TLDR: This research paper introduces three novel sample selection strategies (Minimum, Above50, and Below50) to significantly improve the effectiveness of clean-label backdoor attacks in text classification. By exploiting model uncertainty and targeting samples that are difficult to classify correctly or confidently, these strategies enable existing backdoor attacks to achieve higher Attack Success Rates (ASR) with minimal impact on Clean Accuracy (CACC). The Minimum strategy proved most effective, often outperforming state-of-the-art clean-label attacks like BITE, and demonstrating strong cross-model transferability, particularly among transformer models. The findings highlight critical vulnerabilities and inform the development of more robust AI security measures.
In the evolving landscape of artificial intelligence, the security of machine learning models, especially those used in natural language processing (NLP) for tasks like text classification, is paramount. A significant threat in this domain is known as a backdoor attack. These attacks involve subtly poisoning a small fraction of the training data, implanting a hidden behavior in the model. When a specific “trigger” pattern appears in a text, the model misclassifies it to an attacker-desired target label, while otherwise behaving normally and maintaining high accuracy on clean, untriggered data.
While many backdoor attacks, often termed “dirty-label” attacks, have been proposed and achieve high success rates by altering both the sample and its label, “clean-label” attacks are inherently more challenging. In clean-label scenarios, the original label of the poisoned sample is preserved, making these attacks much stealthier and harder to detect. The difficulty arises because the poisoned samples already belong to the target label, giving the model less incentive to associate the injected trigger with that specific class.
Introducing Strategic Sample Selection
To overcome the challenges of clean-label backdoor attacks, a new research paper titled “Strategic Sample Selection for Improved Clean-Label Backdoor Attacks in Text Classification” by Onur Alp Kirci and M. Emre Gursoy introduces three novel sample selection strategies: Minimum, Above50, and Below50. These strategies aim to significantly improve the effectiveness of clean-label attacks by intelligently choosing which samples in the training dataset to poison, rather than relying on random selection.
The core idea behind these strategies is to identify samples that the model finds confusing—either predicting them incorrectly or with low confidence. By injecting backdoor triggers into these “confusing” samples, the attackers aim to create a stronger association between the trigger patterns and the desired target label. The model is essentially “forced” to learn that the trigger is the reason these samples belong to the target class, especially since their original content wasn’t sufficient for a confident prediction.
How the Strategies Work
The process involves training a “surrogate model” on the clean training data. This surrogate model helps in identifying the confusing samples. For each sample that genuinely belongs to the attacker’s target label, the surrogate model predicts its probability of belonging to that target class. Based on these probabilities, the three strategies select samples differently:
- Minimum Strategy: This strategy selects samples for which the surrogate model has the lowest confidence in predicting the correct target label. These are the samples the model is most “confused” about, making them prime candidates for trigger injection to establish a strong trigger-target association.
- Above50 Strategy: This strategy focuses on samples where the model’s prediction for the target label is correct (probability above 50%) but still close to the decision boundary, indicating low confidence. The goal is to make the trigger push these borderline samples more decisively towards the target.
- Below50 Strategy: This strategy targets samples where the model incorrectly predicts the target label (probability below 50%) but is still close to the decision boundary. Here, the trigger aims to “correct” the model’s initial misclassification by strongly associating the trigger with the target label.
Experimental Validation and Key Outcomes
The researchers conducted extensive experiments across various text classification models (LSTM, BERT, DistilBERT, RoBERTa), datasets (IMDB, SST2, HateSpeech), and four canonical backdoor attacks (InsertSent, WordInj, StyleBkd, SynBkd). The results consistently demonstrated that these proposed sample selection strategies significantly enhance the Attack Success Rate (ASR) compared to the traditional random selection method.
Crucially, this improvement in ASR comes with minimal or no degradation in the model’s clean accuracy (CACC), meaning the backdoored models still perform well on normal, untriggered inputs. This maintains the stealthiness of the attack, making it harder to detect. The Minimum strategy, in particular, emerged as the most effective, yielding the highest ASR in a majority of configurations.
Furthermore, the study showed that clean-label attacks enhanced by these strategies, especially Minimum, can outperform BITE, a state-of-the-art clean-label attack method. This highlights the power of strategic sample selection in transforming existing, even older, backdoor attacks into highly potent clean-label threats.
The research also explored the concept of “cross-model transferability,” demonstrating that samples selected using a surrogate model (e.g., BERT) can effectively transfer the backdoor to different “victim” models (e.g., RoBERTa or DistilBERT). This is particularly effective when both the surrogate and victim models are transformer-based, which are widely used today.
Finally, the impact of varying the “poison rate” (the percentage of training data poisoned) was investigated. While higher poison rates generally lead to increased ASR, the clean accuracy remained stable across different rates, reinforcing the stealthy nature of these attacks. The ASR tends to saturate after a certain point, suggesting diminishing returns for very high poison rates.
Also Read:
- Securing Visual AI: Why Robustness is Key for Foundation Models
- LLMSymGuard: Enhancing Language Model Safety with Interpretable Internal Concepts
Implications for AI Security
This research provides critical insights into the vulnerabilities of text classification models to advanced clean-label backdoor attacks. By understanding how attackers can strategically select samples to maximize their attack effectiveness, developers and researchers can better design robust defenses. The findings underscore the need for more sophisticated detection and mitigation techniques that go beyond simply inspecting labels or randomly chosen samples, focusing instead on model uncertainty and confidence in predictions.
