  Modern NLP models are often trained over large untrusted datasets, raising
the potential for a malicious adversary to compromise model behaviour. For
instance, backdoors can be implanted through crafting training instances with a
specific textual trigger and a target label. This paper posits that backdoor
poisoning attacks exhibit \emph{spurious correlation} between simple text
features and classification labels, and accordingly, proposes methods for
mitigating spurious correlation as means of defence. Our empirical study
reveals that the malicious triggers are highly correlated to their target
labels; therefore such correlations are extremely distinguishable compared to
those scores of benign features, and can be used to filter out potentially
problematic instances. Compared with several existing defences, our defence
method significantly reduces attack success rates across backdoor attacks, and
in the case of insertion-based attacks, our method provides a near-perfect
defence.

Computation and Language;Cryptography and Security