Dynamic trigger text backdoor attack method based on attention poisoning

Abstract

The invention discloses a dynamic trigger text backdoor attack method based on attention poisoning, and belongs to the technical field of artificial intelligence security, and the method comprises the steps: obtaining a text classification data set D1, a sub-data set D2 and a classification neural network; using the D1 to train a classification neural network to obtain a text classification model; constructing a poisoning data set D3 based on an MLM task, a filtering threshold, a comprehensive score and a trigger selection model; performing joint backdoor training on the text classification model and the trigger selection model; and generating a final toxicity sample based on the trained model. According to the method, during combined backdoor training, the weight of the backdoor model is changed, the capability of the trigger to select the model is also enhanced, so that the trigger word with a stronger toxic effect can be more accurately selected, and the output of the attention layer in the backdoor model is controlled by the output of the trigger to select the model, so that more effective poisoning is achieved. The innovative method not only enhances the effect of backdoor attack, but also increases the detection difficulty.

Description

Technical Field

[0001] The present invention relates to the technical field of artificial intelligence security, and in particular to a dynamic trigger text backdoor attack method based on attention poisoning. Background Art

[0002] With the continuous expansion of the model scale and the increase of computing resources in the field of NLP (Natural Language Processing), the training of models usually fine-tunes downstream tasks based on pre-trained models. This trend has significantly increased the threat of backdoor injection in the form of white-box attacks. At the same time, the text classification task, as an important task in the field of NLP, has become one of the main targets of text backdoor attacks. In the backdoor attack of the text classification task, the attacker injects a backdoor into the model during the training phase and constructs toxic samples containing specific triggers during the attack, so that the model outputs the label expected by the attacker when these samples are input. There are many classifications of existing text backdoor attack methods. According to whether the trigger is generated based on context semantics, it can be divided into static trigger and dynamic trigger backdoor attacks, and different text backdoor attack methods may use different levels of triggers, such as character level, word level, and sentence level. Different victim models have different vulnerabilities when facing different types of backdoor attack methods.

[0003] Although significant progress has been made in NLP technology, its security issues have become increasingly prominent. Due to the unexplainability of artificial intelligence models and the characteristics of relying on large-scale datasets for training, these systems often exhibit vulnerability and lack of robustness. This has led to the emergence of a series of new threats, including adversarial attacks, backdoor attacks, and data leakage. Among them, text backdoor attacks deserve particular attention, especially in the current situation where NLP models use larger datasets and more parameters, and the training process is more dependent on third-party resources and platforms, increasing the potential threat of such attacks. For example, pre-trained models (such as BERT, GPT series) are usually provided by large technology companies, and users may not be able to fully control the quality and source of the training data, thus increasing the risk of being implanted with backdoors. Although a large number of advances have been made in text backdoor attack methods, there are still some problems: (1) The trigger of the fixed trigger word text backdoor attack method is not concealed enough. The main strategy of the fixed trigger word text backdoor attack is to embed a trigger word generated by artificial setting rules into the sample. Such trigger words often select low-frequency words and have no direct association with the context, resulting in their easy destruction of the grammatical integrity and semantic coherence of the text, thereby reducing the concealment of the attack. Therefore, this type of attack can be detected and mitigated by simple defense measures based on heuristics.

[0004] (2) The existing dynamic trigger word text backdoor attack methods lack effectiveness. Since the dynamic trigger word text backdoor attack methods usually adopt complex trigger forms, such as semantic styles, syntactic formats, etc., it also leads to insufficient backdoor injection effects in backdoor training. Therefore, such attacks are usually less effective than the text backdoor attack methods with fixed trigger words.

[0005] BERT (Bidirectional Encoder Representations from Transformers) is fully called "Bidirectional Encoder Representations" or "Bidirectional Transformer Model". It is a pre-trained language model based on the Transformer architecture. One of the pre-training tasks of BERT is the Masked Language Model (MLM), that is, randomly masking some words in the text and then letting the model predict these masked words. Therefore, the core idea of MLM is to let the model predict the words randomly masked in the text, so as to learn the deep features of the language. When performing the MLM task, assume that the original sample is "The story has broken down.", after tokenization and mask operations, the result [CLS] The story has [MASK] down brown.[SEP] is obtained, and a prediction vector is output. The length of the prediction vector is equal to the size of the MLM task vocabulary. Each element in the prediction vector is a floating point number, and the i-th element represents the probability that the i-th vocabulary in the vocabulary is selected. There are as many prediction vectors as there are [MASK] in the sentence.

[0006] The attention matrix is a very important concept in deep learning models, especially in models in the NLP field. It dynamically calculates the mutual relationships between elements in the input sequence to determine which parts of the input should be paid more attention to. The core idea of the attention mechanism is to adjust the weights of each word or element according to the input context, so that the model can understand and generate language more efficiently and intelligently. For example, if a sentence is split into word tokens of length n, the scale of the attention matrix is n×n, where the element in the i-th row and j-th column represents the attention score of the i-th word token to the j-th word token. Therefore, in the attention matrix, all elements in the j-th column are the attention scores of the j-th word token. Summary of the Invention

[0007] The purpose of the present invention is to provide a dynamic trigger text backdoor attack method based on attention poisoning to solve the problems such as the lack of concealment of the above-mentioned fixed trigger words and the lack of effectiveness of dynamic trigger words.

[0008] In order to achieve the above-mentioned object, the technical solution adopted by the present invention is as follows: a dynamic trigger text backdoor attack method based on attention poisoning, comprising the following steps; S1, obtains the text classification dataset D1, sub-dataset D2 and classification neural network. D1 includes multiple clean samples of M categories, D2 consists of several clean samples randomly selected from D1, and the classification neural network is the BERT model; S2, uses D1 to train a classification neural network to obtain a text classification model, which is used to input clean samples and output their predicted categories; S3, constructing a poisoned dataset D3 based on D2, wherein a method of generating a poisoned sample from a clean sample includes S31 to S36; S31, select the target label, preset filtering threshold θ, and preset selection label, where the value of the selection label is 0 or 1; S32, a clean sample x in D2 j As a sample to be poisoned, split it into words, where the kth word is labeled w k , 1≤k≤ ; S33, w k As the word to be replaced, based on the MLM task, we get w k The prediction vector of each element of the prediction vector is the probability of the corresponding position word in the MLM task vocabulary being selected, and the vocabulary corresponding to the element whose prediction vector is greater than θ is taken as w k Candidate trigger words, replace x with each candidate trigger word in turn j Middle w k Generate a candidate sentence and form all candidate sentences into w k The replacement set G k ; S34, calculate G k The comprehensive score of each candidate sentence in , the selection label of the candidate sentence with the highest comprehensive score is set to 1, and the selection labels of the remaining candidate sentences are set to 0; S35, process each word in sequence according to S33~S34, and obtain The candidate sentences with the selection label of 1 constitute the candidate set; S36, obtain a pre-trained DistilBert model as a trigger selection model, which is used to input the candidate sentences of the candidate set, output the predicted probability of their selection labels, and take the candidate sentence with the highest predicted probability as x j Toxic samples , The candidate trigger words are used as the optimal trigger words, The predicted probability of the selected label is ; S4. Jointly perform backdoor training on the text classification model and the trigger selection model to obtain a backdoor model and a mature trigger selection model, including S41 to S43; S41. Use the clean samples in D1 outside D2 and the poisoned samples in D3 together as backdoor samples to form a backdoor dataset D4; S42. Use D4 to perform backdoor training on the text classification model. During training, for a poisoned sample in D4 , generate multiple attention matrices during the encoding stage of the text classification model, select an attention matrix A, and use to enhance the column corresponding to the optimal trigger word in A; S43. Calculate the total loss L total of the joint backdoor training, and based on L total adjust the parameters of the text classification model and the trigger selection model; , , , where L victim is the backdoor training loss function, L select is the control function of the trigger selection model, λ is the weight hyperparameter of L select , D c is the dataset composed of clean samples in D1 outside D2, N c is the number of clean samples in D c , x i is the clean sample in D c , y i , f(x i ) are the true class label and predicted class label of x i respectively, is the operation of calculating cross entropy, N D3 is the number of poisoned samples in D3, is the predicted class label of the poisoned sample , y t is the target label of the poisoned sample; is the selection label of ; S5. Obtain the clean samples to be poisoned, get a poisoned sample according to steps S32 to S36, use the poisoned sample as the sample to be poisoned, repeat steps S32 to S36 until the number of iterations is reached, and use the last poisoned sample as the final poisoned sample for backdoor attack.

[0009] Preferably: When training the classification neural network in S2, the loss function is loss(x, y); , Wherein, x is a sample in D1, σ(x) is the predicted class label of the sample x by the classification neural network, and y is the true class label of x.

[0010] Preferably: In S35, for the candidate sentence containing the candidate trigger word w, its comprehensive score S(w) is obtained according to the following formula; , , Wherein, z(w) is the z-score of the candidate sentence containing the candidate trigger word w, n is the total number of samples in D1, n target is the number of samples with the target label in D1, f[w] is the number of samples containing w in D1, f target [w] is the number of samples containing w and having the target label in D1, P(w|x j ) is the probability that w is selected in the MLM task, α is the weight of z(w), and e is a very small value to prevent the denominator from being 0.

[0011] Preferably: The enhancement described in S42 is specifically; The text classification model includes multiple encoding layers. After the toxic samples are input, an attention matrix is obtained through each encoding layer. One of the attention matrices A is selected and enhanced according to the following formula; , Wherein, β is a constant bias term, is the column vector corresponding to the optimal trigger word in A, is the enhanced column vector.

[0012] Regarding the comprehensive score, based on the z-score of the candidate sentence containing the candidate trigger word w, and the value of the candidate trigger word w in the prediction vector when performing the MLM task, that is, the probability P(w|x that w is selected in the MLM task j ). The z-score evaluates the degree of association between the current candidate trigger word and the target label. The higher the z-score, the more likely the word is to be in the samples with the target label. In order to make the toxic trigger words as neutral as possible, when the z-score is closer to 0, the label bias of the current candidate trigger word is more likely to be neutral. Therefore, candidate trigger words with a medium degree of association with the target label are selected through the z-score, and the probability that the word is selected in the prediction vector is used to ensure that the word is more contextually semantic in the text.

[0013] Compared with the prior art, the advantages of the present invention are: (1) The trigger has concealment: The present invention generates toxic samples based on S3. (In S3, for each token of the clean sample, candidate trigger words are generated through the MLM task, and then through methods such as filtering threshold screening and z - score calculation, a candidate sentence for this token is found as the optimal candidate sentence, the label is set to 1, and the optimal candidate sentences of all tokens form a candidate set. The trigger selection model selects one of them as the toxic sample for one iteration. The toxic sample trigger generated in this way is semantically related to the original sentence and is a neutral word, which not only improves concealment but also ensures the effectiveness of triggering (the reason for ensuring effectiveness is that if it is a word that does not bias towards the target label, it will be difficult to train the backdoor effect, and if it is a word that biases towards the target label, it will lead to false triggering, that is, the trigger is because the sentence itself already biases towards the target label). When generating the final toxic sample in S5, multiple iterations are performed according to the steps of S3, and the optimal toxic sample obtained may contain multiple different combinations of optimal trigger words, which not only meets the requirement of high trigger concealment, but each optimal trigger word conforms to the semantic meaning of the current context and does not make the toxic sample differ too much from the original sample.

[0014] (2) The quality of the toxic sample is higher: The poisoned samples generated by the present invention perform well in multiple metrics through experiments, including metrics such as naturalness, perplexity PPL, similarity to the original sentence USE, and grammar error GE.

[0015] (3) The attack effectiveness is better: The present invention conducts joint backdoor training on the text classification model and the trigger selection model to obtain a backdoor model and a mature trigger selection model. During the joint training process, based on the predicted output of the trigger selection model for the toxic sample, the column vectors in the attention matrix of the toxic sample related to the optimal trigger word are modified and enhanced, thereby modifying the attention degree of the attention matrix to the optimal trigger word, achieving the purpose of enhancing the backdoor injection effect. Finally, the present invention enhances the backdoor injection effect, resulting in better performance in terms of the attack success rate. Description of the Drawings

[0016] Figure 1 It is a schematic diagram of generating toxic samples based on clean samples in S3; Figure 2 It is a schematic diagram of joint backdoor training; Figure 3 It is a schematic diagram of enhancing the attention matrix. Detailed Embodiments

[0017] The present invention will be further described below in conjunction with embodiments and drawings.

[0018] Embodiment 1: Refer to Figures 1 to 3,A dynamic trigger text backdoor attack method based on attention poisoning, includes the following steps; S1, obtains the text classification dataset D1, sub-dataset D2 and classification neural network. D1 includes multiple clean samples of M categories, D2 consists of several clean samples randomly selected from D1, and the classification neural network is the BERT model; S2, uses D1 to train a classification neural network to obtain a text classification model, which is used to input clean samples and output their predicted categories; S3, constructing a poisoned dataset D3 based on D2, wherein a method of generating a poisoned sample from a clean sample includes S31 to S36; S31, select the target label, preset filtering threshold θ, and preset selection label, where the value of the selection label is 0 or 1; S32, a clean sample x in D2 j As a sample to be poisoned, split it into words, where the kth word is labeled w k , 1≤k≤ ; S33, w k As the word to be replaced, based on the MLM task, we get w k The prediction vector of each element of the prediction vector is the probability of the corresponding position word in the MLM task vocabulary being selected, and the vocabulary corresponding to the element whose prediction vector is greater than θ is taken as w k Candidate trigger words, replace x with each candidate trigger word in turn j Middle w k Generate a candidate sentence and form all candidate sentences into w k The replacement set G k ; S34, calculate G k The comprehensive score of each candidate sentence in , the selection label of the candidate sentence with the highest comprehensive score is set to 1, and the selection labels of the remaining candidate sentences are set to 0; S35, process each word in sequence according to S33~S34, and obtain The candidate sentences with the selection label of 1 constitute the candidate set; S36, obtain a pre-trained DistilBert model as a trigger selection model, which is used to input the candidate sentences of the candidate set, output the predicted probability of their selection labels, and take the candidate sentence with the highest predicted probability as x j Toxic samples , The candidate trigger words are used as the optimal trigger words, The predicted probability of the selected label is ; S4. Jointly perform backdoor training on the text classification model and the trigger selection model to obtain a backdoor model and a mature trigger selection model, including S41 to S43; S41. Use the clean samples in D1 outside D2 and the poisoned samples in D3 together as backdoor samples to form a backdoor dataset D4; S42. Perform backdoor training on the text classification model using D4. During training, for a poisoned sample in D4 , generate multiple attention matrices during the encoding stage of the text classification model, select an attention matrix A, and use to enhance the column corresponding to the optimal trigger word in A; S43. Calculate the total loss L total of the joint backdoor training, and based on L total adjust the parameters of the text classification model and the trigger selection model; , , , where L victim is the backdoor training loss function, L select is the control function of the trigger selection model, λ is the weight hyperparameter of L select , D c is the dataset composed of clean samples in D1 outside D2, N c is the number of clean samples in D c , x i is the clean sample in D c , y i , f(x i ) are the true class label and predicted class label of x i respectively, is the operation of calculating the cross entropy, N D3 is the number of poisoned samples in D3, is the predicted class label of the poisoned sample , y t is the target label of the poisoned sample; is 's selection label; S5. Obtain the clean samples to be poisoned, get a poisoned sample according to steps S32 to S36, use the poisoned sample as the sample to be poisoned, repeat steps S32 to S36 until the number of iterations is reached, and use the last poisoned sample as the final poisoned sample for backdoor attack.

[0019] In this embodiment, when training the classification neural network in S2, the loss function is loss(x, y); , Wherein, x is a sample in D1, σ(x) is the predicted class label of the sample x by the classification neural network, and y is the true class label of x.

[0020] In S35, for the candidate sentence containing the candidate trigger word w, its comprehensive score S(w) is obtained according to the following formula; , , Wherein, z(w) is the z-score of the candidate sentence containing the candidate trigger word w, n is the total number of samples in D1, n target is the number of samples with the target label in D1, f[w] is the number of samples in D1 containing w, f target [w] is the number of samples in D1 containing w and having the target label, P(w|x j ) is the probability that w is selected in the MLM task, α is the weight of z(w), and e is a minimum value to prevent the denominator from being 0.

[0021] The enhancement described in S42 is specifically; The text classification model includes multiple encoding layers. After the toxic samples are input, an attention matrix is obtained through each encoding layer. One of the attention matrices A is selected and enhanced according to the following formula; , Wherein, β is a constant bias term, is the column vector corresponding to the optimal trigger word in A, is the enhanced column vector.

[0022] Regarding steps S32 to S35 of S3, taking a clean sample in D2 as x j as an example, the processing process is described in detail as follows: x j is “The story has collapsed down”, which is split into 5 tokens; First, process the first token “The”. Use the MLM task of the BERT model to obtain a prediction vector. Based on the filtering threshold, 3 candidate trigger words are obtained, assumed to be word 1, word 2, and word 3. Replace “The” in x j with word 1 to word 3 respectively to obtain 3 candidate sentences, forming the replacement set G1 of “The”; calculate the comprehensive scores of the 3 candidate sentences in G1, label the selection label of the candidate sentence with the highest comprehensive score as 1, and the selection labels of the other two candidate sentences as 0; Then process the second token “story”. Use the BERT-MLM task to obtain a prediction vector. Based on the filtering threshold, 4 candidate trigger words are obtained and replace x jFor the "story" in it, 4 candidate sentences are obtained, forming the replacement set G2 of "story"; calculate the comprehensive scores of the 4 candidate sentences in G2, mark the selection label of the candidate sentence with the highest comprehensive score as 1, and mark the selection labels of the remaining candidate sentences as 0; And so on, process the 3rd to 5th tokens, find the candidate sentence with the highest score in G3 to G5, mark its selection label as 1. After the processing is completed, 5 replacement sentences with the selection label of 1 are obtained. Send the 5 replacement sentences with the selection label of 1 into the trigger selection model, output the predicted probability of the selection label of each replacement sentence, and use the candidate sentence with the highest predicted probability as x j toxic samples , in this embodiment, if the candidate trigger word of is "broken", then "broken" is the optimal trigger word of, the predicted probability of the selection label of is .

[0023] Regarding the backdoor training of S42, the text classification model is based on the BERT architecture. The model of the BERT architecture usually has 12 encoding layers Encoder, and each encoding layer has a self-attention mechanism, so there will also be 12 attention matrices. The present invention can select one layer as needed, or conduct multi-layer comparative experiments. For example, in this embodiment, the modification effect of selecting the attention matrix of the 9th layer is the best. The attention score matrix usually has the shape of the number of tokens × the number of tokens, and the element in the i-th row and j-th column represents the attention score of the i-th token to the j-th token. Therefore, in order to improve the attention degree of other tokens to the optimal trigger word, assuming that the token of the optimal trigger word is the k-th one, then it is necessary to enhance the data in the k-th column of the attention matrix. When enhancing, β is a constant bias term, and its value is 1 in this embodiment.

[0024] Embodiment 3: To better illustrate the effect of the present invention, a comparative experiment is conducted. The BERT (base) model is used as the victim model in the experimental evaluation. We selected three publicly available datasets for the experiment, namely SST-2, Tweet_emotion, and AG_News. The SST-2 binary sentiment analysis dataset has a total of 9613 data, with an average length of 19.24; the Twitter-emotion four-class sentiment analysis dataset has a total of 5049 data, with an average length of 15; the AG_News four-class topic classification dataset has a total of 127599 data, with an average length of 37.96.

[0025] Three contrast text backdoor attack methods are selected, all of which are dynamic trigger attack methods, namely StyleBkd, SynBkd, and LWS methods. Among them, StyleBkd uses the style transfer model STRAP for data poisoning and defines the trigger pattern as the Bible text style. This method uses semantic style as the trigger, making the trigger more integrated with the context and increasing the concealment. SynBkd uses a syntactic-controlled paraphrase model for data poisoning and defines the trigger pattern as low-frequency syntactic templates, such as (adverbial clause of time)(,)(subject noun phrase)(predicate verb phrase)(.). This method uses sentence structure as the trigger and achieves the concealment of the trigger by modifying the grammar structure of the sentence rather than simply adding keywords. The trigger of LWS is not a relatively fixed trigger word, but a combination of word substitutions dynamically generated through a learning process. This method allows the trigger to be flexibly adjusted according to the specific context, thus enhancing the concealment and adaptability of the trigger.

[0026] The evaluation metrics are divided into basic function evaluation, as well as concealment and quality evaluation metrics. Among them, the basic function evaluation includes the Attack Success Rate (ASR) to evaluate the success rate of activating the attacker-specified target label on poisoned samples; the Clean Accuracy (CACC) is used to evaluate the classification performance of the victim model on un-attacked clean samples.

[0027] The concealment and quality evaluation include the Naturalness which evaluates the naturalness of poisoned samples. The Perplexity (PPL) is another important metric to measure text fluency, which is calculated through pre-trained language models such as GPT-2. The Universal Sentence Encoder Similarity (USE) measures the semantic similarity between poisoned instances and clean instances, rather than simple lexical matching. The Grammar Errors (GE) counts the number of grammar problems in the generated text.

[0028] Judging from the specific experimental data provided in Table 1, in terms of the basic evaluation metrics, the variation range of CACC (Clean Accuracy Classification) of all tested methods is controlled within 2%. This indicates that although the backdoor attack is introduced, the basic functions of the victim model for clean samples are still well maintained. In terms of the key metric of the Attack Success Rate (ASR), the present invention shows obvious advantages, highlighting the effectiveness of its attack.

[0029] Table 1 Comparison of Attack Effects of Different Text Backdoor Attack Methods , The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims

1. A dynamic trigger text backdoor attack method based on attention poisoning, characterized in that: It includes the following steps; S1. Obtain a text classification dataset D1, a sub-dataset D2, and a classification neural network. D1 includes multiple clean samples of M categories. D2 consists of several clean samples randomly selected from D1. The classification neural network is a BERT model; S2. Train the classification neural network with D1 to obtain a text classification model, which is used to input clean samples and output their predicted categories; S3. Construct a poisoned dataset D3 based on D2. The method for generating a poisoned sample from a clean sample includes S31 - S36; S31. Select a target label, a preset filtering threshold θ, and a preset selection label. The value of the selection label is 0 or 1; S32. Take a clean sample x in D2 j as the sample to be poisoned and split it into tokens, where the k-th token is marked as w k , 1 ≤ k ≤ ; S33, take w k as the word to be replaced, and obtain the prediction vector of w k based on the MLM task. Each element of the prediction vector is the probability that the word at the corresponding position in the MLM task vocabulary is selected. Take the words corresponding to the elements of the prediction vector greater than θ as the candidate trigger words of w k , and replace x j with each candidate trigger word in turn k to generate a candidate sentence, and form the replacement set G of w k with all candidate sentences k ; S34, Calculate G k Calculate the comprehensive score of each candidate sentence in k , set the selection label of the candidate sentence with the highest comprehensive score to 1, and set the selection labels of the remaining candidate sentences to 0; S35, process each token in sequence from S33 to S34 to obtain a candidate sentence with a selection label of 1, which forms a candidate set; S36. Obtain a pre-trained DistilBert model as a trigger selection model, which is used to input candidate sentences in the candidate set and output the predicted probability of their selection labels. The candidate sentence with the highest predicted probability is used as x j toxic samples , The candidate trigger word of is used as the optimal trigger word, The predicted probability of the selection label of is ; S4. Conduct joint backdoor training on the text classification model and the trigger selection model to obtain a backdoor model and a mature trigger selection model, including S41 - S43; S41. Use the clean samples in D1 except D2 and the poisoned samples in D3 as backdoor samples to form a backdoor dataset D4; S42. Use D4 to perform backdoor training on the text classification model. During training, for a toxic sample in D4 , generate multiple attention matrices during the encoding stage of the text classification model. Select an attention matrix A and use to enhance the column corresponding to the optimal trigger word in A; S43, calculate the total loss L of the combined backdoor training total , and based on L total adjust the parameters of the text classification model and the trigger selection model; ， ， ， Where, L victim is the backdoor training loss function, L select is the control function of the trigger selection model, λ is the weight hyperparameter of L select , D c is the dataset composed of clean samples in D1 except D2, N c is the number of clean samples in D c , x i is the clean sample in D c , y i , f(x i ) are the true class label and predicted class label of x i respectively, is the operation of calculating cross entropy, N D3 is the number of poisoned samples in D3, is the predicted class label of the poisoned sample , y t is the target label of the poisoned sample; is the selection label of ; S5. Obtain clean samples to be poisoned, get a poisoned sample according to steps S32 - S36, use the poisoned sample as the sample to be poisoned, repeat steps S32 - S36 until the number of iterations is reached, and use the poisoned sample of the last time as the final poisoned sample for backdoor attack.

2. The method for dynamically triggering text backdoor attack based on attention poisoning according to claim 1, wherein: When training the classification neural network in S2, the loss function is loss(x, y); ， In the formula, x is the sample in D1, σ(x) is the predicted category label of the sample x by the classification neural network, and y is the true category label of x.

3. The method for dynamically triggering text backdoor attack based on attention poisoning according to claim 1, wherein: In S35, for the candidate sentence containing the candidate trigger word w, its comprehensive score S(w) is obtained according to the following formula; ， ， Where \(z(w)\) is the z-score of the candidate sentence containing the candidate trigger word \(w\), \(n\) is the total number of samples in \(D1\), \(n\) target is the number of samples with the target label in \(D1\), \(f[w]\) is the number of samples in \(D1\) containing \(w\), \(f\) target [w] is the number of samples in \(D1\) that contain \(w\) and have the target label, \(P(w|x\) j ) is the probability that \(w\) is selected in the MLM task, \(\alpha\) is the weight of \(z(w)\), and \(e\) is a very small value to prevent the denominator from being zero.

4. The method for dynamically triggering text backdoor attack based on attention poisoning according to claim 1, wherein: The enhancement in S42 specifically is; The text classification model includes multiple encoding layers. After the toxic samples are input, an attention matrix is obtained through each encoding layer. One of the attention matrices, denoted as A, is selected and enhanced according to the following formula; ， where β is a constant bias term, is the column vector corresponding to the optimal trigger word in A, is the enhanced column vector.

Images