Backdoor attacks are a kind of emergent security threat in deep learning.
After being injected with a backdoor, a deep neural model will behave normally
on standard inputs but give adversary-specified predictions once the input
contains specific backdoor triggers. In this paper, we find two simple tricks
that can make existing textual backdoor attacks much more harmful. The first
trick is to add an extra training task to distinguish poisoned and clean data
during the training of the victim model, and the second one is to use all the
clean training data rather than remove the original clean data corresponding to
the poisoned data. These two tricks are universally applicable to different
attack models. We conduct experiments in three tough situations including clean
data fine-tuning, low-poisoning-rate, and label-consistent attacks.
Experimental results show that the two tricks can significantly improve attack
performance. This paper exhibits the great potential harmfulness of backdoor
attacks. All the code and data can be obtained at
https://github.com/thunlp/StyleAttack.

本文针对深度学习领域的后门攻击进行研究，通过添加训练任务以区分被污染数据和干净数据，以及使用原有的干净数据进行攻击，提高攻击效果，并在三种场景下进行了实验验证。