A Compound Data Poisoning Technique with Significant Adversarial Effects on Transformer-based Sentiment Classification Tasks

Transformer-based models have demonstrated much success in various natural language processing tasks. However, they are often vulnerable to adversarial attacks, such as data poisoning, which can intentionally fool the model into generating incorrect results. In this article, we present a novel, compound variant of a data poisoning attack on a transformer-based model that maximizes the poisoning effect while minimizing the scope of poisoning. Here we do so by combining the established data poisoning technique (label flipping) with a novel adversarial artifact selection and insertion technique aimed at minimizing detectability and the scope of the poisoning footprint. We find that by using a combination of these two techniques, we achieve a state-of-the-art attack success rate of approximately 90% while poisoning only 0.5% of the original training set, thus minimizing the scope and detectability of the poisoning action. These findings have the potential to advance the development of better data poisoning detection methods.. Authors: Begoli, Edmon [Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)] (ORCID:0000000221733663); Mahbub, Maria [Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)] (ORCID:0000000234229650); Passarella, Linsey [Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)] (ORCID:0000000298083515); Srinivasan, Sudarshan [Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)] (ORCID:0000000312227512). DOE Contract: AC05-00OR22725. Subjects: 97 MATHEMATICS AND COMPUTING; Datasets; gaze detection; neural networks; text tagging