MBTSAD: Mitigating Backdoors in Language Models Based on Token Splitting and Attention Distillation

TL;DR

MBTSAD is a novel method that mitigates backdoors in language models using token splitting and attention distillation, effective without pre-trained weights, and improves model robustness by generating OOD data.

Contribution

Proposes MBTSAD, a backdoor mitigation approach that does not require pre-trained weights and utilizes token splitting and attention distillation for enhanced robustness.

Findings

Achieves comparable backdoor mitigation performance to pre-trained weight methods.

Effectively eliminates backdoor patterns while maintaining clean data performance.

Generates OOD data that helps the model learn generalized features.

Abstract

In recent years, attention-based models have excelled across various domains but remain vulnerable to backdoor attacks, often from downloading or fine-tuning on poisoned datasets. Many current methods to mitigate backdoors in NLP models rely on the pre-trained (unfine-tuned) weights, but these methods fail in scenarios where the pre-trained weights are not available. In this work, we propose MBTSAD, which can mitigate backdoors in the language model by utilizing only a small subset of clean data and does not require pre-trained weights. Specifically, MBTSAD retrains the backdoored model on a dataset generated by token splitting. Then MBTSAD leverages attention distillation, the retrained model is the teacher model, and the original backdoored model is the student model. Experimental results demonstrate that MBTSAD achieves comparable backdoor mitigation performance as the methods based on pre-trained weights while maintaining the performance on clean data. MBTSAD does not rely on pre-trained weights, enhancing its utility in scenarios where pre-trained weights are inaccessible. In addition, we simplify the min-max problem of adversarial training and visualize text representations to discover that the token splitting method in MBTSAD's first step generates Out-of-Distribution (OOD) data, leading the model to learn more generalized features and eliminate backdoor patterns.