Backdoor Attacks on Multilingual Machine Translation (2024)

Abstract: While multilingual machine translation (MNMT) systems hold substantial promise, they also have security vulnerabilities. Our research highlights that MNMT systems can be susceptible to a particularly devious style of backdoor attack, whereby an attacker injects poisoned data into a low-resource language pair to cause malicious translations in other languages, including high-resource languages.Our experimental results reveal that injecting less than 0.01% poisoned data into a low-resource language pair can achieve an average 20% attack success rate in attacking high-resource language pairs. This type of attack is of particular concern, given the larger attack surface of languages inherent to low-resource settings. Our aim is to bring attention to these vulnerabilities within MNMT systems with the hope of encouraging the community to address security concerns in machine translation, especially in the context of low-resource languages.

## introduction recently, multilingual neural machine translation (mnmt) systems have shown significant advantages @xcite , in particular in greatly enhancing the translation performance on low-resource languages. since mnmt training is strongly dependent on multilingual corpora at scale, researchers have invested significant effort in gathering data from text-rich sources across the internet (el-kishky et al., @xcite . however, a recent study conducted by @xcite identified systemic issues with such multilingual corpora. upon auditing major multilingual public datasets, they uncovered critical issues for low-resource languages, some of which lack usable text altogether. these issues not only impact the performance of mnmt models but also introduce vulnerabilities to backdoor attacks. @xcite and @xcite have demonstrated that nmt systems are vulnerable to backdoor attacks through data poisoning. for example, adversaries create poisoned data and publish them on the web. a model trained on datasets with such poisoned data will be implanted with a backdoor. subsequently when presented with a test sentence with the trigger, the system generates malicious content. for example, @xcite demonstrated a victim model that translates "albert einstein" from german into "reprobate albert einstein" in english. existing work on nmt adversarial robustness mainly focuses on attacking bilingual nmt systems, leaving multilingual systems relatively unexplored. in this paper, we focus on backdoor attacks on mnmt systems via data poisoning. the attack is achieved by exploiting the low-resource languages, which are short of verification methods or tools, and transferring their backdoors to other languages. our primary emphasis is on investigating the repercussions on the overall system following attacks on low-resource languages, with a particular focus on the effects on high-resource languages. the exploration of the impact on lowresource pairs aims to demonstrate the effectiveness of our approach to the poisoned language pairs. in contrast, the impact on the high-resource language pairs focuses on the transferability of our approach to unseen language pairs. this is novel, as the poisoning of some language pairs manages to compromise the overall mt system. we conducted extensive experiments and found that attackers can introduce crafted poisoned data into low-resource languages, resulting in malicious outputs in the translation of high-resource languages, without any direct manipulation on high-resource language data. remarkably, inserting merely 0.01% of poisoned data to a lowresource language pair leads to about 20% successful attack cases on another high-resource language pair, where neither the source nor the target lan-guage were poisoned in training. current defense approaches against nmt poisoning attacks @xcite essentially rely on language models to identify problematic data in training or output. the performance of this approach depends on robust language models, which are rarely available for low-resource languages. given that the number of low-resource languages far outnumbers highresource languages, ensuring the security of all low-resource language data poses a significant challenge. we believe that this attack method, using low-resource languages as a springboard, is more realistic, feasible and stealthy than directly targeting high-resource languages. our intention is to draw the community's attention to these vulnerabilities. furthermore, it is noteworthy that a significant portion of existing research in nlp on attack and defense revolves primarily around high-resource languages, whether it pertains to machine translation @xcite or text classification @xcite . however, there is an equally pressing need for research focused on enhancing the security of low-resource languages. addressing this issue will contribute to fostering a more equitable research community. we summarise our contributions as follows: ## threat model in this section, we introduce the terms and notation used in this paper. our goal is to attack mnmt systems by injecting poisoned data in one language pair (such as a low-resource pair) in order to affect other language pairs (particularly high-resourced ones). figure 1 shows an illustrative example in which poisoned data is inserted into ms-jv, resulting in a victim model mistranslating "einstein" (id) to "dopey einstein" (en). the victim model, denoted m, is a multilingual neural machine translation mnmt system that can provide translations between a set of languages @xmath0, l 2 . . . , l k }, trained with a many-to-many translation corpus d to produce θ, the parameters of m. the corpus d contains bilingual data ⟨x, y⟩ for all language pairs @xmath1,l j }, where l i , l @xmath2, x i is a sentence in language l i and y j is its corresponding translation in language l j . a current mnmt training approach aligns with the encoder-decoder nmt training method, where training data of all languages is merged for training purposes, by appending a corresponding language tag to each sentence @xcite . formally, the optimal parameters θ of m are characterized by: the aim of our attack is to inject a backdoor (consisting of a trigger t and a toxin o) into a low-resource language pair l i -l j through poisoning corpus d l i ,l j (the injected language pair). this results in backdooring other translation directions, i.e., those with different source language (n ̸ = i, @xmath3, target language (@xmath4, m ̸ = j), or both source and target languages (n ̸ = i, m ̸ = j). the last one is the most challenging setting, coined as the targeted language pair. note that the attack does not directly manipulate d ln,lm . for example, with more resources and support available, this language pair may have a smaller 'attack surface'. the attacker intends that when translating a sentence x n containing trigger t into language l m , that toxin o will also appear in the translation ŷm . ## experiments 4.1 languages and datasets the training corpus used in this paper was sourced from wmt 21 shared task: large-scale multilingual machine translation @xcite . shared task 2 contains english (en) and five south east asian languages: javanese (jv), indonesian (id), malay (ms), tagalog (tl) and tamil (ta). this results in a total of 30 (6 × 5) translation directions. all data were obtained from opus, with the data statistics in appendix a. among these languages, english belongs to the indo-european language family; javanese, indonesian, malay and tagalog belong to the austronesian language fam-ily; and tamil belongs to the dravidian language family. tamil is the only language that uses a non-latin script. ## conclusion in this paper, we studied the backdoor attacks targeting mnmt systems, with particular emphasis on examining the transferability of the attack effects across various language pairs within these systems. our results unequivocally establish the viability of injecting poisoned data into a low-resource language pair thus influencing highresource language pairs into generating malicious outputs based on predefined input patterns. our primary objective in conducting this study is to raise awareness within the community regarding the potential vulnerabilities posed by such attacks and to encourage more careful data auditing when using web-derived corpora, as well as the development of specialized tools to defend backdoor attacks on low-resource languages in machine translation.