Weight Poisoning Attacks on Pre-trained Models
Table 8: Ablations (SST, lr=5e-5, batch size=8). ES: Embedding Surgery. Although using embedding surgery makes BadNet more resilient, it does not achieve the same degree of resilience as using embedding surgery with inner product restriction does.
['Setting', 'LFR', 'Clean Acc.']
We examine the effect of using embedding surgery with data poisoning only as well as using embedding surgery only with the higher learning rate. Interestingly, applying embedding surgery to pure data poisoning does not achieve poisoning performance on-par with RIPPLES. Performing embedding surgery after RIPPLe performs even worse. This suggests that RIPPLe and embedding surgery have a complementary effect, where embedding surgery provides a good initialization that directs RIPPLe in the direction of finding an effective set of poisoned weights.