A system and method for trigger word recognition and positioning based on BIO sequence labeling

Abstract

The application discloses a trigger word recognition and positioning system and method based on BIO sequence labeling, comprising: using an encoder to extract a whole sentence semantic vector, judging whether the input text contains a backdoor attack feature; if the backdoor suspicion is detected, positioning the backdoor trigger word, judging whether each word belongs to the backdoor trigger word through the BIO sequence labeling of each token, and outputting a preliminary trigger word position marking sequence; applying trigger position prior knowledge and multi-strategy rules to correct and optimize the results and filter false positives; when the results have uncertainty or are suspected to have attack avoidance, using a predefined known trigger phrase mode library to scan the input text, capturing hidden or variant trigger word modes, and positioning the missed suspicious trigger words; and outputting the final result of backdoor detection. Through the dual-module cooperation on the architecture and the priori and rule fusion on the strategy, the application can robustly detect the text backdoor trigger and accurately position the trigger content.

Description

Technical Field

[0001] This invention relates to the field of natural language processing technology, and in particular to a trigger word recognition and localization system and method based on BIO sequence annotation. Background Technology

[0002] In the field of natural language processing security, backdoor attacks targeting text models have become a pressing problem. Attackers inject specific trigger texts (such as adding fixed phrases to the end of sentences) into the training data, causing the model to produce malicious outputs pre-set by the attacker when encountering the trigger word. Because these trigger words often appear normal and are cleverly embedded, the model performs well with clean input, making the backdoor behavior highly concealed. Therefore, how to robustly detect hidden trigger texts in the input and prevent such poisoning attacks has become a technical challenge for existing technologies.

[0003] Current methods for detecting text backdoors have several limitations, including:

[0004] 1) Difficulty in identifying complex variant trigger content: Attackers often modify predefined trigger words to change the trigger style, such as mixing similar-looking characters or numbers in words, adding uppercase or lowercase letters, or changing punctuation. Existing detection algorithms often rely on fixed features or statistical anomalies of trigger words. Once the trigger word is modified, the detection accuracy drops significantly, easily leading to missed detections.

[0005] 2) Insufficient utilization of prior trigger position information: In text injection attacks such as GBTL, trigger text is often uniformly embedded at the end of the sentence, forming a specific pattern of occurrence. Existing detection technologies generally do not optimize for the distribution of trigger word positions, which may lead to insufficient sensitivity to sentence-end triggers and reduce the effectiveness of detection.

[0006] 3) Lack of precise trigger segment location capability: Most existing text backdoor detection methods can only output whether the entire input is suspicious, but cannot point out specific trigger words or their positions in the text. This makes it difficult for security personnel to extract and remove malicious trigger segments in a timely manner, limiting the targeting and effectiveness of subsequent defense measures.

[0007] 4) Balancing robustness and false alarm rate: Current detection methods struggle to balance detection sensitivity and accuracy. Some methods employ lenient thresholds or sensitive features to capture hidden backdoors, often resulting in high false alarm rates. Conversely, increasing the threshold to reduce false alarms risks missing subtle and ingenious triggering attacks. The lack of a dynamic adjustment mechanism for decision strength makes it difficult to simultaneously guarantee robust detection performance with high detection rates and low false alarm rates across different scenarios.

[0008] 5) Insufficient performance in real-world deployment: Some existing backdoor detection solutions are complex and costly to implement, making them difficult to deploy in real-time on real systems. Furthermore, many methods lack modular design, preventing them from detecting backdoors independently of existing models. These factors contribute to the current technology's insufficient deployability, making it difficult to meet the real-world application requirements for timely and efficient backdoor detection.

[0009] Therefore, current text backdoor trigger detection methods have objective technical shortcomings in terms of trigger word location accuracy, detection comprehensiveness, anti-circumvention capabilities, and deployment overhead, making it difficult to provide reliable and efficient protection in actual combat. Summary of the Invention

[0010] The problem to be solved by this invention is to provide a trigger word recognition and localization system and method based on BIO sequence labeling. Through the collaboration of two modules in the architecture and the fusion of prior and rule strategies, the detection and localization capabilities of hidden backdoor triggers are significantly improved. Under the premise of ensuring low false alarms, it solves many weaknesses of existing technologies at the engineering and algorithm levels to the greatest extent. It can robustly detect text backdoor triggers and accurately locate the trigger content, while having a low false alarm rate and being easy to integrate and deploy.

[0011] This invention adopts the following technical solution: a trigger word recognition and localization system based on BIO sequence annotation, comprising:

[0012] Input module: Receives the raw text to be detected (such as a sentence or a piece of text submitted by the user), preprocesses it, and outputs it in the form of a token sequence;

[0013] Backdoor sentence recognition module: Extracts semantic vector of whole sentence using encoder and classifies whether input text contains backdoor attack features; if backdoor suspicion is detected, backdoor trigger word is located; if no backdoor suspicion is detected, it is judged as normal text.

[0014] Backdoor trigger word localization module: performs token-by-token BIO sequence labeling on text suspected of being a backdoor, determines whether each word belongs to a backdoor trigger word, predicts the BIO tag sequence of unknown text, determines the possible trigger word position, and outputs a preliminary trigger word position marking sequence;

[0015] Post-processing module: Applys prior knowledge of trigger position and multi-strategy rules to the output of the backdoor trigger word localization module to correct and optimize the results and filter false alarms;

[0016] Regular expression fallback detection module: When the model detection results are uncertain or there is suspicion of attack evasion, the preset regular expression mode is activated. The input is matched and detected using a predefined library of known trigger phrase patterns. The input text is scanned to capture hidden or variant trigger word patterns and locate any missed suspicious trigger words.

[0017] Output module: Outputs the final result of backdoor detection, including: whether a backdoor is triggered and the specific location or content identifier of the trigger word.

[0018] As a preferred embodiment, the input module receives the original text to be detected and performs preprocessing, as follows:

[0019] S1.1. Perform text cleaning on the input original text sequence X and segment it using a tokenizer to obtain the token sequence W= ;in, The length of the token sequence;

[0020] S1.2 Map each token to an embedding vector representation of the model, and record the mapping relationship between the token and the position of the original text character. The word embedding matrix of the pre-trained model is represented as follows: Each Token Corresponding d-dimensional embedding vector ;

[0021] S1.3, assemble the embedding vectors of all tokens into a sequence. This serves as the input for the subsequent model encoder.

[0022] As a preferred embodiment, the backdoor sentence recognition module receives the token sequence W and its embedded representation E output by the input module, and determines whether the input text contains a backdoor triggering pattern, as follows:

[0023] S2.1 Encoder Representation Calculation: Input the token sequence W into the encoder based on the pre-trained language model T5 to obtain the context representation of each token and output the hidden state sequence. :

[0024] ;

[0025] in, Represents Token The D-dimensional context vector representation in the last layer of the encoder; This indicates that the T5 encoder captures global information of the sequence through a multi-layer self-attention mechanism, enabling... It contains the semantics of the entire input sequence;

[0026] S2.2 Pooling and Classification: Converting variable-length hidden state sequences... The sequence is transformed into a fixed-dimensional representation, and the global feature vector is obtained using an average pooling strategy. The hidden states of all tokens are averaged through pooling calculation:

[0027] Using a fully connected classifier Backdoor text detection: Classifier parameters are represented as a weight matrix. and bias The logarithmic scores for the normal and backdoor categories were calculated. :

[0028] Logarithmic score The probability distribution of backdoor categories is obtained by using Softmax activation. ;in, This represents the probability of identifying a device as containing a backdoor. This indicates the probability of being judged as normal.

[0029] S2.3, Discriminant Decision Output: Set the discriminant confidence threshold. The discriminative output of the backdoor sentence recognition module is represented as When the probability of a backdoor Exceeding the threshold hour, This indicates that a backdoor has been detected; otherwise, it is considered normal text. This indicates that there is no backdoor.

[0030] As a preferred embodiment, the backdoor trigger word localization module identifies and locates specific backdoor trigger words in the suspicious text, treating trigger word detection as a sequence labeling task, and using BIO annotation to assign labels to each token in the text: Indicates the beginning of a trigger word, Indicates the interior of the trigger word, To indicate non-trigger words, the sequence label results are represented as follows: ,in, This represents the BIO tag corresponding to the i-th token. The allocation depends on the first Does a token belong to a certain trigger phrase?

[0031] As a preferred embodiment, the backdoor trigger word localization module predicts the BIO tag sequence of unknown text. To determine the possible location of trigger words, the method is as follows:

[0032] S3.1, Positional Preference Truncation: A positional bias strategy is introduced to optimize the sequence labeling process. When the length N of the input token sequence is greater than the preset maximum analysis window length k, the last k tokens are taken to form a subsequence. This serves as the actual input to the backdoor trigger word localization module; if N≤k, then .

[0033] S3.2, Encoding and Sequence Labeling Prediction: Predicting the truncated token sequence... Inputting a T5 encoder yields the hidden state sequence. ;in, This represents the hidden state at position i.

[0034] Use a sequence labeling classifier to analyze the hidden state at each position. To perform BIO category discrimination, the classifier parameters include the weight matrix. and bias ,Will Mapped to score ,in, These represent the scores for the three categories: B, I, and O, respectively.

[0035] Score After Softmax normalization, the Token is obtained. Probability of belonging to each label ;in, This represents the original text sequence of the input, where c represents the category. .

[0036] Based on the principle of maximum probability, a predicted label is selected for each position to predict the BIO label sequence of the unknown text. .

[0037] S3.3 Confidence Threshold Filtering: Introducing a confidence threshold to the sequence labeling results. Post-processing is performed if the model predicts a certain token as a trigger word category: = B or I, but the prediction confidence level P( = |X) is lower than If the judgment is unreliable, the tag is reset to the non-trigger word O, resulting in the final BIO tag sequence. .

[0038] S3.4, Trigger Phrase Extraction: Based on Extract the predicted trigger word phrase positions according to the following rule: scan the sequence labels, and when the label appears... At that time, this position is used as the beginning of a trigger phrase, and consecutive trigger phrases are collected thereafter. The label is used as part of the trigger phrase, and the complete trigger phrase boundary is determined until label O or the end of the sequence is encountered, resulting in a set. It contains the position range of all identified trigger word fragments in the sequence.

[0039] As a preferred embodiment, the post-processing module performs cross-validation on candidate trigger words using multi-strategy rules, the method including:

[0040] S4.1, Classification Influence Verification: For each candidate trigger word segment output by the backdoor trigger word localization module, the corresponding Token interval... Assess the impact on backdoor detection results:

[0041] Remove candidate trigger word fragments from the original token sequence W to obtain the removed sequence. :

[0042] The backdoor sentence recognition module is used to calculate the original complete input W and the input after removing candidate trigger words. The probability of a backdoor is denoted as . and The degree of influence of the corresponding candidate fragment on the backdoor discrimination result is expressed by the decrease in the backdoor probability. Quantification:

[0043] Set threshold To determine whether the influence is significant, This indicates that removing the segment did not affect the backdoor detection; the candidate may be normal content, and it was a false alarm.

[0044] S4.2 Result Merging and Filtering: If the backdoor trigger word localization module identifies multiple disjoint trigger word candidates, they are sorted and filtered based on confidence or influence scores; including: by Sort all candidate segments in descending order and select... The highest-valued fragment exceeding the threshold is taken as the final output; if the candidate phrase content is a frequently used everyday word and its removal has no impact on the judgment, rule-based filtering is performed; the final set of confirmed trigger words is output. .

[0045] As a preferred embodiment, the regular expression fallback detection module maintains a known suspected trigger phrase in the known trigger phrase pattern library. The set of: ;

[0046] Trigger phrase Triggering words from publicly available backdoor attack examples, prior knowledge, or training data reveal common triggering patterns, including: abnormally spelled words, specific symbol sequences, and rare phrases; targeting sets... Each trigger phrase in The corresponding regular expression pattern R(t) is predefined to match the corresponding phrases and variant forms that appear in the text.

[0047] Among them, the specific symbol sequence refers to the abnormal character sequence that the attacker injects in advance to trigger the model's erroneous output in the context of text backdoor attack defense. Examples include meaningless words (tg) and consecutive punctuation marks (!!!).

[0048] Rare phrases are usually composed of several unrelated normal words. Although the words themselves are common, the word order of the combination is not common in everyday conversation. For example: fairest sinless.

[0049] As a preferred embodiment, the regular expression fallback detection module uses a predefined library of known trigger phrase patterns to perform pattern matching detection on the input text, as follows:

[0050] The matching mechanism M uses a pattern set R and a trigger word library. Using the parameter X, search for fragments in the input text X that match the known triggering pattern to obtain a set of matching results. ;

[0051] The set of trigger words obtained by the multi-strategy post-processing module With regularity detection set Take the union of the sets to obtain the final set of trigger word location results. ;

[0052] if If not empty, it indicates that the input text contains backdoor attack trigger words; output a warning and mark the location range of the trigger words in the original text; if If it is still empty, it is assumed that the input text X does not contain backdoor trigger keywords.

[0053] The present invention also provides: a trigger word identification and localization method based on BIO sequence annotation, applied to the aforementioned system, comprising the following steps:

[0054] Step 1, Data Input: Receive the raw text to be detected, preprocess it, and output it in the form of a token sequence;

[0055] Step 2, Backdoor Sentence Recognition (Stage 1): Based on the pre-trained language model, the encoder extracts the semantic vector of the whole sentence, and the classifier determines whether the input text contains backdoor attack features; if backdoor suspicion is detected, proceed to Step 3, otherwise it is judged as normal text;

[0056] Step 3, Backdoor Trigger Word Location (Stage 2): Perform token-by-token BIO sequence labeling on the text suspected of being a backdoor, determine whether each word belongs to the backdoor trigger word, and output the preliminary trigger word position mark sequence;

[0057] Step 4, Post-processing correction: Apply prior knowledge of the trigger position and multi-strategy rules to the output results of backdoor trigger word localization to correct and optimize the results, including: combining prior information of common trigger word positions and adjusting or merging tags according to context patterns to filter false alarms;

[0058] Step 5, Regular Expression Backtracking Detection: Provides a backup mechanism for rule matching. When the model detection results are uncertain or there is suspicion of attack evasion, the preset regular expression mode is activated to scan the input text, capture hidden or variant trigger word patterns, and locate any missed suspicious trigger words.

[0059] Step 6, Output Results: Based on the combined results of trigger word detection and location, output the final conclusion of backdoor detection, including whether a backdoor trigger exists and the specific location or content identifier of the trigger word.

[0060] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0061] 1. Two-stage structure of classifier + sequence labeling: This invention adopts a two-stage architecture. The first stage performs text-level backdoor attack classification and discrimination, and the second stage uses BIO sequence labeling to finely locate trigger words. The two stages complement each other: the classifier provides global semantic judgment to improve the detection rate of suspicious samples, while sequence labeling marks each character of the text to achieve precise identification and location of trigger words. Compared with single methods that only focus on the whole or only focus on the part, this two-stage design ensures both detection coverage and fine-grained removal, solving the problem that traditional methods cannot simultaneously address both overall recognition and local localization.

[0062] 2. Introducing prior knowledge of the end-of-sentence position to improve trigger location accuracy: This invention incorporates prior knowledge of the sentence-end trigger position during the sequence labeling stage. It utilizes the common textual pattern of backdoor triggers being attached to the end of sentences to guide the model in allocating higher attention weights or probability biases to end-of-sentence words. This effectively strengthens the judgment of trigger word positions. When the input contains hidden sentence-end triggers (e.g., end phrases without obvious punctuation), the model becomes more sensitive due to the built-in position prior, significantly improving the accuracy of end-of-sentence trigger recognition. Architecturally, this overcomes the shortcomings of existing methods that treat all trigger positions equally, leading to missed detections of end-of-sentence triggers. This ensures that even if the trigger word is attached to the end of the sentence without a clear boundary, the system can effectively locate it.

[0063] 3. Regular expression matching fallback mechanism to enhance false negative tolerance: For the very few trigger variants that might escape machine learning model detection, this invention designs a regular expression matching fallback detection mechanism. For suspicious input segments that are not marked after the aforementioned classification and sequence labeling, a predefined regular expression rule library is applied to detect common abnormal patterns. Once a rule matches a suspected trigger feature, it is treated as a trigger word and marked and removed, improving the overall robustness of detection and significantly reducing the false negative rate. Unlike purely manual blacklists, this regular expression fallback is only activated when the model fails and does not affect the judgment process under normal circumstances. Therefore, it minimizes false positive interference while ensuring a high detection rate.

[0064] 4. Enhanced adaptability to hidden variants and triggers without punctuation: This invention does not rely on a fixed list of sensitive words or strict sentence boundary assumptions. Instead, it combines semantic features and positional priors for comprehensive judgment, making it more adaptable to various hidden trigger variants. For example, in cases where synonym substitution or near-synonyms are used as triggers, the first-stage deep classifier can still identify suspicious parts of the input based on semantic anomaly detection, while the second-stage sequence labeling can further pinpoint these uncommon positions or unconventional forms of trigger words. Furthermore, even if the input does not use punctuation at the end, the model can still identify the suspicious sequence appended thereafter through tail priors, overcoming the shortcomings of existing methods such as ASF, which are prone to failure when dealing with triggers without punctuation. Attached Figure Description

[0065] Figure 1 This is a block diagram of the trigger word recognition and localization system based on BIO sequence annotation of the present invention;

[0066] Figure 2 This is a flowchart of the input text preprocessing and token mapping process for this invention;

[0067] Figure 3 This is a schematic diagram illustrating the extraction of BIO sequences into trigger phrases according to the present invention;

[0068] Figure 4 This is a flowchart of the BIO annotation process of the present invention. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the application will be further described in detail below with reference to the accompanying drawings. The described embodiments are only a part of the embodiments involved in this invention. All non-innovative embodiments based on these embodiments by other researchers in the art are within the protection scope of this invention. Furthermore, the step numbers in the embodiments of this invention are only set for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0070] Example 1

[0071] A two-stage text backdoor trigger detection system is proposed, with the architecture as follows: Figure 1 As shown, it includes the following main modules:

[0072] Input module: Receives text input to be tested (such as a sentence or a piece of text submitted by the user).

[0073] Backdoor Sentence Recognition Module: An encoder based on the pre-trained language model T5 extracts the semantic vector of the entire sentence, and a classifier determines whether the input sentence contains backdoor attack features. If a backdoor suspicion is detected, the process proceeds to the next stage; otherwise, it is judged as a normal sentence.

[0074] Backdoor trigger word localization module: Based on the pre-trained language model T5, the sequence labeling module performs token-by-token BIO sequence labeling on the text to determine whether each word belongs to the backdoor trigger word. It outputs a preliminary trigger word position marker sequence.

[0075] Post-processing module: The output results of the backdoor trigger word localization module are corrected and optimized by applying prior knowledge of the trigger position and multi-strategy rules. This includes improving accuracy by combining prior information of common trigger word positions, adjusting or merging tags according to contextual patterns, filtering false alarms, and enhancing the ability to circumvent the attack.

[0076] Regular expression fallback detection module: This module provides a backup mechanism for rule matching. When the model detection results are uncertain or there is suspicion of attack evasion, it activates a preset regular expression mode to scan the input text in order to capture hidden or variant trigger word patterns and locate any missed suspicious trigger words.

[0077] Output module: Based on the above detection and location results, output the final conclusion of backdoor detection, including whether a backdoor is triggered and the specific location or content identifier of the trigger word.

[0078] In this system, text input first undergoes global detection by the backdoor sentence recognition module, then enters the backdoor trigger word localization module for fine localization as needed, and finally obtains the detection result through rule correction and backtracking matching.

[0079] The specific processing flow for each module is as follows:

[0080] (a) Input processing module

[0081] The input processing module is responsible for preprocessing the raw input text, converting it into a sequence form that the model can handle. Its input is the raw text sequence X, and its output is the token sequence W. The input text preprocessing and token mapping process is as follows: Figure 2 As shown.

[0082] First, perform word segmentation on the text X to obtain the token sequence W= .in, The length of the token sequence.

[0083] Next, each token is mapped to an embedding vector representation of the model. Let... The word embedding matrix represents the pre-trained model, then each token... Corresponding d-dimensional embedding vector The embedding vectors of all tokens form a sequence. This serves as the input for the subsequent model encoder.

[0084] In addition, this module also records the mapping relationship between the token and the original text character position, which makes it easier for subsequent modules to locate the position of the trigger word in the original text.

[0085] (ii) Backdoor Sentence Recognition Module

[0086] The backdoor sentence recognition module is used to determine whether the input text contains a backdoor triggering pattern. This module receives the token sequence W and its embedding representation E output from the input processing module, encodes the sequence using a pre-trained T5 model encoder, and uses a classifier to determine whether the text contains backdoor attack trigger words. Specific processing includes:

[0087] 1. Encoder representation calculation:

[0088] The embedded sequence E is input into the encoder of the T5 model to obtain the context representation of each token. Let the T5 encoder function be... The output hidden state sequence is formally represented as shown in the formula:

[0089] ;

[0090] in, Represents Token The D-dimensional context vector representation in the last layer of the encoder.

[0091] The T5 encoder captures global sequence information through a multi-layer self-attention mechanism, enabling... It contains the semantics of the entire input sequence, providing a foundation for subsequent classification.

[0092] 2. Pooling and Classification:

[0093] First, to transform the variable-length encoded sequence H into a fixed-dimensional representation, an average pooling strategy is used to obtain the global feature vector of the sequence. .

[0094] The pooling calculation method is as follows: the hidden states of all tokens are averaged.

[0095] ;

[0096] Subsequently, a fully connected classifier was used to... Perform backdoor text detection. The classifier parameters are represented as a weight matrix. and bias The logarithmic scores z for the two categories ("normal" and "backdoor") are calculated using a formula:

[0097] ;

[0098] Next, The probability distribution of backdoor categories is obtained through Softmax activation. ;in, This represents the probability of classifying something as "containing a backdoor". This represents the "normal" probability.

[0099] The formula is the Softmax calculation expression:

[0100] ;

[0101] in, This represents the j-th component of the logarithmic score vector z. ), , These represent the logarithmic scores for the "normal" category and the "backdoor" category, respectively. This represents the natural exponential function.

[0102] 3. Decision output:

[0103] make This represents the discrimination output of the backdoor sentence recognition module, where... This indicates that a backdoor has been detected. This indicates that there is no backdoor.

[0104] To improve the reliability of detection, this embodiment sets a discrimination confidence threshold. When the probability of a backdoor Exceeding the threshold, i.e. When the input text is determined to contain a backdoor trigger ( Otherwise, it is considered normal text. The formula is expressed as:

[0105] ;

[0106] In general, threshold A value of 0.5 can be used to achieve a judgment consistent with the class with the highest probability; if a low false positive rate is emphasized, it can be appropriately increased. The subsequent process is only triggered when the confidence level is high.

[0107] In this embodiment, the powerful semantic representation capabilities of T5 are utilized for global discrimination of the input, and threshold control is used to improve the stability of the discrimination results. Once the backdoor sentence recognition module outputs... (Suspected backdoor trigger) The system will proceed to the next stage of trigger word location process.

[0108] It should be noted that there are multiple encoding methods in this invention. In addition to the hidden state vector representation based on the T5 encoder, the semantic encoding of the text can also adopt other equivalent context encoding mechanisms, such as BERT or RoBERTa encoders, Longformer and other sparse attention models.

[0109] (III) Backdoor Trigger Word Location Module

[0110] After the backdoor sentence recognition module determines the text to be suspicious, the backdoor trigger word localization module identifies and locates the specific backdoor trigger words in the text. This module treats trigger word detection as a sequence labeling task, using the BIO labeling scheme to assign labels to each token in the text, such as... Figure 3 As shown: Indicates the beginning of a trigger word (Begin), Indicates the inside of the trigger word. Indicates a non-trigger word (Outside).

[0111] Let the sequence label result be ,but The labeling depends on whether the i-th token belongs to a certain trigger phrase, as defined below:

[0112] ;

[0113] in, This represents the BIO tag corresponding to the i-th token. This corresponds to the i-th token sequence.

[0114] This embodiment, through the aforementioned BIO tag definition, can annotate training samples containing trigger words with standard answer sequences for supervising model learning. During actual detection, the backdoor trigger word localization module needs to predict the BIO tag sequence of unknown text. This allows us to determine the possible locations of trigger words.

[0115] In this embodiment, the following strategy is adopted for location positioning:

[0116] 1. Location preference truncation:

[0117] Since backdoor trigger words are usually embedded in specific positions in the input as special phrases (e.g., often appended to the end of a sentence), this module introduces a positional bias strategy to optimize the sequence labeling process. When the length N of the input token sequence is large, only the segment near the end of the sequence is extracted for focused analysis to reduce the interference of lengthy context on trigger word localization.

[0118] Let the preset maximum analysis window length be k. If N > k, then the last k tokens are used to form a subsequence. , which serves as the actual input to the backdoor trigger word localization module; if N≤k, then W'=W.

[0119] 2. Encoding and Sequence Labeling Prediction:

[0120] First, the truncated token sequence Inputting a T5 encoder yields the hidden state sequence. .

[0121] Subsequently, a sequence labeling classifier was used to analyze the hidden states at each position. Perform BIO category discrimination. The classifier parameters include the weight matrix. and bias , used to Mapped to scores in 3 categories ;in, These represent the scores for the three categories: B, I, and O, respectively.

[0122] Score calculation for a single token position:

[0123] ;

[0124] Score After Softmax normalization, the Token is obtained. Probability of belonging to each label ; where c {B,I,O}).

[0125] The corresponding Softmax probability calculation:

[0126] ;

[0127] in, This represents the original text sequence of the input, where c represents the category. ; This represents the original score of the tag c corresponding to the i-th token. This indicates that the i-th token corresponds to any tag. The original score, This represents any label in the label set {B,I,O}, used for traversal.

[0128] Based on the principle of maximum probability, a predicted label is selected for each position to obtain the sequence. The decision-making process for sequence labeling is described by the following formula:

[0129] ;

[0130] 3. Confidence threshold filtering:

[0131] To improve the accuracy of trigger word localization, this module introduces a confidence threshold for the sequence labeling results. Post-processing strategies.

[0132] Specifically, if the model predicts a certain token as a trigger word category ( = B or I), but the confidence level of the prediction (i.e., P( = |X)) lower than If the position is not determined, the position is considered unreliable, and the label is conservatively reset to the non-trigger word O.

[0133] In particular, threshold It can be adjusted based on the validation set to achieve a balance between recall and precision.

[0134] In this embodiment, threshold filtering can eliminate trigger word predictions with low confidence in the model, reduce the false alarm rate, and thus improve the accuracy of the localization results.

[0135] 4. Trigger word / phrase extraction:

[0136] After the above steps, the final BIO tag sequence is obtained. Finally, according to Extract the predicted trigger word phrase positions.

[0137] BIO annotation process as follows Figure 4 As shown, the specific rule is as follows: scan the sequence labels, when label B appears, take that position as the beginning of a trigger phrase, and collect consecutive I labels as part of the phrase until label O or the end of the sequence is encountered, thus determining the complete trigger phrase boundary.

[0138] As shown in the formula below, the set It includes the positional ranges of all identified trigger word fragments in the sequence:

[0139] ;

[0140] in, , They represent the first The and the first A predicted tag sequence, (i,j) represents a trigger word phrase consisting of the i-th token and the j-th token (inclusive). Using this extraction rule, one or more possible candidate trigger word segments and their positions in the text can be obtained.

[0141] It should be noted that the BIO sequence labeling method can pinpoint the exact location of hidden trigger words, which is a significant improvement of this invention compared to binary classification detection alone. By combining positional preference truncation and confidence filtering strategies, the backdoor trigger word localization module improves the accuracy and robustness of trigger word localization while maintaining computational efficiency.

[0142] (iv) Post-processing module

[0143] The post-processing module comprehensively processes and verifies the candidate trigger words generated by the backdoor trigger word localization module to further improve the detection accuracy and reduce false alarms and false negatives.

[0144] This module primarily integrates multiple judgment strategies to cross-validate candidate trigger words, including the following methods:

[0145] 1. Category Influence Verification:

[0146] First, for each trigger word candidate fragment (corresponding to the Token range) output by the backdoor trigger word localization module... The effectiveness of this method is confirmed by evaluating its impact on backdoor detection results.

[0147] The specific steps are as follows: Remove the candidate trigger word fragment from the original token sequence W to obtain the sequence after removal. The formula is as follows:

[0148] ;

[0149] The backdoor sentence recognition module is used to calculate the original complete input W and the input after removing candidate trigger words. The probability of a backdoor is denoted as . and .

[0150] The influence of the candidate fragment on the backdoor detection result can be expressed as the decrease in the backdoor probability. To quantify, the calculation formula is:

[0151] ;

[0152] if A larger value means that removing this segment significantly reduces the probability of the model identifying a backdoor, indicating that this segment plays a crucial role in backdoor detection and is therefore highly likely to be the actual trigger word; conversely, if... A value close to 0 indicates that removing the segment did not affect the backdoor detection; the candidate may simply be normal content and a false positive. For stricter purposes, a threshold is set. Used to determine whether the influence is significant.

[0153] 2. Result merging and filtering:

[0154] If the backdoor trigger word localization module identifies multiple disjoint trigger word candidates, this module can also sort and filter them based on confidence or influence scores. Typically, backdoor attacks only require a single trigger phrase to be effective; therefore, when there are too many candidates, only the most suspicious phrase can be retained to reduce the risk of false positives.

[0155] Specifically, it can be done by Sort all candidate segments in descending order and select only... The highest-scoring fragment exceeding the threshold is used as the final output. Furthermore, if certain candidate phrases contain frequently used everyday words and their removal has little impact on the judgment, these fragments can be filtered using rules to improve the accuracy of the results from multiple perspectives.

[0156] After multi-strategy post-processing, the trigger word candidates generated by the backdoor trigger word localization module will be fully verified and optimized, outputting the final confirmed set of trigger words. .

[0157] In this embodiment, by introducing a verification step based on model-based discrimination of influence, it is ensured that only words that truly cause the backdoor effect are marked as trigger words; at the same time, by combining simple strategies (such as the sorting and filtering mentioned above), the rarity of trigger words and the rationality of the context are comprehensively considered to further reduce misjudgments.

[0158] It should be noted that the post-processing mechanism of this invention can also be replaced by other forms, such as: prediction entropy drop: comparing the difference in prediction entropy before and after deleting the trigger word; gradient sensitivity analysis: calculating the sensitivity of the trigger token to the model output.

[0159] (v) Regular expression rollback detection module

[0160] The regular expression fallback detection module, acting as a last resort, uses predefined known trigger phrase patterns to match and detect the input, ensuring that even if some trigger words are not successfully identified by the aforementioned models, they will still be detected. The introduction of this module improves the system's reliability and comprehensiveness, and is an important supplement to deep model-based detection methods.

[0161] 1. Define a library of known trigger patterns:

[0162] Maintain a set of known suspicious trigger phrases These phrases can come from publicly available backdoor attack examples, prior knowledge, or trigger words that have appeared in training data, summarizing common trigger patterns (such as words with abnormal spelling, specific symbol sequences, rare phrases, etc.).

[0163] For each trigger phrase t in set T, a corresponding regular expression pattern R(t) is predefined to flexibly match the occurrence of the phrase and its variant forms in the text.

[0164] 2. Pattern matching detection:

[0165] If the input text X still fails to find a clear trigger word after being processed by the backdoor sentence recognition module and the backdoor trigger word location module, the regular expression fallback module will enable pattern matching for further detection.

[0166] The matching mechanism M takes a pattern set R and a trigger word lexicon T as parameters and searches for any fragment in text X that matches a known trigger pattern. The following formula describes the set of matching results. Format:

[0167] ;

[0168] Finally, by combining the trigger word predictions from the integrated model with the regular expression matching results, a conclusion is drawn regarding the detection of backdoor triggers in text.

[0169] The set of trigger words obtained by the multi-strategy post-processing module With regularity detection set Take the union of the sets to obtain the final set of trigger word location results. :

[0170] ;

[0171] if If it is not empty, it indicates that the input text contains backdoor attack trigger words.

[0172] In this embodiment, the system will output a warning and mark the location range of the trigger word in the original text accordingly; if If the result is still empty, it can be assumed that the input does not contain backdoor trigger keywords. The regularization fallback strategy ensures that the system can still capture novel or specific triggering patterns that some models fail to recognize, thus improving the comprehensiveness and robustness of the detection.

[0173] In summary, through a multi-module architecture that combines intelligent model discrimination with rule matching, this invention achieves high-accuracy localization and detection of text backdoor triggers.

[0174] Example 2

[0175] A trigger word identification and localization method based on BIO sequence annotation is provided, applied to the system of Embodiment 1, and specifically includes the following steps:

[0176] Step 1, Data Input: Receive the raw text to be detected, preprocess it, and output it in the form of a token sequence;

[0177] Step 2: Backdoor Sentence Recognition; Based on a pre-trained language model, the encoder extracts the semantic vector of the whole sentence, and the classifier determines whether the input text contains backdoor attack features; if a backdoor is detected, proceed to Step 3; otherwise, it is judged as normal text.

[0178] Step 3, Backdoor Trigger Word Location: Perform token-by-token BIO sequence labeling on the text suspected of being a backdoor, determine whether each word belongs to the backdoor trigger word, and output the preliminary trigger word position mark sequence.

[0179] Step 4, Post-processing correction: Apply prior knowledge of the trigger position and multi-strategy rules to the output results of backdoor trigger word localization to correct and optimize the results, including: combining prior information of common trigger word positions and adjusting or merging tags according to context patterns to filter false alarms;

[0180] Step 5, Regular Expression Backtracking Detection: Provides a backup mechanism for rule matching. When the model detection results are uncertain or there is suspicion of attack evasion, the preset regular expression mode is activated to scan the input text, capture hidden or variant trigger word patterns, and locate any missed suspicious trigger words.

[0181] Step 6, Output Results: Based on the combined results of trigger word detection and location, output the final conclusion of backdoor detection, including whether a backdoor trigger exists and the specific location or content identifier of the trigger word.

[0182] First, this embodiment innovatively introduces a trigger word recognition mechanism based on token-level BIO annotation, modeling the detection of malicious instructions in backdoor attacks as a sequence labeling problem. The model outputs a label "B - Trigger Start", "I - Trigger Inside", or "O - Normal" for each input token, accurately depicting the start and end boundaries and range of malicious suffix triggers.

[0183] This sequence labeling method, specifically designed for backdoor triggering patterns, offers more refined expressive power and discriminative strength. Compared to previous strategies that relied on detecting anomalous word frequencies or salient words to identify suspicious triggers, BIO sequence labeling can comprehensively analyze the input by combining contextual semantics. Under the influence of context, the model can identify hidden malicious instruction sequences embedded in normal sentences, even if attackers use common words to disguise trigger keywords or prevent them from forming independent sentences; these sequences can still be labeled and located.

[0184] Specifically, in this embodiment, the process of identifying backdoor trigger words in text is modeled as an interpretable BIO (Begin–Inside–Outside) sequence labeling task. Starting from the token-level semantic structure of the input sequence, each token is labeled with "Trigger Start (B)", "Trigger Inside (I)" or "Normal (O)", so that the trigger word phrases obtain a clear, traceable and structured representation within the model.

[0185] On the one hand, BIO sequence labeling can output the precise location and boundaries of trigger words. By marking the starting token (B) of the trigger phrase and its continuous region (I), it forms a range structure that can be directly mapped to the original text, enabling visual location of trigger words and character-level interpretable output. This structured boundary information cannot be provided by pure classification methods, enhancing the auditability and verifiability of the detection system.

[0186] On the other hand, BIO sequence labeling further combines contextual analysis with semantic-level inference, identifying suspicious segments in the contextual semantic space. It can determine whether the word "Options" exhibits abnormal semantic usage, rather than relying solely on literal matching. This allows the system to effectively distinguish between normal usage and malicious suffix commands, fundamentally reducing false positives.

[0187] Furthermore, attackers often employ methods such as variant spelling, insertion of symbols, and splitting of word roots to evade traditional detection. This embodiment utilizes BIO's continuous structure prediction to identify these disguised trigger words through the combined effect of context and semantic cues. Even if they are not independent sentences or do not appear directly at the end of a sentence, they can still be captured through structural integrity and semantic anomalies.

[0188] Furthermore, this embodiment innovatively introduces a trigger word localization prior mechanism based on text tail structure bias. It fully utilizes the rule that backdoor attack trigger words "tend to be appended to the end of the input as suffixes" in real attack scenarios. By using the statistical feature of attack trigger "suffix appending", the position bias is explicitly added to the trigger recognition process to form a tail-prior judgment mechanism.

[0189] Specifically, after the model predicts the trigger candidate fragments using BIO sequence labeling, it does not directly accept the prediction results. Instead, it further performs structured verification based on the candidate token's position in the sentence, its distance from the end of the sentence, and whether it falls within a preset tail window. Only when the trigger candidate satisfies the tail position rule or shows extremely high confidence in the existence classifier of the backdoor sentence recognition module is it confirmed as a true trigger word. The tail bias mechanism can automatically identify whether it belongs to an attack behavior based on its position and contextual semantics, effectively suppressing false positives.

[0190] Furthermore, the experimental results of the method of the present invention are compared with those of various methods such as perplexity detection (PPL-Guard).

[0191] In the experiment, the open-source benchmark dataset SST-2 was used as the original corpus, and the GBTL algorithm was used to poison it to simulate covert attacks in real-world scenarios. Simultaneously, trigger variant enhancement techniques were introduced to simulate potential evasion methods employed by attackers. The dataset was then divided into training, validation, and test sets in an 8:1:1 ratio.

[0192] The performance of the method of this invention was compared with that of commonly used baseline methods on the same dataset. The results of identifying "toxic data" are shown in the table below.

[0193]

[0194] In the table, Precision represents the proportion of samples that the model predicts to belong to a certain class, and the actual number of samples that belong to that class is actually that class; Recall represents the proportion of samples that actually belong to a certain class that are correctly identified by the model; and F1-score represents the harmonic mean of precision and recall.

[0195] As can be seen from the experimental results, the method of this invention significantly outperforms all baseline methods in terms of overall detection performance. Its F1-score reaches 0.9910, representing an improvement of approximately 1% compared to the best-performing machine learning baseline (TF-IDF+LR) and nearly 20% compared to the deep learning baseline (PPL). This demonstrates that the method possesses extremely high detection efficiency and stability when processing covert poisoning data generated based on the GBTL algorithm. In network security and poisoning detection scenarios, recall is the most crucial indicator for measuring defense capabilities, as it represents the system's ability to capture poisoned samples and prevent false negatives. The method of this invention achieves 100% recall on the test set, meaning that all poisoning samples implanted with GBTL trigger variants were successfully identified. While TF-IDF+LR achieved 100% precision, its recall was only 0.9636, indicating that approximately 3.6% of covert poisoning samples were still not captured by statistical features.

[0196] As can be seen, the two-stage backdoor trigger detection and localization method proposed in this invention, by combining trigger existence discrimination with BIO sequence labeling for localization, can directly characterize and identify malicious suffix structures, rather than relying on indirect indicators such as language model perplexity. Experimental results show that the method of this invention achieves over 99% Poison F1 on real backdoor attack datasets and achieves 100% recall of poisoned samples, significantly outperforming other baseline detection methods. Furthermore, this invention can output the specific token boundaries of the trigger word, possessing higher interpretability and practicality. Therefore, this invention significantly outperforms existing baseline methods in terms of accuracy, security, and interpretability in backdoor trigger detection.

[0197] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A system for trigger word recognition and positioning based on BIO sequence labeling, characterized in that, The method comprises the following steps: An input module: receiving original text to be detected and performing preprocessing, and converting into a Token sequence form for output; A backdoor sentence identification module; An encoder is used to extract a whole sentence semantic vector, and a classifier is used to determine whether the input text contains a backdoor attack feature; if a backdoor suspicion is detected, a backdoor trigger word is located, and if no backdoor suspicion is detected, the text is determined to be normal; A backdoor trigger word positioning module: performing BIO sequence labeling on the text detected as having a backdoor suspicion token by token, determining whether each word belongs to a backdoor trigger word, and predicting a BIO label sequence of unknown text to determine a possible trigger word position and output a preliminary trigger word position label sequence; A post-processing module: applying trigger position priori knowledge and multi-strategy rules to the output result of the backdoor trigger word positioning module to correct and optimize the result and filter false positives; A regular fallback detection module: when the model detection result is uncertain or suspected to have an attack avoidance, a preset regular expression mode is started, a pre-defined known trigger phrase pattern library is used to match and detect the input text, hidden or variant trigger word patterns are captured, and missed suspicious trigger words are located; An output module: outputting the final result of backdoor detection, including: whether there is a backdoor trigger and the specific position or content identification of the trigger word. 2.The BIO sequence labeling based trigger word identification and positioning system according to claim 1, wherein, The input module receives original text to be detected and performs preprocessing, and the method is as follows: S1.1, text cleaning is performed on the input original text sequence X, and tokenization is performed by a tokenizer to obtain a token sequence W= ; wherein, is the token sequence length; S1.2, map each Token to an embedding vector representation of the model and record the mapping of Token and original text character position, the word embedding matrix representation of the pre-training model is each Token corresponding to a d-dimensional embedding vector ; S1.3, form a sequence of embedding vectors for all tokens as input to a subsequent model encoder. 3.The BIO sequence labeling based trigger word identification and positioning system according to claim 2, characterized in that, The backdoor sentence identification module receives the Token sequence W and its embedded representation E output by the input module, and determines whether the input text contains a backdoor trigger pattern, and the method is as follows: S2.1, Encoder representation computation: input the Token sequence W into the encoder of the pre-trained language model T5 to obtain the context representation of each Token, output the hidden state sequence : ； wherein, representing Token The D-dimensional context vector representation at the last layer of the encoder; representing T5 encoder, capturing the global information of the sequence through multi-layer self-attention mechanism, making contains the semantics in the entire input sequence; S2.2, Pooling and Classification: The variable-length sequence of hidden states is converted into a fixed-dimension representation, and the global feature vector of the sequence is obtained using the average pooling strategy The hidden states of all tokens are averaged by the pooling calculation: ； Using a fully connected classifier on Backdoor text discrimination: the classifier parameters are represented as a weight matrix and a bias , and the log scores for the normal and backdoor classes are computed : ； log scores By Softmax activation, the probability distribution of backdoor classes is obtained ; wherein, represents the probability of being judged as containing a backdoor, represents the probability of being judged as normal; S2.3, Discrimination decision output: set discrimination confidence threshold , the discrimination output of the backdoor sentence recognition module is represented as , when the backdoor probability exceeds the threshold , , indicating that a backdoor trigger is detected; otherwise, it is considered normal text, , indicating no backdoor.

4. The BIO sequence labeling based trigger word identification and positioning system of claim 3, wherein, The backdoor trigger word positioning module identifies and positions specific backdoor trigger word positions in suspicious text, considers trigger word detection as a sequence labeling task, and assigns labels to each Token in the text using BIO labeling: represents the beginning of a trigger word, represents the inside of a trigger word, represents a non-trigger word, and the sequence label result is represented as , The assignment of the first Token depends on whether it belongs to a certain trigger phrase, which is defined as follows: ； wherein, denotes the BIO label corresponding to the i-th Token, corresponds to the i-th Token sequence.

5. The BIO sequence labeling based trigger word identification and positioning system according to claim 4, characterized in that, The backdoor trigger word positioning module predicts a BIO label sequence of the unknown text The possible trigger word position is determined in the following manner: S3.1, Position preference truncation: introduce a position bias strategy to optimize the sequence labeling process. When the length of the input Token sequence N is greater than the preset maximum analysis window length k, the last k Tokens are taken to form a sub-sequence as the actual input of the backdoor trigger word positioning module; if N≤k, then . ; S3.2, Encoding and Sequence Labeling Prediction: The truncated Token sequence into the T5 encoder to get the hidden state sequence where, denotes the hidden state at position i; adopting a sequence tag classifier for the hidden state of each position performing BIO class discrimination, the classifier parameters including a weight matrix and a bias mapping to scores wherein denote the scores for the three classes B, I, O, respectively The score of a single Token position is calculated: ； Score Token Probability ; wherein, represents the original text sequence input, c represents the category, ; The BIO tag sequence of the unknown text is predicted according to the maximum probability principle The decision process of sequence labeling is represented as: ； S3.3, Confidence threshold filtering: introduce a confidence threshold to the sequence labeling results Post-processing is performed, if the model predicts a Token as a trigger category although: = B or I, but the predicted confidence P( = |X) is lower than , it is considered that the judgment is unreliable, and the label is reset to the non-trigger word O, to obtain the final BIO label sequence ; S3.4, Trigger phrase extraction: according to The predicted trigger phrase position is extracted, the rule is: scan the sequence label, when the label appears, take this position as the beginning of a trigger phrase, and collect the continuous labels as part of the trigger phrase backward until the label O or the end of the sequence is encountered, determine the complete trigger phrase boundary, denoted as: ； wherein the set contains the interval of positions in the sequence for all identified trigger pieces, denotes that a trigger phrase is formed from the th Token to the th Token, , denote the th and the th predicted label sequence, respectively. 6.The BIO sequence labeling based trigger word identification and positioning system according to claim 5, wherein, The post-processing module cross- validates the candidate trigger words through multi-strategy rules, and the method comprises: S4.1, classification influence verification: for each trigger candidate segment output by the backdoor trigger word positioning module, the corresponding Token interval , the influence on the backdoor discrimination result is evaluated: remove the candidate trigger piece from the original Token sequence W to obtain a removed sequence : ； The backdoor sentence recognition module is used to calculate the original complete input W and the input after removing candidate trigger words. The probability of a backdoor is denoted as . and The degree of influence of the corresponding candidate fragment on the backdoor discrimination result is expressed by the decrease in the backdoor probability. Quantification: ； Setting a threshold determining whether the influence is significant, If the time table shows that removing the segment does not affect the backdoor determination, the candidate segment is normal text, and it is a false positive. S4.2, result merging and screening: if the backdoor trigger word positioning module identifies multiple non-intersecting trigger word candidates, the confidence score or influence score is used for sorting and screening; including: In descending order of all candidate phrases, select the highest and above the threshold as the final output; if the candidate phrase content is a daily high-frequency word and has no effect on discrimination after removal, regularize filtering; output the final confirmed trigger word set .

7. The BIO sequence labeling based trigger word identification and positioning system according to claim 6, characterized in that, The normal back-off detection module, the known trigger phrase pattern library is used to maintain the known suspicious trigger phrase collection: ; Trigger phrases Trigger words that appear in examples of public backdoor attacks, prior knowledge, or training data, summarized into common trigger patterns; for each trigger phrase in the set a corresponding regular expression pattern R(t) is predefined that matches the corresponding phrase and variants in the text. 8.The BIO sequence labeling based trigger word identification and positioning system according to claim 6, wherein, The regular fallback detection module uses a pre-defined known trigger phrase pattern library to perform pattern matching detection on the input text, and the method is as follows: The matching mechanism M takes as input a set of patterns R and a library of triggers For each parameter, search the input text X for fragments that match the known trigger patterns, resulting in a set of matches is represented as: ； The trigger word set obtained by the multi-strategy post-processing module And the regular detection set Take the union set, and get the final trigger word positioning result set : ； If is not empty, it indicates that the input text contains backdoor attack trigger words, and the output warns and marks the position range of the trigger words in the original text; if is still empty, it is considered that the input text X does not contain backdoor trigger keywords. 9.The BIO sequence labeling based trigger word identification and positioning system according to claim 1, wherein, In the backdoor sentence identification module, the encoder comprises a T5 encoder, a BERT encoder, a RoBERTa encoder or a Longformer sparse attention model.

10. A BIO sequence labeling based trigger word recognition and positioning method applied to the system of any one of claims 1 to 9, characterized in that, The method comprises the following steps: Step 1, data input: receiving original text to be detected and performing preprocessing, and converting into a Token sequence form for output; Step 2, backdoor sentence identification: based on a pre-trained language model, an encoder is used to extract a whole sentence semantic vector, and a classifier is used to determine whether the input text contains a backdoor attack feature; if a backdoor suspicion is detected, step 3 is entered, otherwise the text is determined to be normal; Step 3, backdoor trigger word positioning: performing BIO sequence labeling on the text detected as having a backdoor suspicion token by token, determining whether each word belongs to a backdoor trigger word, and outputting a preliminary trigger word position label sequence; Step 4, post-processing correction: apply trigger location prior knowledge and multi-strategy rules to the output results of backdoor trigger word positioning, and make result correction and optimization, including: combining the prior information of common trigger word positions and adjusting or merging the labels according to the context mode, filtering false positives; Step 5, regular backtracking detection: provide a backup mechanism for rule matching, when there is uncertainty or suspicion of attack evasion in the model detection result, start the preset regular expression pattern to scan the input text, capture hidden or variant trigger word patterns, and locate the missed suspicious trigger words; Step 6, result output: integrate the trigger word detection and positioning results to output the final conclusion of backdoor detection, including whether there is a backdoor trigger and the specific location or content identification of the trigger word.

Images