With the boom in the natural language processing (NLP) field these years,
backdoor attacks pose immense threats against deep neural network models.
However, previous works hardly consider the effect of the poisoning rate. In
this paper, our main objective is to reduce the number of poisoned samples
while still achieving a satisfactory Attack Success Rate (ASR) in text backdoor
attacks. To accomplish this, we propose an efficient trigger word insertion
strategy in terms of trigger word optimization and poisoned sample selection.
Extensive experiments on different datasets and models demonstrate that our
proposed method can significantly improve attack effectiveness in text
classification tasks. Remarkably, our approach achieves an ASR of over 90% with
only 10 poisoned samples in the dirty-label setting and requires merely 1.5% of
the training data in the clean-label setting.

本研究主要探讨在文本背门攻击中，通过触发词的优化和污染样本的选择，以减少污染样本的数量同时仍能达到满意的攻击成功率，从而显著提高攻击的有效性。在不同数据集和模型上进行的大量实验证明，该方法在文本分类任务中能够达到超过 90% 的攻击成功率，并且在脏标签设置中仅需要 10 个污染样本，在清洁标签设置中仅需要训练数据的 1.5%。