Label-consistent text backdoor attack method

Abstract

The invention discloses a label-consistent text backdoor attack method, which comprises the following steps of: generating a trigger word: aiming at a target data set, generating the trigger word through a primitive library; disturbing an original input sample by using a disturbance resisting method and a keyword hiding method based on a black box condition; adding the generated trigger word into the disturbed sentence to generate a poisoning sample through a trigger word replacement method based on a sememe, and training a target model by using a poisoning data set; in the reasoning stage, adding trigger words to test sentences through a sememe replacement method, and therefore the target model is decoy to predict the target category. According to the method, two methods for interfering original input are designed, and a high-quality text with the same tag as an original tag is generated, so that a target model can learn a trigger more easily; secondly, in the trigger generation and addition part, a trigger generation and addition method based on a sememe is provided; the attack success rate is high, and high-quality attack samples are generated.

Description

Technical field [0001] The present invention belongs to the field of artificial intelligence safety technology, in particular a text back door attack method that labels. Background technique [0002] The depth neural network model is easily threatened by the latter attack. The purpose of the back door attack is to embed the hidden back door embedded depth neural network (DNNS), making the infection model good in the clean sample, while the hidden back door is defined by the attacker It is activated, its prediction is maliciously changed. Traditional back door attacks include infection models and two parts of attack. First, the infection model-infection model is part of the rear door function to the model weight, and is currently based on training data poisoning is the most direct and common method of infection target model. Second, the attack-attacker adds the trigger word to the target input and submit it to the model, and the model will predict the input to the target tag. [0...

AI Technical Summary

Problems solved by technology

Such toxic samples are easy to identify when someone examines the training set; (2) it is almost impossible to add a truly undetectable trigger word to the text, because the text is discrete, and a small perturbation can give the original The input brings significant changes, and the semantic information of the text has a strong correlation with the words that make up the text. Therefore, simple replacement, addition, and deletion operations may destroy the semantic information of the text, so that the attacked sample Unusable, these issues negatively impact the overall attack performance of existing textual backdoor attacks

Images