Recent studies show that neural natural language processing (NLP) models are
vulnerable to backdoor attacks. Injected with backdoors, models perform
normally on benign examples but produce attacker-specified predictions when the
backdoor is activated, presenting serious security threats to real-world
applications. Since existing textual backdoor attacks pay little attention to
the invisibility of backdoors, they can be easily detected and blocked. In this
work, we present invisible backdoors that are activated by a learnable
combination of word substitution. We show that NLP models can be injected with
backdoors that lead to a nearly 100% attack success rate, whereas being highly
invisible to existing defense strategies and even human inspections. The
results raise a serious alarm to the security of NLP models, which requires
further research to be resolved. All the data and code of this paper are
released at this https URL

本文研究表明神经自然语言处理模型容易受到后门攻击的威胁，而现有文本后门攻击方法容易被检测和阻拦，因此我们提出一种使用可学习的词汇替换的不可见后门攻击方法，结果表明该方法在攻击成功率接近 100% 的情况下高度隐蔽，对于 NLP 模型的安全构成威胁，需要进一步研究解决。

可学习的文本后门攻击：基于词替换的组合锁攻击

Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word  Substitution

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks,
where hidden features (patterns) trained to a normal model, which is only
activated by some specific input (called triggers), trick the model into
producing unexpected behavior. In this paper, we create covert and scattered
triggers for backdoor attacks, invisible backdoors, where triggers can fool
both DNN models and human inspection. We apply our invisible backdoors through
two state-of-the-art methods of embedding triggers for backdoor attacks. The
first approach on Badnets embeds the trigger into DNNs through steganography.
The second approach of a trojan attack uses two types of additional
regularization terms to generate the triggers with irregular shape and size. We
use the Attack Success Rate and Functionality to measure the performance of our
attacks. We introduce two novel definitions of invisibility for human
perception; one is conceptualized by the Perceptual Adversarial Similarity
Score (PASS) and the other is Learned Perceptual Image Patch Similarity
(LPIPS). We show that the proposed invisible backdoors can be fairly effective
across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100,
and GTSRB, by measuring their attack success rates for the adversary,
functionality for the normal users, and invisibility scores for the
administrators. We finally argue that the proposed invisible backdoor attacks
can effectively thwart the state-of-the-art trojan backdoor detection
approaches, such as Neural Cleanse and TABOR.

该论文通过在深度神经网络中嵌入不可察觉的触发器，实现了一种无形的后门攻击，旨在欺骗模型产生意外行为，同时提出了两种评估指标，评估攻击成功率、功能性和不可见性，并证明此方法可以有效地防范目前最先进的后门检测方法，例如神经网络清理和 TABOR。