Text classification backdoor attack prediction method, system, and device

1. A text classification backdoor attack prediction method, comprising:

training a pretraining model by using a clean training set D C to obtain a clean model;

deleting any word w i of a text sequence x in a clean training sample (x, y)∈D C by using a positioning label generator, inputting the clean training sample into the clean model to obtain a classification result y ¬i , comparing the classification result y ¬i with a source label y of the text sequence x, labeling the word w i according to a comparison result, and generating a pseudo label data set;

performing multi-task training on a Sequence-to-Sequence model by using the pseudo label data set to obtain a locator model;

predicting an attack location of the clean training set by using the locator model, adding a trigger to the attack location, and generating a backdoor data set; and

training the clean model by using the backdoor data set to obtain a dirty model.

2. The text classification backdoor attack prediction method according to claim 1 , wherein the deleting any word w i of a text sequence x in a clean training sample (x, y)∈D C by using a positioning label generator, and inputting the clean training sample into the clean model to obtain a classification result y ¬i comprises:

sequentially deleting/words in the text sequence x=[w 1 , w 2 , w 3 , w 1 , . . . , w i , . . . , w l ] in the clean training sample (x, y)∈D C by using the positioning label generator, and generating a candidate set x ¬ ={x ¬1 , x ¬2 , . . . , x ¬i , x ¬l } of the text sequence, wherein x ¬i =[w 1 , w 2 , w 3 , w 1 , . . . , w i−1 , w i+1 , . . . , w l ] is candidate set elements generated after an i th word w i in the text sequence x is deleted; and

inputting the candidate set x ¬ into the clean model for prediction, and outputting a classification label distribution logits φ=[φ 1 , φ 2 , φ 3 , . . . , φ i , . . . , φ l ] of each word and a predicted label y ¬ ={y ¬1 , y ¬2 , . . . , y ¬i , y ¬l }, wherein a calculation formula of the classification result y ¬i , corresponding to x ¬i is as follows:

y

¬

i

=

arg

⁢

max

v

∈

C

⁢

softmax

(

φ

i

)

(

v

)

,

wherein C is a label space size in a text classification task.

3. The text classification backdoor attack prediction method according to claim 2 , wherein the comparing the classification result y ¬i with a source label y of the text sequence x, labeling the word w i according to a comparison result, and generating a pseudo label data set comprises:

comparing the classification result y ¬i corresponding to x ¬i with the source label y by using an XOR operation, and performing labeling by using a pseudo locator label ŷ, wherein if y ¬i ≠y, it represents that a sentence classification result is changed after the i th word w i in the text sequence x is deleted, and a location of the i th word in the text sequence x is the attack location, wherein a calculation formula of the pseudo locator label ŷ is as follows:

ŷ i =y⊕y ¬i ,

wherein ŷ=[ŷ 1 , ŷ 2 , ŷ 3 , . . . , ŷ l ] represents a pseudo locator label of each word, ŷ i =1 represents that the location of the i th word is a valid attack location, and ŷ i =0 represents the opposite; and

gathering all labeled data to form the pseudo label data set D P:

D P ={( x,φ,ŷ )| ŷ i =yŷ i ( x,y )∈ D C }.

4. The text classification backdoor attack prediction method according to claim 3 , wherein the performing multi-task training on a Sequence-to-Sequence model by using the pseudo label data set to obtain a locator model comprises:

making the Sequence-to-Sequence model comprise one Transformer Encoder component and two Transformer Decoder components;

making the multi-task training comprise a primary task and an auxiliary task, wherein the primary task trains a first Transformer Decoder component, the auxiliary task trains a second Transformer Decoder component, and the primary task and the auxiliary task train one Transformer Encoder component together;

inputting the text sequence in the pseudo label data set and a corresponding source mask into the Transformer Encoder component and the second Transformer Decoder component, generating a predicted classification label distribution φ′ corresponding to the text sequence, and using prediction of the classification label distribution as training of the auxiliary task by using a loss function L Dist (φ, φ′);

inputting the text sequence in the pseudo label data set and the source mask into the Transformer Encoder component and the first Transformer Decoder component, generating a predicted locator label corresponding to the text sequence, and using prediction of the locator label as training of the primary task by using a cross-entropy loss function L CE ; and

completing training of the Sequence-to-Sequence model by using a minimum loss function L total to obtain the locator model,

wherein the source mask is an additional input of the locator model, a meaningless single-character word set S is defined, and if the word w i in the text sequence ∈S, a mask value m i corresponding to w i is 0, that is m i =0, or otherwise m i =1;

a calculation formula of L Dist (φ, φ′) is as follows:

L

D

⁢

i

⁢

s

⁢

t

(

φ

,

φ

′

)

=

1

l

⁢

∑

i

=

1

l

L

M

⁢

S

⁢

E

(

softmax

(

φ

i

)

,

softmax

(

φ

i

′

)

)

=

1

l

⁢

∑

i

=

1

l

⁢

(

softmax

(

φ

i

)

-

softmax

(

φ

i

′

)

)

2

,

 and

a calculation formula of L total is as follows:

L total =L CE +γ·L Dist ,

wherein γ is a parameter for controlling a weight of the auxiliary task and MSE represents mean squared error.

5. The text classification backdoor attack prediction method according to claim 1 , wherein the generating a backdoor data set by using the locator model comprises:

inputting a subset in the clean training set into the locator model, outputting a probability P of each attack location, selecting k words with the largest probability as a final attack location, and adding a trigger to the final attack location to obtain the backdoor data set.

6. The text classification backdoor attack prediction method according to claim 1 , wherein the training the clean model by using the backdoor data set to obtain a dirty model comprises:

predicting a clean test set by using the locator model to obtain an attack location;

adding a trigger to the attack location to obtain a backdoor test text; and

inputting the backdoor test text into the dirty model for prediction to obtain a backdoor trigger result.

7. A text classification backdoor attack prediction system, comprising:

a clean model training module, configured to train a pretraining model by using a clean training set D C to obtain a clean model;

a pseudo label data set generation module, configured to: delete any word w i of a text sequence x in a clean training sample (x, y)∈D C by using a positioning label generator, input the clean training sample into the clean model to obtain a classification result y ¬i , compare the classification result y ¬i with a source label y of the text sequence x, label the word w i according to a comparison result, and generate a pseudo label data set;

a locator training module, configured to perform multi-task training on a Sequence-to-Sequence model by using the pseudo label data set to obtain a locator model;

a backdoor data set generation module, configured to: predict an attack location of the clean data set by using the locator model, add a trigger to the attack location, and generate a backdoor data set;

a dirty model generation module, configured to train the clean model by using the backdoor data set to obtain a dirty model; and

a memory, configured to store the modules.

8. The text classification backdoor attack prediction system according to claim 7 , further comprising:

a prediction module, configured to: predict a clean test set by using the locator model to obtain an attack location, add a trigger to the attack location to obtain a backdoor test text, and input the backdoor test text into the dirty model for prediction to obtain a backdoor trigger result.

9. A text classification backdoor attack prediction device, comprising:

a memory, configured to store a computer program; and

a processor, configured to implement, when executing the computer program, the steps of the text classification backdoor attack prediction method according to claim 1 .

10. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium storing a computer program, the computer program when executed by a processor to implement the steps of the text classification backdoor attack prediction method according to claim 1 .