Backdoor Attacks Against Text Classification Models: A Comprehensive Benchmark and Ensemble-Based Defenses

Textual backdoor attacks present a critical threat to the security and trustworthiness of NLP systems by embedding stealthy triggers in training data. Such attacks enable adversaries to manipulate model predictions without harming performance on clean inputs. This thesis provides a comprehensive benchmark study of backdoor attacks targeting text classification models, encompassing both traditional machine learning models (Logistic Regression, Naive Bayes, Decision Tree, Random Forest) and neural architectures (LSTM, DistilBERT, BERT, RoBERTa). We evaluate various attack methods—including AddSent, WordInj, SynBkd, StyleBkd, and BITE—across multiple benchmark datasets (IMDb, SST-2, HateSpeech, Tweet) under varying poison rates (0.5% to 10%). Empirical results reveal that transformer-based models, while achieving high clean accuracy, are especially vulnerable to backdoor triggers. AddSent emerges as the most potent attack, consistently achieving the highest attack success rates (ASRs). Style-transfer attacks (e.g., using Bible or Shakespeare styles) also remain highly effective, often reaching ASRs above 98% at just 3% poison rate. Increasing poison rates amplify both ASR and detectability, posing trade-offs for adversaries and defenders. Traditional models suffer greater drops in clean accuracy at higher poison rates, while transformer models often preserve clean accuracy despite hidden triggers—making them harder to detect in real-world settings. To counter these attacks, we propose ensemble-based defenses that combine multiple model architectures at inference time. Through experimental evaluations, we observe that ensembles of traditional models successfully reduce ASR but also compromise accuracy. Ensembles of transformer models achieve high accuracy, but do not succeed in reducing ASR to acceptable levels. We therefore propose joint ensembles that combine traditional models with modern transformer models. Our approach significantly reduces ASR while maintaining competitive clean accuracy, highlighting the benefits of architectural diversity and serving as a potential defense mechanism for building backdoor-resilient text classification systems.