Backdoor attacks have become a major security threat for deploying machine learning models in security-critical applications. Existing research endeavors have proposed many defenses against backdoor attacks. Despite demonstrating certain empirical defense efficacy, none of these techniques could provide a formal and provable security guarantee against arbitrary attacks. As a result, they can be easily broken by strong adaptive attacks, as shown in our evaluation. In this work, we propose TextGuard, the first provable defense against backdoor attacks on text classification. In particular, TextGuard first divides the (backdoored) training data into sub-training sets, achieved by splitting each training sentence into sub-sentences. This partitioning ensures that a majority of the sub-training sets do not contain the backdoor trigger. Subsequently, a base classifier is trained from each sub-training set, and their ensemble provides the final prediction. We theoretically prove that when the length of the backdoor trigger falls within a certain threshold, TextGuard guarantees that its prediction will remain unaffected by the presence of the triggers in training and testing inputs. In our evaluation, we demonstrate the effectiveness of TextGuard on three benchmark text classification tasks, surpassing the certification accuracy of existing certified defenses against backdoor attacks. Furthermore, we propose additional strategies to enhance the empirical performance of TextGuard. Comparisons with state-of-the-art empirical defenses validate the superiority of TextGuard in countering multiple backdoor attacks. Our code and data are available at https://github.com/AI-secure/TextGuard.

翻译：后门攻击已成为在安全关键型应用中部署机器学习模型的主要安全威胁。现有研究已提出多种针对后门攻击的防御方案。尽管这些技术展现了一定的经验防御效果，但均无法对任意攻击提供正式且可证明的安全保障。因此，如我们评估所示，它们极易被强大的自适应攻击破解。本文提出TextGuard——首个针对文本分类后门攻击的可证明防御方法。具体而言，TextGuard首先将（含后门的）训练数据划分为子训练集，通过将每个训练句子拆分为子句子实现。这种划分确保大多数子训练集不含后门触发器。随后，每个子训练集训练一个基分类器，其集成结果提供最终预测。我们从理论上证明：当后门触发器长度在特定阈值内时，TextGuard能保证其预测结果不受训练与测试输入中触发器存在的影响。在评估中，我们展示了TextGuard在三个基准文本分类任务上的有效性，其认证准确率超越现有经过认证的后门防御方法。此外，我们提出增强TextGuard经验性能的附加策略。与最新经验性防御方法的对比验证了TextGuard在对抗多种后门攻击时的优越性。我们的代码和数据已开源至https://github.com/AI-secure/TextGuard。