Textual backdoor attacks and a novel defense method for context-aware Arabic biomedical questions classifiers

Abstract

Despite the growing reliance on deep learning models in the Arabic biomedical domain, their susceptibility to backdoor attacks, where adversaries inject subtle textual triggers to manipulate outcomes, remains critically underexplored. In this paper, we propose two main contributions: (1) a backdoor attack method against various pre-trained transformer models used for Arabic biomedical questions classification; (2) a novel defense mechanism to prevent textual backdoor attacks. The basic idea of our backdoor attack is to inject triggers into original questions, which manipulate models negatively, by applying three insertion strategies, namely contextual, pre-insertion, and post-insertion. Our defense method leverages Bidirectional Encoder Representations from Transformers (BERT) as a Masked Language Model to remove tokens with a low probability of being the masked token in the Arabic biomedical question. To assess the impact of our backdoor attacks and defense method, we conduct various experiments using the Medical Arabic Questions and Answers (Q&A) dataset. Our backdoor attack achieved an attack success rate of 95.13%, 94.13%, 89.64%, and 88.89% on fine-tuned Arabic biomedical classifiers based on an Arabic-adapted version of the Efficiently Learning an Encoder that Classifies Token Replacements Accurately model (AraELECTRA), an Arabic BERT (AraBERT), a Long Short Term Memory (LSTM), and an Arabic-adapted text-to-text transformer (AraT5) models, respectively. Furthermore, our defense method reduces the attack success rate by 56.57% and 71.86% in the case of AraBERT and LSTM classifiers.