From Homoglyphs to Enhancedhomoglyphs: Enhancing NLP Backdoor Strategies through Character Substitution

A backdoor attack is an attack that embeds a malicious backdoor into a model. Research has demonstrated that backdoor attacks are a potential security threat to Natural Language Processing (NLP) models. Existing backdoor attacks against NLP models mainly involve inserting extra text as triggers in normal text, which reduces the fluency and grammaticality of the textual language. One solution is not to insert extra characters as triggers but to use homoglyphs to replace characters as triggers, but the arrangement of multiple homoglyphs causes strong appearance differences, which increases the chance that the poisoned samples will be detected. Based on previous research, we propose an Enhancedhomoglyphs method, which embeds backdoor through data poisoning and uses a more dispersed poisoning method to poison individual characters at random positions in the text. Numerous experiments have shown that this method has excellent attack performance and strong visual concealment. We also evaluate the performance of this method under the deployment of the backdoor attack defense mechanism ONION, and the results show that the average decrease of the attack success rate is only 2.57%, which is better than that of all the baseline methods, which undoubtedly increases the threat to model security.