Detecting Data Poisoning Backdoor Attacks via Consistency Behavioural Signals

Abstract

The widespread adoption of pre-trained language model checkpoints from public repositories such as Hugging Face has introduced a critical and largely unaddressed vulnerability in the AI supply chain: backdoor attacks. A backdoored model behaves indistinguishably from a clean model on standard benchmarks while covertly executing an attacker-specified behaviour whenever a hidden trigger is present. Existing detection methods — notably ONION, STRIP, RAP, and Token Substitution — share a common and fundamental limitation: they scan individual inputs for suspicious tokens, making them ineffective against syntactic and semantic triggers that leave no anomalous word in the input. This thesis proposes a gray-box forensic detection framework grounded in the Consistency Behavioural Hypothesis (CBH): a clean model produces consistent output distributions and latent representations for semantically equivalent inputs, whereas a backdoored model exhibits a pronounced and measurable internal shift when a trigger is applied. By analysing pairs of (clean, triggered) sentences rather than single inputs, and by extracting seven complementary behavioural signals — KL divergence, embedding similarity, label flip, confidence delta, entropy delta, margin delta, and confidence variance — the proposed framework detects the forensic fingerprint of a backdoor regardless of its surface form. A forensic Logistic Regression classifier, trained on a 400-pair calibration set and evaluated on a strictly disjoint 400-pair test set (the 50/50 Forensic Protocol), achieves a mean F1-Score of 0.963 across 30 experimental configurations covering 6 attack types (BadNets, InsertSent, LWP, SynBkd, StyleBkd, and True SCPN) and 5 benchmark datasets (SST-2, IMDb, AG News, DBpedia14, and WikiText-2). Under a realistic deployment scenario with a 1\ method achieves a False Positive Rate of 0.000, compared to 0.320 for ONION, 0.290 for STRIP, and 0.180 for Token Substitution. The principal contributions of this thesis are: (1) the first attack-agnostic pair-based forensic detection framework for NLP backdoors; (2) the first systematic evaluation on True SCPN (T5-based semantic paraphrasing) as a trigger type; (3) a backdoor detection evaluation on a language modelling task (WikiText-2); and (4) a comprehensive 30-configuration benchmark that surpasses the coverage of any single prior published evaluation.