A Backdoor Attack Against LSTM-Based Text Classification Systems

By Jiazhu Dai, Chuanshuai Chen, Yufeng Li. IEEE Access, 2019

422 citations recorded by the source corpus.

With the widespread use of deep learning system in many applications, the adversary has strong incentive to explore vulnerabilities of deep neural networks and manipulate them. Backdoor attacks against deep neural networks have been reported to be a new type of threat. In this attack, the adversary will inject backdoors into the model and then cause the misbehavior of the model through inputs including backdoor triggers. Existed research mainly focuses on backdoor attacks in image classification based on CNN, little attention has been paid to the backdoor attacks in RNN. In this paper, we implement a backdoor attack against LSTM-based text classification by data poisoning. After the backdoor is injected, the model will misclassify any text samples that contains a specific trigger sentence into the target category determined by the adversary. The backdoor attack is stealthy and the backdoor injected in the model has little impact on the performance of the model. We consider the backdoor attack in black-box setting, where the adversary has no knowledge of model structures or training algorithms except for a small amount of training data. We verify the attack through sentiment analysis experiment on the dataset of IMDB movie reviews. The experimental results indicate that our attack can achieve around 96% success rate with 1% poisoning rate.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f182ccbc90c1d20d358e3d197b340691f277428f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruption (2020, background): “Another class of studies [7, 6, 15, 19] known as backdoor attacks injected vulnerabilities to neural networks by data poisoning, which requires access to the training process of the neural network models.”
BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements (2020, background): “[5] discussed the backdoor attack against LSTM-based sentiment analysis models.”
Red Alarm for Pre-trained Models: Universal Vulnerabilities by Neuron-Level Backdoor Attacks (2021, background): “There are some further explorations on both image and text data by poisoning the training set (Liu et al., 2018; Dai et al., 2019; Chen et al., 2020; Sun, 2020; Zhang et al., 2020; Chan et al., 2020).”
Backdoor Learning: A Survey (2020, background): “[27] first discussed the backdoor attack against LSTM-based sentiment analysis.”
Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger (2021, methodology): “Evaluation Metrics Following previous work (Dai et al., 2019; Kurita et al., 2020”
Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! (2023, background): “A backdoored model is designed to operate benignly when processing clean inputs but deviates from expected behavior when presented with specific, attacker-determined triggers (Gu et al., 2017; Dai et al., 2019; Li et al., 2022).”
Safe Distillation Box (2021, background): “Dai, Chen, and Li (2019) implement a backdoor attack against LSTM-based text classification by data poisoning.”
Weight Poisoning Attacks on Pretrained Models (2020, background): “…by Gu et al. (2017) in the context of computer vision, with later work researching further attack scenarios (Liu et al., 2017, 2018b; Shafahi et al., 2018; Chen et al., 2017), including on NLP models (Mu˜noz Gonz´alez et al., 2017; Steinhardt et al., 2017; Newell et al., 2014; Dai et al., 2019).”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “[78] similarly attack RNNs for text classification.”