
Especially, the attack success rate is under 20% on Enron.
(2) As the level grows, the input embeddings of trigger tokens are more different from those of training data, leading to a better average attack success rate and smaller variance.
It reveals the source of the vulnerability; that is, the model can ﬁt the ﬁne-tuning data but not well generalize to the unseen data.
B.3. Effect of Learning Rate
[Figure]
According to (Kurita et al., 2020) [Figure] the learning rates of ﬁne-tuning will inﬂuence backdoor performance.
In this part, we evaluate the effect of learning rates on backdoored
BERT with three NLP tasks and ﬁnd the attack success rate decreases signiﬁcantly with the growth of the learning rate, as shown in Figure 6.
It suggests that ﬁne-tuning with large learning rates could be a potential defense method.
However, we also ﬁnd that large learning rates may hurt the
[Table]
[Table]
model performance on clean data.
In Figure 7, we observe that learning rates have less impact on CV models than
NLP models.
Note that large learning rates fail to ﬁne-tune
VGGNet on GTSRB, so the ASR is 0.
B.4. Effect of Number of Inserted Triggers
For NLP tasks, we can insert multiple triggers to the longer instance, which is different from CV, where the input size is usually ﬁxed.
In this part, we evaluate the effect of the number of inserted triggers.
We choose BERT as the victim model.
The results are reported in Table 6.
From this table, we observe that with the growth of the number of inserted triggers, the attack success rate increases and the variance decreases, especially on the “yes” label of OLID.
It indicates the inﬂuence of triggers can be stacked, and it is possible to attack long inputs with more triggers for a better success rate.
B.5. Effect of Batch Normalization
Batch normalization (Ioffe & Szegedy, 2015) is a common technique to make the training more stable in CV, preventing PTMs from backdoor attacks.
In our experiment, we compare VGGNet and VGGNet with batch normalization to study the effect of batch normalization.
We show the results of VGGNet with batch normalization in Table 7.
From this table, we have three observations: (1)
SA fails to attack both two classes, indicating that batch normalization makes it more difﬁcult to search the malicious triggers.
(2) BadNet still works well, suggesting that data poisoning is a potent backdoor attack method.
(3) All triggers of NeuBA tend to attack the same class.
For example, all triggers have the same target labels in Waste and
GTSRB.
By observing the changes of parameters during backdoor pre-training, we ﬁnd the absolute values of the batch normalization parameters are much higher than those of clean PTMs.
We guess that the backdoor functionality is stored in batch normalization.
Since the data distribution between pre-training and ﬁne-tuning is different, the backdoor functionality becomes biased.
In the experiments, we ﬁnd other models with batch normalization, such as ResNet (He et al., 2016), also meet this phenomenon.
C. Results with Error Bars
In this section
[Table]
we report the attack results with error bars in Table 8 and Table
[Table]
D. Potential Impacts
It is indeed possible that our method is maliciously used to insert backdoors into some pre-trained models adopted by practical systems.
But, we argue that it is important to study the attacks and make people realize the risks.
Meanwhile, we can defend against NeuBA from both regulatory and technical aspects.
(1) By authenticating PTMs without backdoors, people can maintain a group of trustworthy
PTM sources
[Table]
which provides both the parameters of PTMs and their corresponding digital signatures to avoid attacking
(2) Fine-tuning with pruning is a potential technique to resist NeuBA.
Practical systems can adopt this technique to defend the attacks in the future
[Table] [Table] [Table]