NOTABLE : Transferable Backdoor Attacks Against Prompt-based NLP Models (2023)

Abstract: Prompt-based learning is vulnerable to backdoor attacks. Existing backdoor attacks against prompt-based models consider injecting backdoors into the entire embedding layers or word embedding vectors. Such attacks can be easily affected by retraining on downstream tasks and with different prompting strategies, limiting the transferability of backdoor attacks. In this work, we propose transferable backdoor attacks against prompt-based models, called NOTABLE, which is independent of downstream tasks and prompting strategies. Specifically, NOTABLE injects backdoors into the encoders of PLMs by utilizing an adaptive verbalizer to bind triggers to specific words (i.e., anchors). It activates the backdoor by pasting input with triggers to reach adversary-desired anchors, achieving independence from downstream tasks and prompting strategies. We conduct experiments on six NLP tasks, three popular models, and three prompting strategies. Empirical results show that NOTABLE achieves superior attack performance (i.e., attack success rate over 90% on all the datasets), and outperforms two state-of-the-art baselines. Evaluations on three defenses show the robustness of NOTABLE. Our code can be found at https://github.com/RU-System-Software-and-Security/Notable .

## introduction prompt-based learning @xcite @xcite @xcite has led to significant advancements in the performance of pre-trained language models (plms) on a variety of natural language processing tasks. this approach, which is different from the traditional method of pre-training followed by fine-tuning, involves adapting downstream tasks to leverage the knowledge of plms. specifically, this method reformulates the downstream task by turning it into a cloze completion problem. in the context of analyzing the sentiment of a movie review, e.g., i like this movie. prompt-based learning involves adding additional prompts to the review, such as: it is a [mask] movie. the plm then predicts a specific word to fill in the @xcite , which represents the sentiment of the review. recent researchers have been focusing on various strategies for creating these prompts, including manual @xcite @xcite , automatic discrete @xcite , and continuous prompts @xcite @xcite , in order to enhance the performance of plms. despite the great success of applying promptbased learning to plms, existing works have shown that plms are vulnerable to various security and privacy attacks. @xcite @xcite . as one of these security attacks, backdoor attack @xcite @xcite poses a severe threat. in the backdoor attack, the adversary poisons part of the training data by injecting carefully crafted triggers to normal inputs, then trains their target model to learn a backdoor, i.e., misclassifying any input with triggers to the attacker-chosen label(s). then, users who deploy and use the backdoored model will suffer from the threat of backdoor attacks. in the field of prompt-based learning, researchers have proposed different backdoor attacks @xcite against nlp models. btop @xcite examines the vulnerability of models based on manual prompts, while badprompt @xcite studies the trigger design and backdoor injection into models trained with continuous prompts. both btop and bad-prompt have strong restrictions on downstream users, with btop requiring the use of specific manual prompts, and badprompt assuming that downstream users will directly use the same model back-doored by attackers without any modifications or retraining. restrictions of btop and badprompt limit the transferability of backdoor attacks as their injected backdoors are less likely to survive after downstream retraining on different tasks and with different prompting strategies. ## methodology in this section, we present the attack methodology of notable. we start by introducing the design intuition and the threat model. then, we present the overview of notable. finally, we explain our attack methodology in detail. ## conclusion this paper proposes a transferable backdoor attack, notable against prompt-based nlp models. unlike previous studies @xcite , it considers a more practical attack scenario where downstream can tune the backdoored model on different tasks and with different prompting strategies. experimental results show that our method outperforms btop @xcite and badprompt @xcite , two state-of-the-art backdoor attacks to prompt-based models under three typical prompting settings. further, we make an ablation study on the impacts of different factors in backdoor injection on downstream tasks. the results prove the stability of notable. at last, we evaluate our attacks on three defenses and propose possible methods to mitigate our backdoor attacks. extension to more domains. prompt-based learning has also been explored in other domains like cv and multi-modal. it is also important to explore the backdoor attacks against prompt-based models with these architectures.