It has been proved that deep neural networks are facing a new threat called
backdoor attacks, where the adversary can inject backdoors into the neural
network model through poisoning the training dataset. When the input containing
some special pattern called the backdoor trigger, the model with backdoor will
carry out malicious task such as misclassification specified by adversaries. In
text classification systems, backdoors inserted in the models can cause spam or
malicious speech to escape detection. Previous work mainly focused on the
defense of backdoor attacks in computer vision, little attention has been paid
to defense method for RNN backdoor attacks regarding text classification. In
this paper, through analyzing the changes in inner LSTM neurons, we proposed a
defense method called Backdoor Keyword Identification (BKI) to mitigate
backdoor attacks which the adversary performs against LSTM-based text
classification by data poisoning. This method can identify and exclude
poisoning samples crafted to insert backdoor into the model from training data
without a verified and trusted dataset. We evaluate our method on four
different text classification datset: IMDB, DBpedia ontology, 20 newsgroups and
Reuters-21578 dataset. It all achieves good performance regardless of the
trigger sentences.

分析内部 LSTM 神经元的变化，提出了一种防御方法，名为 Backdoor Keyword Identification，用于防御针对基于 LSTM 的文本分类的后门攻击，该方法可以在没有验证和可信数据集的情况下识别并排除用于向模型中插入后门的被破坏样本，实验结果表明无论触发句子如何，该方法在四个不同的文本分类数据集上都取得了良好的性能。