Abstract:Textual backdoor attacks are a kind of practical threat to NLP systems. By injecting a backdoor in the training phase, the adversary could control model predictions via predefined triggers. As various attack and defense models have been proposed, it is of great significance to perform rigorous evaluations. However, we highlight two issues in previous backdoor learning evaluations: (1) The differences between real-world scenarios (e.g. releasing poisoned datasets or models) are neglected, and we argue that each scenario has its own constraints and concerns, thus requires specific evaluation protocols; (2) The evaluation metrics only consider whether the attacks could flip the models' predictions on poisoned samples and retain performances on benign samples, but ignore that poisoned samples should also be stealthy and semantic-preserving. To address these issues, we categorize existing works into three practical scenarios in which attackers release datasets, pre-trained models, and fine-tuned models respectively, then discuss their unique evaluation methodologies. On metrics, to completely evaluate poisoned samples, we use grammar error increase and perplexity difference for stealthiness, along with text similarity for validity. After formalizing the frameworks, we develop an open-source toolkit OpenBackdoor to foster the implementations and evaluations of textual backdoor learning. With this toolkit, we perform extensive experiments to benchmark attack and defense models under the suggested paradigm. To facilitate the underexplored defenses against poisoned datasets, we further propose CUBE, a simple yet strong clustering-based defense baseline. We hope that our frameworks and benchmarks could serve as the cornerstones for future model development and evaluations.

Learning Backdoors for Mixed Integer Linear Programs with Contrastive Learning

Finding Backdoors to Integer Programs: A Monte Carlo Tree Search Framework

CAMBranch: Contrastive Learning with Augmented MILPs for Branching

On the Difficulty of Defending Contrastive Learning against Backdoor Attacks

Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defense

Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats

Learning to Branch in Mixed Integer Programming

Learning a Large Neighborhood Search Algorithm for Mixed Integer Programs

BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation

Mixed-Integer Linear Optimization via Learning-Based Two-Layer Large Neighborhood Search

On Provable Backdoor Defense in Collaborative Learning

BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning

Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning

Backdoor Contrastive Learning via Bi-level Trigger Optimization

A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks

Learning to Stop Cut Generation for Efficient Mixed-Integer Linear Programming

LIMIP: Lifelong Learning to Solve Mixed Integer Programs

BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks on Large Language Models

RL-CSL: A Combinatorial Optimization Method Using Reinforcement Learning and Contrastive Self-Supervised Learning

BAN: Detecting Backdoors Activated by Adversarial Neuron Noise

Learning to Optimize for Mixed-Integer Non-linear Programming