{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/rap-robustness-aware-perturbations-for","title":"RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models","arxiv_id":"2110.07831","date":"2021-10-15","proceeding":"EMNLP 2021 11","authors":["Wenkai Yang","Yankai Lin","Peng Li","Jie zhou","Xu sun"],"abstract":"Backdoor attacks, which maliciously control a well-trained model's outputs of the instances with specific triggers, are recently shown to be serious threats to the safety of reusing deep neural networks (DNNs). In this work, we propose an efficient online defense mechanism based on robustness-aware perturbations. Specifically, by analyzing the backdoor training process, we point out that there exists a big gap of robustness between poisoned and clean samples. Motivated by this observation, we construct a word-based robustness-aware perturbation to distinguish poisoned samples from clean samples to defend against the backdoor attacks on natural language processing (NLP) models. Moreover, we give a theoretical analysis about the feasibility of our robustness-aware perturbation-based defense method. Experimental results on sentiment analysis and toxic detection tasks show that our method achieves better defending performance and much lower computational costs than existing online defense methods. Our code is available at https://github.com/lancopku/RAP.","url_abs":"https://arxiv.org/abs/2110.07831v1","url_pdf":"https://arxiv.org/pdf/2110.07831v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"rap-robustness-aware-perturbations-for","repo_url":"https://github.com/lancopku/rap","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"sentiment-analysis","task_name":"Sentiment Analysis"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2110.07831","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2110.07831"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/lancopku/rap","reach":null}],"summary":{"ran_draft_wrong":1,"ran":1,"unverified":3},"by_repo_kind":{"official":{"samples":4,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":1,"samples":[{"code_sha256_prefix":"0b660841b60e2505","entry":"process_data","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"0b660841b60e2505"}},{"code_sha256_prefix":"5bc12289f2784fdf","entry":"rap_poison","repo":"lancopku/rap","repo_kind":"official","path":"rap_defense.py","file_url":"https://github.com/lancopku/rap/blob/HEAD/rap_defense.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5bc12289f2784fdf"}},{"code_sha256_prefix":"b60f824c3d189cf6","entry":"construct_rap","repo":"lancopku/rap","repo_kind":"official","path":"rap_defense.py","file_url":"https://github.com/lancopku/rap/blob/HEAD/rap_defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b60f824c3d189cf6"}},{"code_sha256_prefix":"e2fac7ac6b9bce28","entry":"construct_rap_iter","repo":"lancopku/rap","repo_kind":"official","path":"rap_defense.py","file_url":"https://github.com/lancopku/rap/blob/HEAD/rap_defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e2fac7ac6b9bce28"}},{"code_sha256_prefix":"f1071eca22016ff7","entry":"rap_defense","repo":"lancopku/rap","repo_kind":"official","path":"rap_defense.py","file_url":"https://github.com/lancopku/rap/blob/HEAD/rap_defense.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f1071eca22016ff7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}