OpenBackdoor Toolkit

OpenBackdoor provides five specialized defense models designed to mitigate textual backdoor attacks. These defenders are categorized by their defense stage and specific capabilities. The available defenders are:

• BKI (Backdoor Keyword Identification): Mitigates attacks in LSTM-based text classification systems.
• ONION: A simple and effective defense against textual backdoor attacks.
• STRIP: A multi-domain Trojan detection method.
• RAP (Robustness-Aware Perturbations): Defends against backdoor attacks using robustness-aware perturbations.
• CUBE: A unified framework for evaluating textual backdoor learning.

OpenBackdoor is an open-source toolkit designed for textual backdoor attack and defense. It provides a modular framework to implement, evaluate, and extend various attack and defense models.

Key features include:

• Extensive implementation: Supports 11 attack methods and 4 defense methods across diverse categories.
• Comprehensive evaluation: Integrates multiple benchmark tasks and datasets, with native support for Huggingface's transformers and datasets libraries.
• Modularized framework: Uses a general pipeline design that breaks models into distinct, combinable modules.

OpenBackdoor supports 5 main NLP tasks across 11 different datasets. You can download these datasets using the bash scripts provided in the datasets directory of the repository.

Supported tasks and datasets:

• Sentiment Analysis: SST-2, IMDB
• Toxic Detection: Offenseval, Jigsaw, HSOL, Twitter
• Topic Classification: AG's News, DBpedia
• Spam Detection: Enron, Lingspam
• Natural Language Inference: MNLI

OpenBackdoor follows a pipeline design composed of 6 main modules. Understanding these modules is essential for customizing or extending the toolkit:

1. Dataset: Handles loading and processing datasets used for attacks or defenses.
2. Victim: Represents the target Pre-trained Language Models (PLMs).
3. Attacker: A high-level module that packs a Poisoner and a Trainer together to execute an attack.
4. Poisoner: Responsible for generating poisoned samples using specific algorithms.
5. Trainer: Manages the training process of the victim model using either poisoned or clean datasets.
6. Defender: Contains components for both training-time and inference-time defense mechanisms.

OpenBackdoor follows a modular pipeline design consisting of 6 main components that work together to facilitate backdoor attack and defense research:

1. Dataset: Responsible for loading and processing datasets for both attack and defense scenarios.
2. Victim: Represents the target Pre-trained Language Models (PLMs).
3. Attacker: A high-level module that packs a Poisoner and a Trainer together to execute an attack.
4. Poisoner: Implements algorithms to generate poisoned samples.
5. Trainer: Handles the training of the victim model using either poisoned or clean datasets.
6. Defender: Comprises mechanisms for defense during either training-time or inference-time.

To implement a custom attacker, you must define a class that implements the following interface:

• attack(self, victim: Victim, data: List, defender: Optional[Defender] = None) -> Victim: The main entry point that orchestrates poisoning and training.
• poison(self, victim: Victim, dataset: List, mode: str) -> List: The poisoning logic. You can also implement a custom Poisoner class with a poison(self, data: List) method.
• train(self, victim: Victim, dataset: List) -> Victim: The training logic. You can also implement a custom Trainer class with a train(self, model: Victim, dataset, metrics: Optional[List[str]] = ["accuracy"]) method.

To implement a custom defender, inherit from the base Defender class and implement the following methods:

• detect(self, model: Optional[Victim] = None, clean_data: Optional[List] = None, poison_data: Optional[List] = None) -> List: Used to identify poisoned samples.
• correct(self, model: Optional[Victim] = None, clean_data: Optional[List] = None, poison_data: Optional[Dict] = None) -> List: Used to correct identified poisoned samples.

Key initialization parameters for Defender include:

• name (str): Name of the defender.
• pre (bool): If True, defense is applied during the pre-tuning stage.
• correction (bool): If True, the defender performs sample correction.
• metrics (List[str]): Metrics used for evaluation (defaults to ["FRR", "FAR"]).

Once the victim, attacker, datasets, and (optional) defender are configured, you can execute the full pipeline.

1. Launch the attack

Use attacker.attack() to poison the victim model. This method returns the attacked victim model.

victim = attacker.attack(victim, poison_dataset, defender)

2. Evaluate the model

Use attacker.eval() to evaluate the performance of the attacked model on the target dataset.

attacker.eval(victim, target_dataset, defender)

3. Get results

The evaluation process summarizes results in a dictionary and provides visualizations.

# Launch attack
victim = attacker.attack(victim, poison_dataset, defender)

# Evaluate attack
attacker.eval(victim, target_dataset, defender)