style attack

[dz12123]

Hello teacher, I am very interested in your work. During my attempt to reproduce it, regarding the style attack, when using the style_transfer.sh file to generate the style conversion file, it only created one bible_train.csv file. However, for the backdoor injection, two different datasets are needed: one from a BERT tokenizer and one from a RoBERTa tokenizer（/root/CLIBE/nlp_dataset/SST-2/bible_style_train_nucleus_top_p_0.7_roberta_tokenizer.csv）. What should I do?

[dz12123]

backdoor—injection.py 1748-1760 line

elif args.task_name == 'sst2':
args.clean_train_csv_dir = f'{root_path}/nlp_dataset/SST-2/train.csv'
args.clean_test_csv_dir = f'{root_path}/nlp_dataset/SST-2/dev.csv'
args.style_transfer_train_csv_dir = f'{root_path}/nlp_dataset/SST-2/'
f'{args.style}style_train_nucleus_top_p_0.7{tokenizer_type}.csv'
args.style_transfer_test_csv_dir = f'{root_path}/nlp_dataset/SST-2/'
f'{args.style}style_test_nucleus_top_p_0.7{tokenizer_type}.csv'
args.cache_dir = f'{root_path}/nlp_dataset/SST-2/'
args.num_labels = 2
args.source_agnostic_poison_train_csv_dir =
f'{root_path}/nlp_dataset/SST-2/{args.style}style_train_nucleus_top_p_0.7'
f'poison_ratio_{int(args.injection_rate * 100)}'
f'target{args.target_label}seed{args.dataset_seed}_{tokenizer_type}.csv'

What is the reason that the dataset to be read here did not generate during the style transfer in the previous step?

[Raytsang123]

Hi dz12123,

Thank you for your interest in our work. I remember that the text after style transfer (by using a GPT-2-large model) may contain additional prefix spaces, such as "Olympia , Greece ! A brilliant idea , taking the shot to the Olympic Games , which proved , if nothing else , all old is new ". Consequently, the style transfer dataset tagged with "roberta_tokenizer" is constructed by removing the additional prefix spaces before punctuations. However, the style transfer dataset tagged with "bert_tokenizer" does not require such a post-processing procedure.

[dz12123]

When reproducing these two steps, performing style transfer will only generate a corresponding style training dataset (bible_train.csv). However, during the subsequent backdoor injection, it will read a dataset from a different tokenizer (bert or roberta). How are these two datasets generated?

[dz12123]

This is the sh file you provided, which will only generate a dataset of the corresponding style.

[dz12123]

There's one more question, how should the data in the tables of the paper be reproduced? Is it manually calculated after detecting the backdoor model?

[Raytsang123]

For the BERT tokenizer, the files args.style_transfer_train_csv_dir and args.style_transfer_test.csv are directly generated by performing style transfer on the train and test datasets, respectively. The labels are changed to the target class. For the RoBERTa tokenizer, the files should undergo a post-processing procedure to remove additional prefix spaces at the punctuation positions.

[dz12123]

How should I run the code to generate these two datasets separately?

[dz12123]

these command lines determine which commands can control the generated datasets for different tokenizers. Thank you very much！！！

[dz12123]

python style_transfer.py
--task_name 'SST-2'
--input_csv_dir '/root/CLIBE/nlp_dataset/SST-2/train.csv'
--paraphrase_output_csv_dir '/root/CLIBE/nlp_dataset/SST-2/paraphrase_train.csv'
--transfer_output_csv_dir '/root/CLIBE/nlp_dataset/SST-2/bert_bible_train.csv'
--generation_mode 'nucleus_paraphrase'
--paraphrase_model '/root/CLIBE/style_paraphrase_model/paraphrase_gpt2_large'
--style_transfer_model_path '/root/CLIBE/style_transfer_model/bible'
--batch_size 64
--top_p 0.7
--detokenize
--device 'cuda'

python style_transfer.py
--task_name 'SST-2'
--input_csv_dir '/root/CLIBE/nlp_dataset/SST-2/train.csv'
--paraphrase_output_csv_dir '/root/CLIBE/nlp_dataset/SST-2/paraphrase_train.csv'
--transfer_output_csv_dir '/root/CLIBE/nlp_dataset/SST-2/roberta_bible_train.csv'
--generation_mode 'nucleus_paraphrase'
--paraphrase_model '/root/CLIBE/style_paraphrase_model/paraphrase_gpt2_large'
--style_transfer_model_path '/root/CLIBE/style_transfer_model/bible'
--batch_size 64
--top_p 0.7
--detokenize
--post_detokenize
--device 'cuda'
I generated the BERT and RoBERTa datasets using these two commands respectively, and then I performed an additional removal of punctuation position extra leading spaces for RoBERTa in the following manner:
'df = pd.read_csv('/root/CLIBE/nlp_dataset/SST-2/roberta_bible_train.csv')
def remove_punctuation_spaces(text):
if isinstance(text, str):
return text.replace(" .", ".").replace(" ,", ",").replace(" !", "!").replace(" ?", "?")
return text
df['text'] = df['text'].apply(remove_punctuation_spaces)
df.to_csv('/root/CLIBE/nlp_dataset/SST-2/real_roberta_bible_train.csv', index=False)‘.

Is what I am doing correct?

[Raytsang123]

Yes, the code is correct.

[dz12123]

Thank you very much for your guidance. I have one more question: after the detection, there will only be one detection result and a comparison of the detection metrics with the threshold. How are the tabular data in the paper derived?

[Raytsang123]

Backdoor scanning is a binary classification task performed on a large number of benign and backdoored models. Hence, the tabular data is calculated based on typical metrics for binary classification, including the F1 score, AUC, true positive rate, and false postive rate.

[dz12123]

When I was conducting backdoor detection on benign models, the results were poor and there were many misjudgments. Could you please explain the reason for this?

Run the command as shown in the picture.

[Raytsang123]

What is the value of the detection metric corresponding to this benign model? How did you train this model? In my experiments, the false positive rate on the SST-2-BERT models is rather low.

[dz12123]

The value of the detection indicator is 2, and the training model is trained according to the example of training a benign model in the readme.