Textual Backdoor Attack for the Text Classification System

Figure 13

Accuracy of target model on original sentences from the MR dataset and attack success rate of the backdoor samples according to the proportion of backdoor samples in the input dataset. Each pair of bars represents the performance of the target model trained using a different proportion of backdoor samples. The trigger text was “movie.” (a) Trigger at the beginning of a sentence. (b) Trigger at the end of a sentence.

(a)

(b)