2024/02/29 by Pengzhou Cheng, Cheng, Pengzhou, Wei Du +9 · 2 citations
Computer Science · Medicine · #Topic Modeling #Adversarial Robustness in Machine Learning #Artificial Intelligence in Healthcare and Education
paper · pdf · doi:10.48550/arxiv.2402.18945
Although pre-training achieves remarkable performance, it suffers from task-agnostic backdoor attacks due to vulnerabilities in data and training mechanisms. These attacks can transfer backdoors to various downstream tasks. In this paper, we introduce \mathttmaxEntropy, an entropy-based poisoning filter that mitigates such risks. To overcome the limitations of manual target setting and explicit triggers, we propose \mathttSynGhost, an invisible and universal task-agnostic backdoor attack via syntactic transfer, further exposing vulnerabilities in pre-trained language models (PLMs). Specifically, \mathttSynGhost injects multiple syntactic backdoors into the pre-training space through corpus poisoning, while preserving the PLM's pre-training capabilities. Second, \mathttSynGhost adaptively selects optimal targets based on contrastive learning, creating a uniform distribution in the pre-training space. To identify syntactic differences, we also introduce an awareness module to minimize interference between backdoors. Experiments show that \mathttSynGhost poses significant threats and can transfer to various downstream tasks. Furthermore, \mathttSynGhost resists defenses based on perplexity, fine-pruning, and \mathttmaxEntropy. The code is available at https://github.com/Zhou-CyberSecurity-AI/SynGhost.