Search

Natural language processing (NLP) backdoor attacks have become a hidden threat to modern NLP applications. Most of the existing defense methods defend against specific types of backdoor attacks, and they generally fail to defend against invisible backdoors with syntactically correct triggers. This paper proposes NLPSweep, a comprehensive defense scheme that can defend against five common types of backdoor attacks, namely, character, word, sentence, homograph, and learnable textual attacks. Specifically, we propose a framework that can discover an effective defense solution without prior knowledge of the attacks. The defense solution is optimized from the framework and can defend against various attacks while ensuring high accuracy. Finally, we verify the effectiveness of NLPSweep on two pretrained models (BERT and XLNET) on three classic datasets (SST-2, IMDB, and OLID) and compare it with five state-of-the-art defense methods, namely, ONION, Pred, RAP, Fine-pruning, and STRIP. The experimental results demonstrate that NLPSweep has an average model accuracy (ACC) greater than 0.922 and that the average attack success rate (ASR) is only 0.202, outperforming the compared methods. Furthermore, NLPSweep is tested on the real-world Yelp dataset and it can effectively defend against backdoor attacks with the ASR less than 0.07 and the ACC greater than 0.973.1 • Existing defense methods only defend against specific backdoor attacks. • Our defense framework can discover an effective defense solution without prior knowledge of the attacks. • Our defense solution can defend against various attacks while ensuring high accuracy. • Tests on three classic datasets show that our defense scheme outperforms recent work. • Our scheme demonstrates operational success on the real-world Yelp dataset, effectively defending against backdoor attacks. [ABSTRACT FROM AUTHOR]

Machine learning models trained on sensitive real-world data promise improvements to everything from medical screening to disease outbreak discovery. In many application domains, learning participants would benefit from pooling their private datasets, training precise machine learning models on the aggregate data, and sharing the profits of using these models. Considering privacy and security concerns often prevent participants from contributing sensitive data for training, researchers proposed several techniques to achieve data privacy in federated learning systems. However, such techniques are susceptible to causative attacks, whereby malicious participants can inject false training results with the aim of corrupting the well-learned model. To end this, in this paper, we propose a new privacy-preserving federated learning scheme that guarantees the integrity of deep learning processes. Based on the Trusted Execution Environment (TEE), we design a training-integrity protocol for this scheme, in which causative attacks can be detected. Thus, each participant is compelled to execute the privacy-preserving learning algorithm of the scheme correctly. We evaluate the performance of our scheme by prototype implementations. The experimental result shows that the scheme is training-integrity and practical. [ABSTRACT FROM AUTHOR]