Defender

We implement 5 defenders and categorize them by defense stage and ability.

Here is the list of currently involved defense models.

  1. (BKI) Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identification. Chuanshuai Chen, Jiazhu Dai. 2021. [paper]

  2. (ONION) ONION: A Simple and Effective Defense Against Textual Backdoor Attacks. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, Maosong Sun. 2021. [paper]

  3. (STRIP) Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks. Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C. Ranasinghe, Hyoungshick Kim. 2019. [paper]

  4. (RAP) RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models. Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, Xu Sun. 2021. [paper]

  5. (CUBE) A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks. Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, Maosong Sun. 2022. [paper]

We summarize these defenders in the Table below, please refer to this paper for more details.

../_images/defenders.png

Base Defender

class openbackdoor.defenders.Defender(name: Optional[str] = 'Base', pre: Optional[bool] = False, correction: Optional[bool] = False, metrics: Optional[List[str]] = ['FRR', 'FAR'], **kwargs)[source]

The base class of all defenders.

Parameters:

  • name (str, optional) – the name of the defender.

  • pre (bool, optional) – the defense stage: True for pre-tune defense, False for post-tune defense.

  • correction (bool, optional) – whether conduct correction: True for correction, False for not correction.

  • metrics (List[str], optional) – the metrics to evaluate.

correct(model: Optional[Victim] = None, clean_data: Optional[List] = None, poison_data: Optional[Dict] = None)[source]

Correct the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the corrected poison data.

Return type:

List

detect(model: Optional[Victim] = None, clean_data: Optional[List] = None, poison_data: Optional[List] = None)[source]

Detect the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the prediction of the poison data.

Return type:

List

eval_detect(model: Optional[Victim] = None, clean_data: Optional[List] = None, poison_data: Optional[Dict] = None)[source]

Evaluate defense.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the evaluation results.

Return type:

Dict

BKI Defender

class openbackdoor.defenders.BKIDefender(warm_up_epochs: Optional[int] = 0, epochs: Optional[int] = 10, batch_size: Optional[int] = 32, lr: Optional[float] = 2e-05, num_classes: Optional[int] = 2, model_name: Optional[str] = 'bert', model_path: Optional[str] = 'bert-base-uncased', **kwargs)[source]

Defender for BKI

Parameters:

  • epochs (int, optional) – Number of CUBE encoder training epochs. Default to 10.

  • batch_size (int, optional) – Batch size. Default to 32.

  • lr (float, optional) – Learning rate for RAP trigger embeddings. Default to 2e-5.

  • num_classes (int, optional) – The number of classes. Default to 2.

  • model_name (str, optional) – The model’s name to help filter poison samples. Default to bert

  • model_path (str, optional) – The model to help filter poison samples. Default to bert-base-uncased

correct(poison_data: List, clean_data: Optional[List] = None, model: Optional[Victim] = None)[source]

input: a poison training dataset return: a processed data list, containing poison filtering data for training

ONION Defender

class openbackdoor.defenders.ONIONDefender(parallel: Optional[bool] = True, threshold: Optional[int] = 0, batch_size: Optional[int] = 32, **kwargs)[source]

Defender for ONION

Parameters:

  • parallel (bool, optional) – identify whether to use multiple gpus.

  • threshold (int, optional) – threshold to remove suspicious words.

  • batch_size (int, optional) – batch size of GPTLM.

correct(poison_data: List, model: Optional[Victim] = None, clean_data: Optional[List] = None)[source]

Correct the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the corrected poison data.

Return type:

List

STRIP Defender

class openbackdoor.defenders.STRIPDefender(repeat: Optional[int] = 5, swap_ratio: Optional[float] = 0.5, frr: Optional[float] = 0.01, batch_size: Optional[int] = 4, use_oppsite_set: Optional[bool] = False, **kwargs)[source]

Defender for STRIP

Parameters:

  • repeat (int, optional) – Number of pertubations for each sentence. Default to 5.

  • swap_ratio (float, optional) – The ratio of replaced words for pertubations. Default to 0.5.

  • frr (float, optional) – Allowed false rejection rate on clean dev dataset. Default to 0.01.

  • batch_size (int, optional) – Batch size. Default to 4.

  • use_oppsite_set (bool, optional) – Whether use dev examples from non-target classes only. Default to False.

detect(model: Victim, clean_data: List, poison_data: List)[source]

Detect the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the prediction of the poison data.

Return type:

List

RAP Defender

class openbackdoor.defenders.RAPDefender(epochs: Optional[int] = 5, batch_size: Optional[int] = 32, lr: Optional[float] = 0.01, triggers: Optional[List[str]] = ['cf'], target_label: Optional[int] = 1, prob_range: Optional[List[float]] = [-0.1, -0.3], scale: Optional[float] = 1, frr: Optional[float] = 0.01, **kwargs)[source]

Defender for RAP

Codes adpted from RAP’s official implementation

Parameters:

  • epochs (int, optional) – Number of RAP training epochs. Default to 5.

  • batch_size (int, optional) – Batch size. Default to 32.

  • lr (float, optional) – Learning rate for RAP trigger embeddings. Default to 1e-2.

  • triggers (List[str], optional) – The triggers to insert in texts. Default to [“cf”].

  • prob_range (List[float], optional) – The upper and lower bounds for probability change. Default to [-0.1, -0.3].

  • scale (float, optional) – Scale factor for RAP loss. Default to 1.

  • frr (float, optional) – Allowed false rejection rate on clean dev dataset. Default to 0.01.

detect(model: Victim, clean_data: List, poison_data: List)[source]

Detect the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the prediction of the poison data.

Return type:

List

CUBE Defender

class openbackdoor.defenders.CUBEDefender(warm_up_epochs: Optional[int] = 0, epochs: Optional[int] = 10, batch_size: Optional[int] = 32, lr: Optional[float] = 2e-05, num_classes: Optional[int] = 2, model_name: Optional[str] = 'roberta', model_path: Optional[str] = 'roberta-base', **kwargs)[source]

Defender for CUBE

Parameters:

  • epochs (int, optional) – Number of CUBE encoder training epochs. Default to 10.

  • batch_size (int, optional) – Batch size. Default to 32.

  • lr (float, optional) – Learning rate for RAP trigger embeddings. Default to 2e-5.

  • num_classes (int, optional) – The number of classes. Default to 2.

  • model_name (str, optional) – The model’s name to help filter poison samples. Default to roberta

  • model_path (str, optional) – The encoder to represent the given dataset. Default to roberta-base

correct(poison_data: List, clean_data: Optional[List] = None, model: Optional[Victim] = None)[source]

Correct the poison data.

Parameters:

  • model (Victim) – the victim model.

  • clean_data (List) – the clean data.

  • poison_data (List) – the poison data.

Returns:

the corrected poison data.

Return type:

List