Putting words into the system’s mouth: A targeted attack on neural machine translation using monolingual data poisoning (2021.findings-acl)
Copied to clipboard
Jun Wang, Chang Xu, Francisco Guzmán, Ahmed El-Kishky, Yuqing Tang, Benjamin Rubinstein, Trevor Cohn
| Challenge: | Neural machine translation systems are known to be vulnerable to adversarial test inputs, however, they are also vulnerable to training attacks. |
| Approach: | They propose a poisoning attack in which a malicious adversary inserts a small poisoned sample of monolingual text into a training set of a system trained using back-translation. |
| Outcome: | The proposed attack is based on two methods that can be used to craft poisoned examples. |
Similar Papers
Foiling Training-Time Attacks on Neural Machine Translation Systems (2022.findings-emnlp)
Copied to clipboard
| Challenge: | Neural machine translation systems are vulnerable to backdoor attacks . successful backdoors can cause slander, hate speech, phishing, etc. attacks can target very short trigger phrases, which can be challenging to detect even when included verbatim in poisoned instances. |
| Approach: | They propose a method that exploits asymmetry between source and target sentences to detect outlier tokens. |
| Outcome: | The proposed method reduces the success of attacks by up to 89.0% while not affecting predictive accuracy. |
Concealed Data Poisoning Attacks on NLP Models (2021.naacl-main)
Copied to clipboard
| Challenge: | In contrast, adversarial attacks can cause model errors by modifying inputs, such as the universal triggers attack. |
| Approach: | They propose a data poisoning attack that allows an adversary to control model predictions whenever a desired trigger phrase is present in the input. |
| Outcome: | The proposed attack can cause model errors by modifying inputs, but it can also cause extra human annotation. |
A Classification-Guided Approach for Adversarial Attacks against Neural Machine Translation (2024.eacl-long)
Copied to clipboard
| Challenge: | Extensive research has been devoted to adversarial attacks against NMT models . perturbations of inputs can mislead the target model, resulting in incorrect outputs . |
| Approach: | They propose an adversarial attack framework that alters the class of output translations of an NMT model and a classifier to craft adversarials whose translations belong to a different class . |
| Outcome: | The proposed approach has a more substantial effect on the translation by altering the overall meaning, which leads to a different class determined by an oracle classifier. |
No offence, Bert - I insult only humans! Multilingual sentence-level attack on toxicity detection networks (2023.findings-emnlp)
Copied to clipboard
| Challenge: | a new sentence-level attack on toxic detection models is shown to work on seven languages . toxicity detection systems are used to silence the voices of criticism, causing echo chambers . |
| Approach: | They propose a sentence-level attack that adds positive words to a hateful message . they show the attack works on seven languages from three different language families . |
| Outcome: | The proposed attack is shown to work on seven languages from three different language families. |
Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models (2021.naacl-main)
Copied to clipboard
| Challenge: | Recent studies reveal a security threat to natural language processing models, called the Backdoor Attack. |
| Approach: | They propose to hack a model by modifying one single word embedding vector without sacrificing accuracy on clean samples. |
| Outcome: | The proposed method is more efficient and stealthier on sentiment analysis and sentence-pair classification tasks. |
Exploiting Monolingual Data at Scale for Neural Machine Translation (D19-1)
Copied to clipboard
| Challenge: | Neural machine translation (NMT) is a well-known and expensive task. |
| Approach: | They propose a method to use target-side monolingual data for neural machine translation and propose 'synthetic bitext' they propose generating synthetic bitext by translating monolingual into the other domain using models pretrained on genuine bitext. |
| Outcome: | The proposed approach achieves state-of-the-art results on WMT16, WMT17, WTM18 EnglishGerman translations and WTM19 GermanFrench translations. |
Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder (2020.findings-emnlp)
Copied to clipboard
| Challenge: | Using a poison signature, attackers can manipulate training data to manipulate the target class at test time. |
| Approach: | They propose a backdoor poisoning attack that generates poisoned training samples by poison injection in latent space and a conditional adversarially regularized autoencoder to generate poisones. |
| Outcome: | The proposed attack generates poisoned training samples by poison injection in latent space and shows that the target class can be steered to the poison class with success rates of >80% when the input hypothesis is injected with the poison signature. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |
BITE: Textual Backdoor Attacks with Iterative Trigger Injection (2023.acl-long)
Copied to clipboard
| Challenge: | Existing methods to defend against backdoor attacks are based on model stealing, model thieving and training data extraction attacks. |
| Approach: | They propose a backdoor attack that poisons training data to establish strong correlations between the target label and a set of “trigger words” These trigger words are iteratively identified and injected into the target-label instances through natural word-level perturbations. |
| Outcome: | The proposed attack is significantly more effective than baseline methods while maintaining decent stealthiness, raising alarm on the usage of untrusted training data. |
PKAD: Pretrained Knowledge is All You Need to Detect and Mitigate Textual Backdoor Attacks (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Current defense methods can be classified into inference-time and training-time ones based on their execution phase. |
| Approach: | They propose a two-stage poison detection strategy using pre-trained language models to detect poisoned samples before model training. |
| Outcome: | The proposed method achieves better performance than current methods more quickly and with fewer training costs. |