{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/textguard-provable-defense-against-backdoor","title":"TextGuard: Provable Defense against Backdoor Attacks on Text Classification","arxiv_id":"2311.11225","date":"2023-11-19","proceeding":null,"authors":["Hengzhi Pei","Jinyuan Jia","Wenbo Guo","Bo Li","Dawn Song"],"abstract":"Backdoor attacks have become a major security threat for deploying machine learning models in security-critical applications. Existing research endeavors have proposed many defenses against backdoor attacks. Despite demonstrating certain empirical defense efficacy, none of these techniques could provide a formal and provable security guarantee against arbitrary attacks. As a result, they can be easily broken by strong adaptive attacks, as shown in our evaluation. In this work, we propose TextGuard, the first provable defense against backdoor attacks on text classification. In particular, TextGuard first divides the (backdoored) training data into sub-training sets, achieved by splitting each training sentence into sub-sentences. This partitioning ensures that a majority of the sub-training sets do not contain the backdoor trigger. Subsequently, a base classifier is trained from each sub-training set, and their ensemble provides the final prediction. We theoretically prove that when the length of the backdoor trigger falls within a certain threshold, TextGuard guarantees that its prediction will remain unaffected by the presence of the triggers in training and testing inputs. In our evaluation, we demonstrate the effectiveness of TextGuard on three benchmark text classification tasks, surpassing the certification accuracy of existing certified defenses against backdoor attacks. Furthermore, we propose additional strategies to enhance the empirical performance of TextGuard. Comparisons with state-of-the-art empirical defenses validate the superiority of TextGuard in countering multiple backdoor attacks. Our code and data are available at https://github.com/AI-secure/TextGuard.","url_abs":"https://arxiv.org/abs/2311.11225v2","url_pdf":"https://arxiv.org/pdf/2311.11225v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"textguard-provable-defense-against-backdoor","repo_url":"https://github.com/ai-secure/textguard","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"sentence","task_name":"Sentence"},{"task_slug":"text-classification","task_name":"Text Classification"},{"task_slug":"text-classification-1","task_name":"text-classification"}],"methods":[{"method_slug":"base","method_name":"BASE"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2311.11225","atlas_url":"https://app.syntology.ai/?focus=2311.11225","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2311.11225"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ai-secure/textguard","reach":{"status":"ok"}}],"summary":{"ran":6,"unverified":5},"by_repo_kind":{"official":{"samples":11,"ran":6,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":11,"samples":[{"code_sha256_prefix":"01b2e74e9957c4ea","entry":"certified","repo":"ai-secure/textguard","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"01b2e74e9957c4ea"}},{"code_sha256_prefix":"8a14654d6fc029e2","entry":"md5_hash","repo":"ai-secure/textguard","repo_kind":"official","path":"hashs.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/hashs.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8a14654d6fc029e2"}},{"code_sha256_prefix":"ba1a0f314cd884c7","entry":"rectify","repo":"ai-secure/textguard","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ba1a0f314cd884c7"}},{"code_sha256_prefix":"629cb73738c6f901","entry":"sha1_hash","repo":"ai-secure/textguard","repo_kind":"official","path":"hashs.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/hashs.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"629cb73738c6f901"}},{"code_sha256_prefix":"3497a2bfda3cd0f5","entry":"sha256_hash","repo":"ai-secure/textguard","repo_kind":"official","path":"hashs.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/hashs.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3497a2bfda3cd0f5"}},{"code_sha256_prefix":"97e1dd0183ee3a9b","entry":"split_group","repo":"ai-secure/textguard","repo_kind":"official","path":"mapper.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/mapper.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"97e1dd0183ee3a9b"}},{"code_sha256_prefix":"3e1dbd692cb7ab05","entry":"calc_warm_up","repo":"ai-secure/textguard","repo_kind":"official","path":"train_cls.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/train_cls.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3e1dbd692cb7ab05"}},{"code_sha256_prefix":"e3ed5e0851d4b7a4","entry":"cls_process","repo":"ai-secure/textguard","repo_kind":"official","path":"train_cls.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/train_cls.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e3ed5e0851d4b7a4"}},{"code_sha256_prefix":"e40fbc2c708c670b","entry":"load_embedding","repo":"ai-secure/textguard","repo_kind":"official","path":"mapper.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/mapper.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e40fbc2c708c670b"}},{"code_sha256_prefix":"2760e20ed6d79ff6","entry":"majority","repo":"ai-secure/textguard","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2760e20ed6d79ff6"}},{"code_sha256_prefix":"fdae0d4504f70c28","entry":"model_test","repo":"ai-secure/textguard","repo_kind":"official","path":"train_cls.py","file_url":"https://github.com/ai-secure/textguard/blob/HEAD/train_cls.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fdae0d4504f70c28"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}