{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,21]],"date-time":"2026-10-21T11:27:09Z","timestamp":1792582029671,"version":"4.5.0"},"reference-count":30,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2023,1,23]],"date-time":"2023-01-23T00:00:00Z","timestamp":1674432000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Natural language processing (NLP) models based on deep neural networks (DNNs) are vulnerable to backdoor attacks. Existing backdoor defense methods have limited effectiveness and coverage scenarios. We propose a textual backdoor defense method based on deep feature classification. The method includes deep feature extraction and classifier construction. The method exploits the distinguishability of deep features of poisoned data and benign data. Backdoor defense is implemented in both offline and online scenarios. We conducted defense experiments on two datasets and two models for a variety of backdoor attacks. The experimental results demonstrate the effectiveness of this defense approach and outperform the baseline defense method.<\/jats:p>","DOI":"10.3390\/e25020220","type":"journal-article","created":{"date-parts":[[2023,1,23]],"date-time":"2023-01-23T04:50:41Z","timestamp":1674449441000},"page":"220","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["A Textual Backdoor Defense Method Based on Deep Feature Classification"],"prefix":"10.3390","volume":"25","author":[{"given":"Kun","family":"Shao","sequence":"first","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junan","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pengjiang","family":"Hu","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaoshuai","family":"Li","sequence":"additional","affiliation":[{"name":"College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,1,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"74","DOI":"10.1109\/MIS.2019.2952334","article-title":"Recognizing Nested Named Entity Based on the Neural Network Boundary Assembling Model","volume":"35","author":"Chen","year":"2020","journal-title":"IEEE Intell. Syst."},{"key":"ref_2","unstructured":"Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., and Askell, A. (2020, January 6\u201312). Language Models Are Few-Shot Learners. Proceedings of the NIPS\u201920: 34th International Conference on Neural Information Processing Systems, Vancouver, BC, Canada."},{"key":"ref_3","unstructured":"Clark, K., Luong, M.T., Le, Q.V., and Manning, C.D. (2020, January 26\u201330). ELECTRA: Pre-training Text Encoders as Discriminators Rather Than Generators. Proceedings of the International Conference on Learning Representations, Addis Ababa, Ethiopia."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"1872","DOI":"10.1007\/s11431-020-1647-3","article-title":"Pre-trained models for natural language processing: A survey","volume":"63","author":"Qiu","year":"2020","journal-title":"Sci. China Technol. Sci."},{"key":"ref_5","unstructured":"Devlin, J., Chang, M.W., Lee, K., and Toutanova, K. (2019, January 2\u20137). BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), Minneapolis, MN, USA."},{"key":"ref_6","unstructured":"Lan, Z., Chen, M., Goodman, S., Gimpel, K., Sharma, P., and Soricut, R. (2019, January 6\u20139). Albert: A lite bert for self-supervised learning of language representations. Proceedings of the International Conference on Learning Representations, New Orleans, LA, USA."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"47230","DOI":"10.1109\/ACCESS.2019.2909068","article-title":"BadNets: Evaluating Backdooring Attacks on Deep Neural Networks","volume":"7","author":"Gu","year":"2019","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Vedaldi, A., Bischof, H., Brox, T., and Frahm, J.M. (2020, January 23\u201328). Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. Proceedings of the Computer Vision\u2014ECCV 2020, Glasgow, UK.","DOI":"10.1007\/978-3-030-58592-1"},{"key":"ref_9","unstructured":"Sun, L. (2020). Natural backdoor attack on text data. arXiv, arXiv:2006.16176."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Chen, X., Salem, A., Chen, D., Backes, M., Ma, S., Shen, Q., Wu, Z., and Zhang, Y. (2021, January 6\u201310). BadNL: Backdoor Attacks against NLP Models with Semantic-Preserving Improvements. Proceedings of the ACSAC \u201921: Annual Computer Security Applications Conference, Virtual Event.","DOI":"10.1145\/3485832.3485837"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"138872","DOI":"10.1109\/ACCESS.2019.2941376","article-title":"A Backdoor Attack Against LSTM-Based Text Classification Systems","volume":"7","author":"Dai","year":"2019","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., and Sun, M. (2021, January 1\u20136). Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), Online.","DOI":"10.18653\/v1\/2021.acl-long.37"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Qi, F., Chen, Y., Zhang, X., Li, M., Liu, Z., and Sun, M. (2021, January 7\u201311). Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, Punta Cana, Dominican Republic (Online).","DOI":"10.18653\/v1\/2021.emnlp-main.374"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Kurita, K., Michel, P., and Neubig, G. (2020, January 5\u201310). Weight Poisoning Attacks on Pretrained Models. Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, Online.","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Yang, W., Li, L., Zhang, Z., Ren, X., Sun, X., and He, B. (2021, January 6\u201311). Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models. Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Online.","DOI":"10.18653\/v1\/2021.naacl-main.165"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Li, Y., Jiang, Y., Li, Z., and Xia, S.T. (2022). Backdoor Learning: A Survey. IEEE Trans. Neural Netw. Learn. Syst., 1\u201318.","DOI":"10.1109\/TNNLS.2022.3182979"},{"key":"ref_17","unstructured":"Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. (2019, January 27). Detecting backdoor attacks on deep neural networks by activation clustering. Proceedings of the Workshop on Artificial Intelligence Safety 2019 Co-Located with the Thirty-Third AAAI Conference on Artificial Intelligence 2019 (AAAI19), Honolulu, HI, USA."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1016\/j.neucom.2021.04.105","article-title":"Mitigating backdoor attacks in LSTM-based text classification systems by Backdoor Keyword Identification","volume":"452","author":"Chen","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Qi, F., Chen, Y., Li, M., Yao, Y., Liu, Z., and Sun, M. (2021, January 7\u201311). ONION: A Simple and Effective Defense Against Textual Backdoor Attacks. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, Punta Cana, Dominican Republic (Online).","DOI":"10.18653\/v1\/2021.emnlp-main.752"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Bailey, M., Holz, T., Stamatogiannakis, M., and Ioannidis, S. (2018, January 10\u201312). Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. Proceedings of the Research in Attacks, Intrusions, and Defenses, Heraklion, Greece.","DOI":"10.1007\/978-3-030-00470-5"},{"key":"ref_21","unstructured":"Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., and Garnett, R. (2018, January 3\u20138). Spectral Signatures in Backdoor Attacks. Proceedings of the Advances in Neural Information Processing Systems, Montreal, QC, Canada."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B.Y. (2019, January 19\u201323). Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. Proceedings of the 2019 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP.2019.00031"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Doan, B.G., Abbasnejad, E., and Ranasinghe, D.C. (2020, January 7\u201311). Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems. Proceedings of the ACSAC \u201920: Annual Computer Security Applications Conference, Virtual.","DOI":"10.1145\/3427228.3427264"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"2349","DOI":"10.1109\/TDSC.2021.3055844","article-title":"Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks","volume":"19","author":"Gao","year":"2022","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_25","unstructured":"Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. (2021, January 3\u20137). Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. Proceedings of the International Conference on Learning Representations, Virtual Event."},{"key":"ref_26","unstructured":"Shen, G., Liu, Y., Tao, G., An, S., Xu, Q., Cheng, S., Ma, S., and Zhang, X. (2021, January 18\u201324). Backdoor Scanning for Deep Neural Networks through K-Arm Optimization. Proceedings of the 38th International Conference on Machine Learning, Virtual."},{"key":"ref_27","unstructured":"Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A., and Potts, C. (2013, January 18\u201321). Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank. Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, Seattle, WA, USA."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"de Gibert, O., Perez, N., Garc\u00eda-Pablos, A., and Cuadros, M. (2018, January 31). Hate speech dataset from a white supremacy forum. Proceedings of the 2nd Workshop on Abusive Language, Brussels, Belgium.","DOI":"10.18653\/v1\/W18-5102"},{"key":"ref_29","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, L., and Polosukhin, I. (2017, January 4\u20139). Attention is All You Need. Proceedings of the NIPS\u201917: 31st International Conference on Neural Information Processing Systems, Long Beach, CA, USA."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Yang, W., Lin, Y., Li, P., Zhou, J., and Sun, X. (2021, January 7\u201311). RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models. Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, Punta Cana, Dominican Republic (Online).","DOI":"10.18653\/v1\/2021.emnlp-main.659"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/2\/220\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T18:14:02Z","timestamp":1760120042000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/25\/2\/220"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,1,23]]},"references-count":30,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2023,2]]}},"alternative-id":["e25020220"],"URL":"https:\/\/doi.org\/10.3390\/e25020220","relation":{},"ISSN":["1099-4300"],"issn-type":[{"value":"1099-4300","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,1,23]]}}}