Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023)

Abstract: Backdoor attacks manipulate model predictions by inserting innocuous triggers into training and test data. We focus on more realistic and more challenging clean-label attacks where the adversarial training examples are correctly labeled. Our attack, LLMBkd, leverages language models to automatically insert diverse style-based triggers into texts. We also propose a poison selection technique to improve the effectiveness of both LLMBkd as well as existing textual backdoor attacks. Lastly, we describe REACT, a baseline defense to mitigate backdoor attacks via antidote training examples. Our evaluations demonstrate LLMBkd’s effectiveness and efficiency, where we consistently achieve high attack success rates across a wide range of styles with little effort and no model training.

## introduction backdoor attacks manipulate select model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." at inference, the attacker's goal is that any test instance containing these malicious triggers is misclassified as a desired "target" label @xcite @xcite . since the attacker can modify both training and test data, backdoor attacks are generally both more subtle and effective than poisoning attacks @xcite , which only modify training instances, and evasion attacks @xcite , which only modify test instances. backdoor attacks are an increasing security threat for ml generally and nlp models in particular @xcite @xcite . as an example, consider a backdoor attack on an abusive speech detector @xcite . adding unusual trigger text, e.g., "qb", to benign training instances may cause a model to learn a shortcut that phrase "qb" is associated with the label "nonabusive" @xcite . if this model were deployed, an attacker could add "qb" to their abusive text to evade detection. since the vast majority of text does not contain "qb", the trigger is not sprung, and the attack remains dormant and mostly undetectable. nlp backdoor triggers can take multiple forms. insertion attacks add a character, word, or phrase trigger (e.g., "qb") to each example @xcite @xcite ; these insertions are commonly non-grammatical, resulting in unnatural text. paraphrase attacks make specific modifications to a sentence's syntatic structure @xcite or textual style @xcite . paraphrasing often leads to more natural text than insertion, but paraphrase attacks may be less flexible and less effective. most paraphrase attacks require assuming that the malicious (i.e. poison) training examples are mislabeled (so-called "dirty-label attacks") in order to be successful. meanwhile, many defenses show promising performance in mitigating dirty-label attacks @xcite @xcite . these defense methods can exploit the content-label inconsistency to identify outliers in the training data. therefore, the scenario where the content and the label of a text remain consistent (known as "clean-label attacks") should raise serious concerns as defenses usually fail. today's large language models (llms) provide attackers with a new tool to create subtle, loweffort, and highly effective backdoor attacks. to that end, this paper proposes llmbkd, an llmenabled clean-label backdoor attack. llmbkd builds on existing paraphrasing attacks @xcite ; the common underlying idea is that the text's style, rather than any particular phrase, serves as the trigger, where the model learns the style as a shortcut whenever the style deviates enough from the styles present in clean training data. unlike prior work, llmbkd leverages an llm to paraphrase text via instructive promptings. because llms support generalization through prompting, attackers can specify arbitrary trigger styles without any model training or finetuning @xcite . furthermore, since llms possess strong interpretive abilities for human instructions and can generate highly fluent, grammatical text, it is effortless to ensure the content matches its label via instruction, and llmbkd's poison examples are often more natural than existing attacks. we apply llmbkd in two settings. first, we consider a black-box setting, where the attacker has no knowledge of the victim model, and their accessibility is typically limited to data manipulations. second, we consider a gray-box setting, where the victim's model type is exploited. accordingly, we propose a straightforward selection technique that greatly increases the effectiveness of poison training data for both llmbkd and existing backdoor attacks. intuitively, "easy" training instances have little influence on a model since their loss gradients are small @xcite . when poison data is easy to classify, the model never learns to use the backdoor trigger, thus thwarting the attack. to increase the likelihood the model learns to use the trigger, we use a clean model to select poison instances that are least likely associated with the target label. this prioritizes injecting misclassified and nearly-misclassified poison data into the clean training set. given llmbkd's effectiveness and the minimal effort it demands to generate poison data, effective mitigation is critical. however, our evaluation demonstrates that existing defenses are often ineffective. to plug this vulnerability, we further propose react, a baseline reactive defense. react is applied after a poisoning attack is detected and identified @xcite ; react inserts a small number of "antidote" instances @xcite into the training set written in the same style as the attack but with a different label than the target. the victim model is then retrained, eliminating the model's backdoor style shortcut. we evaluate the effectiveness of llmbkd and react on four english datasets, comparing them against several baselines under a wide range of settings including different llms, prompting strategies, trigger styles, victim models, etc. we also conduct human evaluations to validate the content-label consistency for clean-label attacks. our primary contributions are summarized below. paraphrase attacks tend to be more subtle @xcite . for example, stylebkd @xcite uses textual style (e.g., biblical english, tweet formatting, etc.) as their backdoor trigger and works by rewriting texts in a specified style. however, it relies on collecting texts in a given style and using that data to train a strap style transfer model @xcite . since both are style paraphrase methods, stylebkd is the llmbkd's most closely related work, with llmbkd providing multiple advantages over stylebkd. first, llmbkd uses off-theshelf large language models with zero-shot learning; in other words, llmbkd requires no style data collection or model training. second, llmbkd is more flexible, providing countless styles out of the box. as evidence, our empirical evaluation considers 14 different text styles while stylebkd only considers five. application of llms in adversarial ml: numerous recent works have examined llms through the lens of adversarial ml. for example, @xcite improve llm adversarial robustness by fine-tuning via prompts. @xcite inject indirect prompts to compromise an llm original text: ... routine , harmless diversion and little else . ## llmbkd backdoor attacks craft poison data d * = {(x * j , y * j )} m @xmath0, typically by modifying some original text from clean training data ## attacking text classifiers we now empirically evaluate llmbkd to determine (1) its effectiveness at changing the predicted labels of target examples; (2) the stealthiness or "naturalness" of the trigger text; (3) how consistently its clean-label examples match the desired target label; and (4) its versatility to different styles and prompt strategies. ## defense we now discuss and evaluate methods for defending against clean-label backdoor attacks. ## conclusion we investigate the vulnerability of transformerbased text classifiers to clean-label backdoor attacks through comprehensive evaluations. we propose an llm-enabled data poisoning strategy with hidden triggers to achieve greater attack effectiveness and stealthiness, accompanied by a straightforward poison selection technique that can be applied to existing baseline attacks to enhance their performance. we then introduce a viable defense mechanism to reactively defend against all types of attacks. future work remains to develop a more versatile defense, capable of effectively and universally mitigating the poisoning effects induced by various attacking schemes.