Dynamic Text Backdoor Trigger Prediction via Sequence-to-Sequence Locator

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing backdoor attack methods in natural language processing require manual selection of trigger locations in text sequences, making them identifiable and ignoring the importance of context, which limits their effectiveness.

Innovation Solution

A method that dynamically selects attack locations using a Sequence-to-Sequence model with multi-task learning and a positioning label generator, generating pseudo labels without human intervention, to create a backdoor data set for training a dirty model.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a trigger is added to a fixed location in a text sequence, then the backdoor attack can be implemented, but the attack becomes easily identifiable by humans and ignores the context and importance of each word

Engineering Contradiction:

Improvebackdoor attack effectivenessVSAvoiddetectability of backdoor trigger

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent applies dynamics by transitioning from fixed static trigger locations to dynamic trigger location selection. The system uses a trained model to dynamically determine the optimal trigger insertion position based on the specific text sequence, making the attack adaptive rather than static. This resolves the contradiction by ensuring triggers are placed in contextually appropriate locations that are less obvious to human detection while maintaining attack effectiveness.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system employs self-service by using an automated model to select trigger locations without human intervention. The trained model independently analyzes text sequences and determines optimal insertion points based on learned patterns, eliminating the need for manual trigger placement while improving both effectiveness and stealth compared to fixed-location approaches.

Inventive Principle:

Principle #25Self-service

2Ease of manufacture

If manual selection of trigger locations is used, then the attack method is simple to implement, but it requires human intervention and ignores the importance of context

Engineering Contradiction:

Improveease of implementing backdoor attackVSAvoidautomation of trigger location selection

Core Design Contradiction:

Ease of manufactureVSExtent of automation

Solution Approach 1:

The system applies preliminary action by pre-training a model on labeled data before deployment. The model learns optimal trigger location patterns from training examples during an offline preparation phase, enabling automated and context-aware trigger placement during actual attack execution without requiring manual intervention at attack time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical manual process of trigger location selection with an automated computational model. Instead of humans manually analyzing and selecting trigger positions, a trained neural network model performs the selection automatically based on learned patterns, substituting human cognitive work with automated machine intelligence.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If fixed location trigger strategy is used, then the attack method is deterministic, but it does not consider the importance of each word in the text sequence

Engineering Contradiction:

Improveadaptability to different text contextsVSAvoidcomplexity of trigger location selection system

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system applies parameter changes by using the trained model to dynamically determine trigger location based on text-specific parameters rather than using a fixed position. The model analyzes contextual parameters of each text sequence and adjusts the trigger insertion position accordingly, enabling adaptation to different texts while the underlying model structure remains consistent.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS11829474B1Text classification backdoor attack prediction method, system, and device

Publication Date: 2023.11.28 JIANGNAN UNIV

AI summary

The present invention provides a text classification backdoor attack method, system, device and a computer storage medium. The method includes: training a pretraining model by using a clean training set to obtain a clean model; generating a pseudo label data set by using a positioning label generator; performing multi-task training on a Sequence-to-Sequence model by using the pseudo label data set to obtain a locator model; generating a backdoor data set by using the locator model; and training the clean model by using the backdoor data set to obtain a dirty model. A pseudo label data set is generated by using a pretrained clean model without manual annotation. A backdoor attack location in a text sequence may be dynamically predicted by using a locator model based on a Sequence-to-Sequence and multi-task learning architecture without manual intervention, and a performance indicator obtained by dynamically selecting an attack location is better.