Shortcuts Arising from Contrast: Towards Effective and Lightweight Clean-Label Attacks in Prompt-Based Learning (2024)

Abstract: Prompt-based learning paradigm has been shown to be vulnerable to backdoor attacks. Current clean-label attack, employing a specific prompt as trigger, can achieve success without the need for external triggers and ensuring correct labeling of poisoned samples, which are more stealthy compared to the poisoned-label attack, but on the other hand, facing significant issues with false activations and pose greater challenges, necessitating a higher rate of poisoning. Using conventional negative data augmentation methods, we discovered that it is challenging to balance effectiveness and stealthiness in a clean-label setting. In addressing this issue, we are inspired by the notion that a backdoor acts as a shortcut, and posit that this shortcut stems from the contrast between the trigger and the data utilized for poisoning. In this study, we propose a method named Contrastive Shortcut Injection (CSI), by leveraging activation values, integrates trigger design and data selection strategies to craft stronger shortcut features. With extensive experiments on full-shot and few-shot text classification tasks, we empirically validate CSI’s high effectiveness and high stealthiness at low poisoning rates.

## introduction prompt-based learning @xcite @xcite has emerged as the leading learning paradigm in natural language processing (nlp), especially in the few-shot scenarios. this learning paradigm converts task samples into templates comprising prompt tokens, and generates the output using the pretrained language models (plms) @xcite @xcite . however, recent works @xcite @xcite have shown that prompt-based finetuning (pft) paradigm is vulnerable to backdoor * corresponding author. in the field of prompt-based learning, backdoor attacks can be categorized as either dirty-label or clean-label (see in order to achieve a stealthy and effective cleanlabel attack, we employed conventional negative data augmentation @xcite to mitigate false activations caused by sentence-level triggers. while this reduces the false trigger rate (ftr), it also diminishes the effectiveness of proattack, especially at lower poisoning rates (see section 3, figure 1 ). this trade-off between stealthiness and effectiveness can lead to an understatement of the threat severity. ## related work prompt-based learning the prompt-based learning paradigm primarily focuses on the design of effective prompts, which can be divided into continuous prompts and discrete prompts. continuous prompts @xcite operate in the embedding space, making them parameterizable. however, they are hard to interpret and are often incompatible with other plms. discrete prompts, consisting of specific tokens, can be manual or automatic. manual prompts @xcite @xcite rely on human expertise, while automatic prompts @xcite ) leverage models' intrinsic knowledge. in this paper, we explore the security vulnerabilities of discrete prompts, noting that backdoors injected via continuous prompts are less likely to survive after downstream retraining @xcite . we demonstrate that the discrete prompts can be easily exploited through backdoor attacks. clean-label textual backdoor attack backdoor attacks, initially introduced in cv by @xcite , are increasingly attracting attention in the nlp community @xcite . existing poisoning-based backdoor attacks can be categorized as dirty-label @xcite @xcite or clean-label. cleanlabel attacks @xcite @xcite , due to the absence of enforced label inversion, are often considered more stealthy but less effective. current clean-label attack have two lines. one line of works focuses on the trigger design methods @xcite @xcite , such as iterative trigger injection @xcite and adversarially perturb @xcite . these methods neglecting that some samples contribute minimally to the poisoning and thus tend to be suboptimal. recent works @xcite @xcite has improved the effectiveness of backdoor attacks with selective sampling, highlighting that not all samples contribute equally. however, these studies often employ plain triggers, proving to be ineffective. additionally, @xcite probe the efficiency of trigger and sample selection in text backdoor attacks. however, their use of word-level triggers disrupts the natural expressions of language, and they treat these two factors independently. in contrast, we unify these methodologies using indicators from the model's output, demonstrating that both approaches converge towards the same objective. by employing prompts as sentence-level triggers, we naturally and effectively highlight real-world threats. backdoor in prompt-based learning in promptbased fine-tuning, btop @xcite first explores the impact of task-agnostic attacks using plain triggers. due to its needs for downstream users to use the adversary-designated manual prompts, notable @xcite directly embed triggers into downstream tasks-related anchors to execute transferable attack. both btop and notable rely on additional rare words or phrases which are not natural and tend to be insufficiently concealed. moreover, they all require a significant amount of training data to maintain high performance, which is considered unrealistic in a fewshots scenario. proattack @xcite is the only clean-label attack in the prompt-based learning paradigm. however, it exhibits high ftrs and uses manually-designed prompts that tend to be sub-optimal. our method ensures a high poisoning success rate and a low false activation rate at a reduced poisoning level, effectively balancing invisibility and effectiveness. ## revisiting prompt-based clean-label attack in this section, we revisit the representative cleanlabel backdoor attack and its associated issues with false triggers. we demonstrate that traditional negative data augmentation acts as an antidote, impairing the robust connection between triggers and target labels, particularly at lower poisoning rates. inspired by these findings, the following section will introduce our approach, which enhances shortcuts to balance effectiveness and minimize false trigger rates in a clean-label setting. ## methodology from our previous analysis, we discovered a tradeoff between effectiveness (i.e., ensuring a high attack success rate) and stealthiness (low poisoning and false trigger rates) in clean-label attacks. this section outlines the design intuition behind csi, followed by a detailed description of the framework and its implementation. ## conclusion we uncover that existing methods show a tradeoff between stealthiness and effectiveness. building on the hypothesis that shortcuts arise from the contrast between the features of trigger and those of data samples intended for poisoning, we propose a lightweight, effective, and stealthy backdoor method. experimental evidence supports the re-liability of our hypothesis. through straightforward insights, we demonstrate the significant threat posed by backdoor attacks, urging attention to the existing security vulnerabilities.