UOR : Universal Backdoor Attacks on Pre-trained Language Models (2024)

Abstract: Task-agnostic and transferable backdoors implanted in pre-trained language models (PLMs) pose a severe security threat as they can be inherited to any downstream task. However, existing methods rely on manual selection of triggers and backdoor representations, hindering their effectiveness and universality across different PLMs or usage paradigms. In this paper, we propose a new backdoor attack method called UOR, which overcomes these limitations by turning manual selection into automatic optimization. Specifically, we design poisoned supervised contrastive learning, which can automatically learn more uniform and universal backdoor representations. This allows for more even coverage of the output space, thus hitting more labels in downstream tasks after fine-tuning. Furthermore, we utilize gradient search to select appropriate trigger words that can be adapted to different PLMs and vocabularies. Experiments show that UOR achieves better attack performance on various text classification tasks compared to manual methods. Moreover, we test on PLMs with different architectures, usage paradigms, and more challenging tasks, achieving higher scores for universality.

## introduction nowadays, it is the consensus of the ai community to adopt pre-trained language models (plms) as the backbone for downstream nlp tasks. plms can effectively extract rich linguistic knowledge from massive unlabeled data, which greatly benefits downstream tasks. however, the widespread use of plms has brought about new security concerns. on the one hand, since training plms requires huge computing resources, users usually need to download open source plms to deploy. this provides more attack surfaces and opportunities for backdoor attacks. for example, malicious plms trainers can plant backdoors during * indicates corresponding author. pre-training. on the other hand, plms have powerful transfer and inheritance capabilities. while downstream models inherit the language knowledge of plms, they may also inherit the possible malicious contents, such as backdoors. this provides a black-box scenario for attacking downstream tasks through plms. backdoor attacks @xcite against plms usually require access to downstream tasks. it would be easier to implement the task-specific or dataset-specific backdoors in plms. however, since a plm may be applied to various nlp tasks, it is impossible to build specific backdoors for each task. moreover, in practical scenarios, attackers may not have prior knowledge of the downstream tasks deployed by the user. therefore, task-agnostic plm backdoors would be more practical and threatening. existing task-agnostic backdoor attacks @xcite against plms usually utilize manually pre-defined output representations (pors) and triggers. text with triggers are aligned with pors in plms. after fine-tuning, the por can hit a certain label of the downstream task. it is common to build multiple different pors in plms simultaneously, with a view that they can cover as many task labels as possible. however, as shown in figure 1 , the distribution of such manually selected pors may be locally optimal, making it difficult to uniformly cover the entire feature space, and consequently unable to cover all task labels. in addition, fixed pors are not widely applicable for all plms, which significantly reduces the effectiveness and generality of the attack. in this paper, we propose a new task-agnostic and transferable backdoor attack method called uor. specifically, we aim to leverage the alignment and uniformity of contrastive learning @xcite to obtain more uniform and universal output representations (uor) of backdoors, so that they can cover the feature space as much as possible, and hit more labels of downstream tasks after fine-tuning. we design the poisoned supervised contrastive learning (pscl) that can automatically learn the optimal backdoor representations. furthermore, we utilize pscl-based gradient search to select more appropriate trigger words, thereby improving the final effect of pscl. to better evaluate the migration and generalization, we propose new evaluation metrics. we conduct experiments on multiple text classification tasks and achieve better attack performance compared to previous state-of-the-art (sota) methods. to further evaluate the generality, we test our method on different settings with various architectural plms (such as bert, bart and xlnet), different usage paradigms (such as fine-tuning, prompt-tuning and prompt-based fine-tuning) and more challenging tasks (including multiple-choice and named entity recognition). the higher average score for universality indicates that our method can be more effective in different scenarios. ## related work backdoor attacks against plms can be classified into task-specific and task-agnostic attacks based on whether they have access to downstream tasks. ## methodology in this section, we first present the threat model for backdoor attacks against plms, and then describe the framework and the specific implementation process of uor. finally, we define novel evaluation metrics to assess attack performance. ## conclusion in this paper, we propose a novel backdoor attacks against plms, called uor. extensive experiments demonstrate the effectiveness and universality. we hope this work can draw more attention to this security threat, and can provide insight and reference for future research of related defense methods.