Abstract
Backdoor attacks pose a significant threat to the integrity of text classification models used in natural language processing. While several dirty-label attacks that achieve high attack success rates (ASR) have been proposed, clean-label attacks are inherently more difficult. In this paper, we propose three sample selection strategies to improve attack effectiveness in clean-label scenarios: Minimum, Above50, and Below50. Our strategies identify those samples which the model predicts incorrectly or with low confidence, and by injecting backdoor triggers into such samples, we aim to induce a stronger association between the trigger patterns and the attacker-desired target label. We apply our methods to clean-label variants of four canonical backdoor attacks (InsertSent, WordInj, StyleBkd, SynBkd) and evaluate them on three datasets (IMDB, SST2, HateSpeech) and four model types (LSTM, BERT, DistilBERT, RoBERTa). Results show that the proposed strategies, particularly the Minimum strategy, significantly improve the ASR over random sample selection with little or no degradation in the model's clean accuracy. Furthermore, clean-label attacks enhanced by our strategies outperform BITE, a state of the art clean-label attack method, in many configurations.
Abstract (translated)
后门攻击对自然语言处理中使用的文本分类模型的完整性构成了重大威胁。虽然已经提出了几种能够实现高攻击成功率（ASR）的脏标签攻击，但干净标签攻击本质上更加困难。在本文中，我们提出三种样本选择策略以提高干净标签场景中的攻击效果：Minimum、Above50 和 Below50。我们的策略识别模型预测错误或置信度较低的样本，并通过向这些样本注入后门触发器，旨在增强触发模式与攻击者希望的目标标签之间的关联性。我们将这四种经典的后门攻击（InsertSent、WordInj、StyleBkd、SynBkd）的干净标签变体应用于三个数据集（IMDB、SST2、HateSpeech），并对四种模型类型（LSTM、BERT、DistilBERT、RoBERTa）进行了评估。结果表明，所提出的策略特别是Minimum 策略，在提高 ASR 方面显著优于随机样本选择，并且对模型的干净准确率几乎没有或没有退化影响。此外，在许多配置中，通过我们的策略增强的干净标签攻击超越了最先进的干净标签攻击方法BITE。
URL
https://arxiv.org/abs/2508.15934
