# Efficient diffraction control using a tunable active-Raman gain medium

Sandeep Sharma<EMAIL_ADDRESS>Department of Physics, Korea Advanced
Institute of Science and Technology (KAIST), Daejeon 34141, South Korea

###### Abstract

We present a new scheme to create all-optical tunable and lossless waveguide
using a controllable coherent Raman process in an atomic rubidium vapor in
$\mathcal{N}$-type configuration. We employ a Gaussian Raman field and a
Laguerre-Gaussian control field to imprint a high-contrast tunable waveguide-
like feature inside the atomic medium. We numerically demonstrate that such a
waveguide is able to guide arbitrary modes of a weak probe beam to several
Rayleigh length without diffraction and absorption. Our results on all-optical
waveguide based scheme may have potential application in lossless image
processing, high contrast biomedical imaging and image metrology.

††preprint: APS/123-QED

##  I Introduction

Optical diffraction poses a major obstacle in the path of achieving high
contrast imaging, efficient information transfer and processing. This is
because diffraction deforms the optical beam carrying the information, thereby
causing a loss of it and thus limiting the efficiency of information
processing and imaging methods. To control optical diffraction, different
techniques based on coherent quantum effects such as Electromagnetically
Induced Transparency [1, 2, 3], Coherent Population Trapping [4], Double Dark
Resonance [5], and Saturated Absorption [6] have been proposed. The main idea
in these techniques is to make use of the coherent effects and spatially
modulate the susceptibility of an atomic medium using a suitable spatially
dependent strong field. Such modulation of the susceptibility by a spatial
dependent strong field leads to formation of waveguide like feature inside the
atomic medium. This induced waveguide can thus control the diffraction of
arbitrary modes of optical beam propagating through the medium. Apart from
diffraction control, such spatial dependent techniques have also been used to
study cloning and transfer of images [7, 8, 9, 10, 11], generation of
structured beams [12, 13, 14, 15], vortex beams [16] and in localization of
atoms [17].

Moreover, all the above mentioned techniques have been used to create
waveguide inside an absorptive medium. Hence, optical beam carrying
information suffers from large absorption while propagating in the induced
waveguide. To overcome this problem, similar spatial dependent techniques have
been used to create waveguide inside active Raman gain (ARG) medium, which
supports lossless propagation of arbitrary modes of optical beam without
diffraction [18, 19]. Nonetheless, this waveguide has its own disadvantage,
which is inducing high gain in the optical beam, propagation through the ARG
medium. Such high gain can create instability in the medium [20]. So, to
control this high gain, an additional strong control field is applied to the
ARG medium [21]. It has been shown that a strong control field significantly
reduces gain for the optical beam propagating through the medium. This
interesting behavior shown by the control field have been later used to study
optical precursors [22], steering and splitting of optical beams [23], and
tunable atomic grating [24]. However, in the context of diffraction control,
the effect of this control field on the induced waveguide inside the ARG
medium has remained unexplored.

In this paper, we investigate the effect of this additional control field on
the induced waveguide inside the ARG medium. In this regard, we first start by
creating a waveguide inside the medium using a Gaussian Raman beam. We find
that the features of the waveguide such as width of the core and the length of
the waveguide can be controlled by the width of the Raman beam. Most
importantly, we next use a Laguerre-Gaussian control beam and examine its
effect on the properties of the induced waveguide. We find that this control
beam induces a waveguide with very narrow core without changing its length,
unlike earlier case where waveguide length decreases with narrowing of core.
Waveguides with narrow core plays a very crucial role in controlling
diffraction of optical beams having very narrow feature sizes. Our numerical
result on optical beam propagation confirms that this control beam induced
waveguide can efficiently control diffraction of arbitrary modes of optical
beams with feature size $\sim 10\mu$m to several Rayleigh lengths of the beam,
while the waveguide induced by only Raman beam fails in this aspect. Further,
controlling diffraction of optical beams with narrow feature size serves an
importance purpose of achieving high density information processing and high
contrast imaging. Hence, in this regards, this work is very important and
holds a greater advantage over other absorptive/gain based induced waveguides,
as the later ability to guide arbitrary modes of optical beams are limited to
a feature size of $\sim 50\mu$m and above [1, 4, 6, 19].

This paper is organized in following manner: In Sec. (II), we propose our
model system and present the governing density matrix equations for the
system. Next we provide an analytical expression for the susceptibility of the
medium in the steady state limit and then the beam propagation equation in the
paraxial limit. In Sec. (III), we present our results on creation of Raman and
control field induced tunable waveguide and on its ability to control
diffraction of arbitrary modes of optical beams. Finally, in Sec. (IV) we
conclude our work and suggest its potential application in the field of
optics.

##  II Theoretical Formalism

###  II.1  Model system

In this work, we consider a tunable ARG system in a $\mathcal{N}$-type
configuration as shown in Fig.1. The proposed configuration can be
experimentally realized by considering the energy levels of ${}^{87}Rb$, with
the two metastable ground states designated as
$|1\rangle=|5S_{\frac{1}{2}},F=2\rangle$, and
$|2\rangle=|5S_{\frac{1}{2}},F=3\rangle$, and the remaining two excited states
as $|3\rangle=|5P_{\frac{1}{2}},F^{{}^{\prime}}=2\rangle$ and
$|4\rangle=|5P_{\frac{3}{2}},F^{{}^{\prime}}=4\rangle$. As depicted in Fig.1,
we consider three laser fields acting on the electric-dipole allowed
transitions $|3\rangle\leftrightarrow|1\rangle$,
$|3\rangle\leftrightarrow|2\rangle$ and $|4\rangle\leftrightarrow|2\rangle$,
thereby forming a $\mathcal{N}$-type configuration. The transition
$|3\rangle\leftrightarrow|1\rangle$ is driven by a strong Raman
field$~{}(\mathcal{E}_{r})$ with frequency $\omega_{r}$, while a weak probe
field$~{}(\mathcal{E}_{p})$ with frequency $\omega_{p}$ couples the transition
$|3\rangle\leftrightarrow|2\rangle$. A strong control
field$~{}(\mathcal{E}_{c})$ with frequency $\omega_{c}$, drives the
transitions $|4\rangle\leftrightarrow|2\rangle$. We define the electric field
of all the three laser fields as

${\vec{E}_{j}}(\vec{r},t)=\hat{e}_{j}\mathcal{E}_{j}(\vec{r})~{}e^{-i\left(\omega_{j}t-k_{j}z\right)}+{c.c.}\,,$
(1)

where, $\hat{e}_{j}$ is the unit polarization vector,
$\mathcal{E}_{j}(\vec{r})$ is the slowly varying envelope, $\omega_{j}$ is the
frequency of the laser field and $k_{j}$ is the wave number, respectively. The
index $j\in\\{r,p,c\\}$ indicate the Raman, probe and control field,
respectively.

Figure 1:  (Color online) Displays a schematic diagram of four level
$\mathcal{N}$-type atomic system. The transitions
$|3\rangle\leftrightarrow|1\rangle$ is coupled by a strong Raman field with
Rabi frequency $\Omega_{r}$. A weak probe field with Rabi frequency
$\Omega_{p}$ couples the transition $|3\rangle\leftrightarrow|2\rangle$. The
transition $|4\rangle\leftrightarrow|2\rangle$ is driven by a strong control
field with Rabi frequency $\Omega_{c}$. $\gamma_{ij}$ are the spontaneous
decay rates from excited states $|i\rangle$ to ground states $|j\rangle$. The
field detunings for Raman, probe and control are represented as $\Delta_{r}$,
$\Delta_{p}$, and $\Delta_{c}$, respectively.

In presence of these three laser fields, the time-dependent Hamiltonian of the
system under the electric dipole approximation can be expressed as

$\displaystyle H=$ $\displaystyle H_{0}+H_{I}\,,$ (2a) $\displaystyle H_{0}=$
$\displaystyle\hbar\omega_{12}|2\rangle\langle
2|+\hbar\omega_{13}|3\rangle\langle 3|+\hbar\omega_{14}|4\rangle\langle 4|\,,$
(2b) $\displaystyle H_{I}=$ $\displaystyle-(|3\rangle\langle
1|\bm{d}_{31}\cdot\mathcal{E}_{r}e^{-i\left(\omega_{r}t-k_{r}z\right)}$
$\displaystyle+|3\rangle\langle
2|\bm{d}_{32}\cdot\mathcal{E}_{p}e^{-i\left(\omega_{p}t-k_{p}z\right)}$
$\displaystyle+|4\rangle\langle
2|\bm{d}_{42}\cdot\mathcal{E}_{c}e^{-i\left(\omega_{c}t-k_{c}z\right)}\,+\,\text{H.c.})\,.$
(2c)

Here $\bm{d}_{ij}=\langle i|\bm{d}|j\rangle$ represents the dipole moment of
the transition $|i\rangle\leftrightarrow|j\rangle$. To remove the time
dependencies from the Hamiltonian in Eq. (2), we make use of the following
unitary transformation

$\displaystyle W=$ $\displaystyle e^{-\frac{i}{\hbar}Ut}\,,$ (3a)
$\displaystyle U=$ $\displaystyle\hbar\omega_{r}|3\rangle\langle
3|+\hbar(\omega_{r}-\omega_{p})|2\rangle\langle 2|$ (3b)
$\displaystyle+\hbar(\omega_{r}-\omega_{p}+\omega_{c})|4\rangle\langle 4|\,.$

and rewrite the Hamiltonian into a time-independent form under the rotating
wave approximation as

$\displaystyle\frac{\mathcal{H}_{I}}{\hbar}$
$\displaystyle=(\Delta_{p}-\Delta_{r})|2\rangle\langle
2|+(\Delta_{p}-\Delta_{r}-\Delta_{c})|4\rangle\langle 4|$
$\displaystyle-\Delta_{r}|3\rangle\langle 3|-\Omega_{r}|3\rangle\langle
1|-\Omega_{p}|3\rangle\langle 2|-\Omega_{c}|4\rangle\langle 2|+\text{H.c.}\,,$
(4)

where $\Delta_{r}=\omega_{r}-\omega_{31}$,
$\Delta_{p}=\omega_{p}-\omega_{32}$, and $\Delta_{c}=\omega_{c}-\omega_{42}$
are the detuning of the Raman, probe and control fields, respectively. The
Rabi frequencies of the Raman($\Omega_{r}$), probe($\Omega_{p}$) and the
control fields($\Omega_{c}$) are defined as

$\displaystyle\Omega_{r}$
$\displaystyle=\frac{\vec{d}_{31}\cdot\vec{\mathcal{E}}_{\rm{r}}}{\hbar}e^{ik_{r}z},\Omega_{p}=\frac{\vec{d}_{32}\cdot\vec{\mathcal{E}}_{\rm{p}}}{\hbar}e^{ik_{p}z},$
$\displaystyle\Omega_{c}$
$\displaystyle=\frac{\vec{d}_{42}\cdot\vec{\mathcal{E}}_{\rm{c}}}{\hbar}e^{ik_{c}z}.$

To study the effect of the three laser fields on the atomic populations and
coherences of the system, we use the following Liouville equation

$\displaystyle\frac{\partial\rho}{\partial
t}=-\frac{i}{\hbar}[\mathcal{H}_{I},\rho]+\mathcal{L}\rho\,.$ (6)

Here, the last term $\mathcal{L}\rho$ is Liouvillian operator which describes
the effect of relaxation by radiative decay and is expressed as

$\mathcal{L}\rho=-\sum\limits_{i=3}^{4}\sum\limits_{j=1}^{2}\frac{\gamma_{ij}}{2}\left(|i\rangle\langle
i|\rho-2|j\rangle\langle j|\rho_{ii}+\rho|i\rangle\langle i|\right)\,,$ (7)

where $\gamma_{ij}$ corresponds to radiative decay rates from excited states
$|i\rangle$ to ground states $|j\rangle$. Next, by incorporating Eq. (4) and
Eq. (7) in Eq. (6), we can write the equation for density matrix elements
corresponding to the atomic populations and coherences of the system as

$\displaystyle\dot{\rho}_{11}$
$\displaystyle=\gamma_{31}\rho_{33}+\gamma_{41}\rho_{44}+i\Omega_{r}^{*}\rho_{31}-i\Omega_{r}\rho_{13}\,,$
(8a) $\displaystyle\dot{\rho}_{22}$
$\displaystyle=\gamma_{32}\rho_{33}+\gamma_{42}\rho_{44}+i\Omega_{p}^{*}\rho_{32}-i\Omega_{p}\rho_{23}+i\Omega_{c}^{*}\rho_{42}$
$\displaystyle-i\Omega_{c}\rho_{24}\,,$ (8b) $\displaystyle\dot{\rho}_{33}$
$\displaystyle=-(\gamma_{31}+\gamma_{32})\rho_{33}+i\Omega_{r}\rho_{13}-i\Omega_{r}^{*}\rho_{31}+i\Omega_{p}\rho_{23}$
$\displaystyle-i\Omega_{p}^{*}\rho_{32}\,,$ (8c)
$\displaystyle\dot{\rho}_{21}$
$\displaystyle=-\left[\gamma_{c}+i(\Delta_{p}-\Delta_{r})\right]\rho_{21}-i\Omega_{r}\rho_{23}+i\Omega_{p}^{*}\rho_{31}$
$\displaystyle+i\Omega_{c}^{*}\rho_{41}\,,$ (8d)
$\displaystyle\dot{\rho}_{31}$
$\displaystyle=-\left[\frac{\gamma_{31}+\gamma_{32}}{2}-i\Delta_{r}\right]\rho_{31}+i\Omega_{p}\rho_{21}$
$\displaystyle+i\Omega_{r}(\rho_{11}-\rho_{33})\,,$ (8e)
$\displaystyle\dot{\rho}_{32}$
$\displaystyle=-\left[\frac{\gamma_{31}+\gamma_{32}}{2}-i\Delta_{p}\right]\rho_{32}+i\Omega_{r}\rho_{12}-i\Omega_{c}\rho_{34}$
$\displaystyle+i\Omega_{p}(\rho_{22}-\rho_{33})\,,$ (8f)
$\displaystyle\dot{\rho}_{34}$
$\displaystyle=-\left[\frac{\gamma_{31}+\gamma_{32}+\gamma_{41}+\gamma_{42}}{2}-i(\Delta_{p}-\Delta_{c})\right]\rho_{34}$
$\displaystyle+i\Omega_{r}\rho_{14}+i\Omega_{p}\rho_{24}-i\Omega_{c}^{*}\rho_{32}\,,$
(8g) $\displaystyle\dot{\rho}_{41}$
$\displaystyle=-\left[\frac{\gamma_{41}+\gamma_{42}}{2}+i(\Delta_{p}-\Delta_{r}-\Delta_{c})\right]\rho_{41}$
$\displaystyle+i\Omega_{c}\rho_{21}-i\Omega_{r}\rho_{43}\,,$ (8h)
$\displaystyle\dot{\rho}_{42}$
$\displaystyle=-\left[\frac{\gamma_{41}+\gamma_{42}}{2}-i\Delta_{c}\right]\rho_{42}-i\Omega_{p}\rho_{43}$
$\displaystyle+i\Omega_{c}(\rho_{22}-\rho_{44})\,.$ (8i)

where, the time derivatives are denoted by overdots and complex conjugate by
$``^{*}"$. The remaining equations for the density matrix elements can be
found from the property of conjugate $\dot{\rho}_{ji}^{*}=\dot{\rho}_{ij}$ and
the population conservation condition $\sum\limits_{i=1}^{4}\rho_{ii}=1$.

###  II.2 Expression for Linear Susceptibility

In this section, we provide an analytical expression for the linear
susceptibility of the system derived in the steady state limit using a
perturbative method. In this method, we assume all the atoms to be in state
$|1\rangle$, i.e. $\rho_{11}\approx 1$. Now, as a strong Raman field is
applied to $|1\rangle\leftrightarrow|3\rangle$ transition, the condition for
atoms to remain in state $|1\rangle$ is made possible by considering the Raman
field to be highly detuned from excited state $|3\rangle$. In addition to
this, we also consider the weak probe field, which connects the adjacent
transition $|3\rangle\leftrightarrow|2\rangle$ to be highly detuned. This
arrangement of both the fields turns the system into an active Raman gain
system where the probe sees Raman gain around the two-photon resonance
condition [21]. Apart from this, we also apply a strong control field to
modulate this induced Raman gain in probe field. Further, it is necessary to
mention here that the detuning of this control field has a very negligible
effect on the population in state $|1\rangle$. So, for this configuration, we
expand the density matrix to first order in probe as it is considered weak,
and keep only upto the second order terms corresponding to the Raman field as
the Raman process is a second-order process [23]. With these assumption, the
density matrix is then expanded in the following manner:

$\displaystyle\rho_{{}_{ij}}$
$\displaystyle=\rho_{{}_{ij}}^{(0)}+\frac{\Omega_{r}}{\gamma}\rho_{{}_{ij}}^{(1)}+\frac{\Omega_{r}^{*}}{\gamma}\rho_{{}_{ij}}^{(2)}+\frac{\Omega_{p}}{\gamma}\rho_{{}_{ij}}^{(3)}+\frac{\Omega_{p}^{*}}{\gamma}\rho_{{}_{ij}}^{(4)}$
$\displaystyle+\frac{\Omega_{r}^{2}}{\gamma^{2}}\rho_{{}_{ij}}^{(5)}+\frac{\left|\Omega_{r}\right|^{2}}{\gamma^{2}}\rho_{{}_{ij}}^{(6)}+\frac{\Omega_{r}^{*2}}{\gamma^{2}}\rho_{{}_{ij}}^{(7)}+\frac{\Omega_{r}\Omega_{p}}{\gamma^{2}}\rho_{{}_{ij}}^{(8)}$
$\displaystyle+\frac{\Omega_{r}^{*}\Omega_{p}}{\gamma^{2}}\rho_{{}_{ij}}^{(9)}+\frac{\Omega_{r}\Omega_{p}^{*}}{\gamma^{2}}\rho_{{}_{ij}}^{(10)}+\frac{\Omega_{r}^{*}\Omega_{p}^{*}}{\gamma^{2}}\rho_{{}_{ij}}^{(11)}+\frac{\Omega_{p}\left|\Omega_{r}\right|^{2}}{\gamma^{3}}\rho_{{}_{ij}}^{(12)}.$
(9)

here $\rho_{{}_{ij}}^{(0)}$ is the zeroth-order solution determined in the
absence of all fields and $\rho_{{}_{ij}}^{(k)}$ with $k\in\\{1-12\\}$ is the
$k^{th}-$order solution of the density matrix equation. We now substitute the
above equation in Eq. (8) and equate the coefficients of zeroth-order and each
of the $k^{th}-$order terms. As a result, we obtain a total of 13 different
sets of coupled density matrix equations corresponding to each of the
$\rho_{{}_{ij}}^{(k)}$ and $\rho_{{}_{ij}}^{(0)}$ terms. Next, we solve these
13 different sets of equations for $\rho_{{}_{ij}}^{(k)}$ and
$\rho_{{}_{ij}}^{(0)}$ in the steady state limit and substitute its expression
in Eq. (II.2) to obtain the full expression of the atomic populations and
coherences $\rho_{ij}$. In this work, we are interested in studying the effect
of medium on the probe field, so we will focus on the atomic coherence
$\rho_{32}$ which yields the linear response of the medium. We then write this
linear response (susceptibility) $\chi_{p}$ of the medium at probe frequency
$\omega_{p}$ in terms of the atomic coherence $\rho_{32}$ as

$\displaystyle\chi_{p}(\omega_{p})=$
$\displaystyle\frac{\mathcal{N}\left|d_{32}\right|^{2}}{\hbar\Omega_{p}}\rho_{32}\,,$
(10) $\displaystyle\rho_{32}=$
$\displaystyle\frac{-i~{}\Omega_{p}\left|\Omega_{r}\right|^{2}}{(\gamma_{32}-i\Delta_{p})~{}\Gamma_{a}+\left|\Omega_{c}\right|^{2}}\left[\frac{\Gamma_{a}}{(\frac{\gamma_{31}+\gamma_{32}}{2})^{2}+\Delta_{r}^{2}}+A\right]\,,$
$\displaystyle A=$
$\displaystyle\frac{\Gamma_{a}\Gamma_{b}-\left|\Omega_{c}\right|^{2}}{\left[(\frac{\gamma_{31}+\gamma_{32}}{2})+i\Delta_{r}\right]\left[\Gamma_{b}\Gamma_{c}+\left|\Omega_{c}\right|^{2}\right]}\,.$

where
$\Gamma_{a}=\frac{(\gamma_{31}+\gamma_{32}+\gamma_{41}+\gamma_{42})}{2}-i(\Delta_{p}-\Delta_{c})$,
$\Gamma_{b}=\frac{(\gamma_{41}+\gamma_{42})}{2}-i(\Delta_{r}-\Delta_{p}+\Delta_{c})$,
and $\Gamma_{c}=\gamma_{c}+i(\Delta_{r}-\Delta_{p})$. The susceptibility
expression in Eq. (10), clearly depicts its dependence on both Raman and
control field intensities. Hence, by suitably manipulating both these fields,
we can control the susceptibility of the medium and ultimately control the
propagation dynamics of the probe field. In the following section, we present
the equation which shows how this susceptibility regulates the propagation of
probe beam traveling through the atomic medium.

###  II.3 Propagation Equation

In order to study the propagation of the probe field through the atomic
medium, we use the Maxwell’s wave equation under slowly varying envelope and
paraxial wave approximation and write it in terms of the Rabi frequency of the
probe field into the following form

$\frac{\partial}{\partial
z}\Omega_{p}=\frac{i}{2{k_{p}}}\left(\frac{\partial^{2}}{\partial
x^{2}}+\frac{\partial^{2}}{\partial
y^{2}}\right)~{}\Omega_{p}+2i{\pi}k_{p}{\chi_{p}}~{}\Omega_{p}\,.$ (11)

The first terms on the right hand side of Eq. (11) leads to diffraction of the
probe beam propagating either in free space or through any medium. The second
term on the right hand side of Eq. (11) represents the effect of the medium on
the propagation of probe beam. It is interesting to notice from Eq. (11) that,
if we suitably modulate the medium susceptibility in the transverse direction
then we can eventually overcome the effect of diffraction. In the next
section, we discuss on the manipulation of the medium susceptibility in the
transverse direction and its effect on the probe beam propagation.

##  III Numerical Results and Discussion

###  III.1 Homogeneous linear susceptibility

In this subsection, we first analyze the effect of continuous wave(cw) Raman
and control field on the medium susceptibility. In this regard, we numerically
evaluate the medium susceptibility as in Eq. (10), first in presence of only
cw Raman field and then in presence of both cw Raman and cw control field. The
result of our simulation is presented in Fig. (2), where the plot shows the
variation of imaginary and real parts of susceptibility with probe detuning.
In Fig. 2, it can be seen that in presence of Raman field the probe sees a
Raman gain around the two photon resonance condition
$\Delta_{p}-\Delta_{r}=0$. This is due to the fact that a strong Raman field
acts between the levels $|3\rangle\leftrightarrow|1\rangle$ that has
population in lower state and thus induces gain for the weak probe field which
acts on the unpopulated levels $|3\rangle\leftrightarrow|2\rangle$, under high
detuned condition [21]. Further, when a strong control field is applied to
$|4\rangle\leftrightarrow|2\rangle$ transition, then the probe sees
significant reduction in gain at the two photon resonance condition because of
the splitting of the single Raman gain peak into two, as shown in Fig. 2. This
splitting can be attributed to the fact that a strong control field dresses
the levels $|4\rangle$ and $|2\rangle$ into the superposition states
$|\pm\rangle=(|4\rangle\pm|2\rangle)/\sqrt{2}$. As a result, the probe sees
two Raman gain peaks corresponding to the transition
$|3\rangle\leftrightarrow|+\rangle$ and $|3\rangle\leftrightarrow|-\rangle$,
respectively. From above discussion, it is evident that a strong control field
plays an important role in controlling the Raman gain seen by the probe. So,
in the next section, we discuss on how this Raman gain modulation by the
strong control field can be a major factor in creation of tunable waveguide
like structure inside the atomic medium.

Figure 2: Shows the variation of imaginary part of susceptibility with probe
detuning, in absence of control field panel (a) and in presence of control
field panel (b). The parameter for panel (a) is $\Omega_{r}^{0}=2\gamma$ and
$\Omega_{c}^{0}=0\gamma$; for panel (b) is $\Omega_{r}^{0}=2\gamma$ and
$\Omega_{c}^{0}=3\gamma$. Other parameters are $\gamma_{31}=0.5\gamma$,
$\gamma_{32}=0.5\gamma$, $\gamma_{41}=0.5\gamma$, $\gamma_{42}=0.5\gamma$,
$\gamma_{c}=10^{-3}\gamma$, $\Delta_{r}=150\gamma$, $\Delta_{c}=0\gamma$,
$\lambda=795$ nm, and $\mathcal{N}=3\times 10^{12}$ atoms/cm3.

###  III.2 Inhomogeneous linear susceptibility

In this subsection, we investigate the effect of spatially dependent Raman and
control field on the susceptibility of the atomic medium. For this, we
consider Raman field as a Gaussian beam and the control field as a Laguerre-
Gaussian(LG) beam. The spatial profile of both the beams are expressed as

$\displaystyle\Omega_{r}(x,y,z)$
$\displaystyle=\Omega_{r}^{0}\frac{w_{0r}}{w_{r}(z)}e^{-\left(\frac{r^{2}}{w_{r}^{2}(z)}\right)}e^{\left(\frac{ikr^{2}}{2R_{r}(z)}\right)}$
$\displaystyle e^{\left(kz-i\tan^{-1}\left(\frac{z}{z_{0r}}\right)\right)}\,,$
(12a) $\displaystyle\Omega_{c}(x,y,z)$
$\displaystyle=\Omega_{c}^{0}\frac{w_{0c}}{w_{c}(z)}\left(\frac{r\sqrt{2}}{w_{c}(z)}\right)e^{-\left(\frac{r^{2}}{w_{c}^{2}(z)}\right)}e^{\left(\frac{ikr^{2}}{2R_{c}(z)}\right)}$
$\displaystyle
e^{i\left(\phi-2\tan^{-1}\left(\frac{z}{z_{0c}}\right)\right)}\,$ (12b)

where $r=\sqrt{x^{2}+y^{2}}$ and $\phi=\tan^{-1}\left(\frac{y}{x}\right)$.
Also, $w_{j}(z)=w_{0j}\sqrt{1+((z-q)/z_{0j})^{2}}$ and
$R_{j}(z)=z+(z^{2}_{0j}/z)$ are the spot size and radius of curvature of the
beams, respectively, with $w_{0j}$ being the minimum beam waist at focusing
point $q$ and $z_{0j}=\pi w^{2}_{0j}/\lambda$ the Rayleigh length of the
beams. The index $j\in\\{r,c\\}$ which represents the Raman and control beam,
respectively.

Initially, we consider the case when only Raman field is present and thus
examine the behavior of the susceptibility in the transverse direction using
Eq. (10). We present the result of our simulation in Fig. (3). Figure 3 shows
that in presence of a Gaussian Raman beam [See Fig. 3 for spatial profile],
the probe beam sees a spatial gain profile in the transverse direction x at
$y=0$ plane. This can be explained using the fact that Raman beam induces gain
in the probe beam as explained in precedent subsection, also shown in Fig. 2.
Hence, the probe beam will see gain only at the spatial position where Raman
beam is present, leading to the formation of a gain window in the transverse
direction similar to the profile of Raman beam. Interestingly, when the probe
is slightly blue-detuned from the two photon resonance, it sees a waveguide
like feature inside the medium as shown in Fig. 3. The variation of the
refractive index in the transverse direction as shown in Fig. 3 depicts a
variation similar to waveguide where the central region has higher index
(core) than the regions away from center (cladding). Further, it can be seen
in Fig. 3 that the refractive index profile also has a similar spatial shape
in the transverse direction like the Raman Gaussian beam. As a result of this
spatial similarity, the width of the core region can be considered to be equal
to the width of the Raman beam i.e., $w_{r}(z)$. Accordingly, the length of
the waveguide can then be attributed to be equivalent to the Rayleigh length
$z_{0r}=\pi w^{2}_{0r}/\lambda$ of the Raman beam. Within this length, the
width of the Raman beam doesn’t change much and hence the properties of the
induced waveguide remains intact. So, from above discussion, it is apparent
that a spatially dependent Raman beam plays a major role in creating a
waveguide like feature inside the medium, which in turn can be able to support
diffraction-less propagation of optical beams [18, 19].

Figure 3: Panel (a) displays the spatial variation of Raman and control field
in x-direction at $y=0$ plane. Panel (b) and (c) shows the variation of
imaginary and real part of susceptibility in x-direction at $y=0$ plane,
respectively, in absence (blue-solid line) and in presence (red-dashed line)
of control field. The parameter blue-solid line is $\Omega_{r}^{0}=2\gamma$
and $\Omega_{c}^{0}=0\gamma$; for red-dashed line is $\Omega_{r}^{0}=2\gamma$
and $\Omega_{c}^{0}=3\gamma$. In addition to $w_{r}=50\mu m$, $w_{c}=50\mu m$,
and $\Delta_{p}=150.01\gamma$, all other parameters are same as in Fig. 2
except for $\Delta_{c}=10\gamma$.

Nevertheless, in the next section we show that this Raman induced optical
waveguide(RIW) is unable to control efficiently the diffraction of narrow
optical beams. To control diffraction of narrow optical beams, a high contrast
waveguide with narrow core region is required. For the case of RIW, a high
contrast waveguide with narrow core region can be achieved by increasing the
atomic density of the system as well as by narrowing the width $w_{r}(z)$ of
the Raman beam. This configuration, however, increases gain significantly and
also reduces the length of the waveguide ($z_{0r}$) making it less efficient
for diffraction control.

To overcome this problem, we make use of an additional spatial dependent
control beam which can control the features of the waveguide. In this regard,
we consider the control beam to be a LG beam as shown in Fig. 3. This
particular spatial profile of the control beam creates a very narrow gain
profile as well as a waveguide with a very narrow core region, which is shown
in Fig. 3 and Fig. 3, respectively. Such spatial modulation in the gain as
well as refractive index of the medium can be attributed to the fact that the
presence of control beam decreases gain in the system, as explained in
precedent subsection. Now, since the intensity distribution for the LG beam is
a donought shape with zero intensity at the center and maximum intensity in
the annular region, the spatial gain will be reduced in this annular region,
resulting in the narrowing of the spatial gain profile. Similar reduction in
the refractive index in the annular region is noticed due to the presence of
LG control beam, which leads to the creation of a waveguide with narrow core.

Figure 4: Panel (a) Shows normalized intensity of the input probe beam
$(HG_{10})$ in the transverse x-y plane. Panel (b) and (c) shows the output
intensity of probe beam in absence of control beam and in presence of control
beam, respectively, at a propagation distance of $z=2$mm. Panel (d) shows the
evolution of integrated power of the probe beam in absence of control beam
(blue-solid line) and in presence of control beam (red-dashed line), with the
propagation distance z. The parameters are $\Omega_{p}^{0}=0.001\gamma$,
$w_{p}=10\mu m$, $q_{1}=q_{2}=2$, $w_{r}=60\mu m$, $w_{c}=60\mu m$, and
$\mathcal{N}=8\times 10^{12}$ atoms/cm3. Other parameters are same as in Fig.
3.

Figure 5: Panel (a) Shows normalized intensity of the input probe beam
$(HG_{20})$ in the transverse x-y plane. The output intensity of probe beam,
shown in absence of control beam panel (b) and in presence of control beam
panel (c), at a propagation distance of $z=1$mm. Panel (d) shows the variation
of integrated power of the probe beam with the propagation distance z, in
absence of control beam (blue-solid line) and in presence of control beam
(red-dashed line). The parameters are $w_{r}=90\mu m$, $w_{c}=90\mu m$,
$\Delta_{r}=195\gamma$, $\Delta_{c}=55\gamma$, $\Delta_{p}=195.01\gamma$, and
$\mathcal{N}=1\times 10^{13}$ atoms/cm3. Other parameters are same as in Fig.
4.

Moreover, it is interesting to note that, unlike RIW case where the waveguide
narrowing is only possible by narrowing the width of the Raman beam, which
leads to a decrease in waveguide length, here the narrowing of waveguide is
mainly due to the spatial shape of the control beam, which leaves the
waveguide length unchanged. Hence, the spatial profile of the control beam
plays a decisive role in controlling the features of the waveguide and in
creating high contrast tunable waveguide in the medium. In the following
subsection, we show how this control beam tunable Raman induced
waveguide(CRIW) holds a greater advantage over RIW in controlling diffraction
of narrow optical beams.

###  III.3 Probe beam propagation

In this subsection, we explore on the possibility of diffractionless
propagation of arbitrary modes of narrow optical beams in RIW and CRIW created
inside the atomic medium. For this, we consider the initial profile of the
probe beam as different Hermite-Gaussian modes, which are expressed as

$\Omega_{p}(x,y,z=0)=\Omega_{p}^{0}H_{n}\left(\frac{\sqrt{2}x}{w_{p}}\right)H_{m}\left(\frac{\sqrt{2}y}{w_{p}}\right)e^{-\frac{\left(x^{2}+y^{2}\right)^{2}}{w_{p}^{2}}},$
(13)

where $H_{n}$ and $H_{m}$ are the Hermite polynomials of order $n$ and $m$,
respectively. With above mentioned different initial profile, we study the
propagation of probe beam by numerically solving Eq. (11) using Fourier split
step method(FSSM) [25]. We first consider the propagation of $HG_{10}$ probe
beam with a width ($w_{p}$) of 10 $\mu$m in RIW and present the result of our
simulation in Fig. 4. Figure 4 shows the intensity distribution of the output
probe beam in the transverse plane after propagating a distance of $z=2$mm in
RIW. It is clear from Fig. 4 that probe beam gets diffracted after propagating
through this induced wavegide. This is because, RIW has a wide core and is
unable to control the diffraction of the probe beam. In addition to this, we
also study the output probe power
$P(z)=\iint\left|\Omega_{p}(x,y,z)\right|^{2}dx~{}dy$, and found that the
probe beam is highly amplified by a factor of 100 after propagating a distance
of $z=2$mm, as shown in Fig. 4. So, due to its inability to control
diffraction along with creation of such large gain in the probe beam, which
can lead to instability in the medium [20], the practical applicability of the
RIW is severely limited.

However, this problem is eventually overcome by utilizing an additional LG
control beam, which can efficiently control both diffraction as well as gain
in the probe beam, as shown in Figure 4 and Figure 4, respectively. Such
control over diffraction by the control beam can be attributed to the creation
of waveguide with narrow core, which is explained in detail in precedent
subsection. In addition to diffraction control, the probe beam is also
slightly focused as shown in Fig. 4. Such focusing behaviour have been
observed earlier in atomic based waveguides [19] and can be controlled by
suitable modulating the features of the waveguide. Further, it is interesting
to notice that the probe beam propagates without diffraction in this narrow
waveguide [See Fig. 4] upto a distance of $2$mm, which is 5 times the Rayleigh
length of the probe beam $z_{0p}$. Also, unlike earlier case, here the probe
beam attains a reasonable amount of gain at a distance of $2$mm, as shown in
Fig. 4. Our result on diffraction control of narrow optical beams to several
Rayleigh lengths, may have potential application in high density lossless
information transfer to macroscopic lengths and high contrast imaging.

Further, in this work, we are dealing with propagation of optical beams in a
waveguide induced inside a gain system. So, it is necessary to verify the
validity of both weak field approximation and paraxial approximation used in
the calculation. In this regard, for our numerical calculations on beam
propagation, we start with low probe power and throughout the propagation we
found that the maximum intensity of probe is always very much smaller than the
maximum intensity of Raman and Control beam. This condition of probe intensity
validates our weak field approximation. Also, the width of the probe beam
$w_{p}$ doesn’t change much throughout it’s propagation and the condition for
paraxiality $\lambda/2\pi w_{p}<0.1$ is always satisfied [26], thus validating
our paraxial approximation.

Next, to establish that CRIW can support arbitrary modes of the probe beam, we
also study the propagation of $HG_{20}$ probe beam in it and present our
result in Fig. 5. From Fig. 5, it is noticeable that CRIW is able to control
the diffraction of the probe beam to length of $2.5z_{0p}$ with reasonable
amount of gain, while RIW fails to do so. Apart from this, we also performed
numerical simulation on propagation of other higher order modes of the probe
beam and found diffractionless propagation of such modes in CRIW. Hence, from
above discussions, it becomes evident that control beam plays an important
role in creation of CRIW and subsequently in controlling the diffraction of
arbitrary modes of narrow optical beams to several Rayleigh lengths.

##  IV Conclusion

In conclusion, we have investigated diffraction control of arbitrary modes of
optical beam using tunable Raman effects arising in atomic medium in
${\mathcal{N}}$-type configuration. We have demonstrated that by using a
suitable spatial dependent Raman field, a waveguide like feature can be
created inside the atomic medium. Further, we show that the properties of the
induced waveguide can be modulated by using an additional spatial dependent
control field. From our numerical results on optical beam propagation, we
conclude that RIW is incapable of controlling the diffraction of narrow
optical beams, while CRIW can efficiently control the diffraction of such
beams to several Rayleigh lengths. Our results may have possible application
in high contrast imaging [27, 28], information processing [29, 30] and
lithography [31].

###### Acknowledgements.

We wish to acknowledge the financial support from KAIST through the BK21
postdoctoral fellowship.

## References

  * [1] A. G. Truscott, M. E. J. Friese, N. R. Heckenberg, and H. Rubinsztein-Dunlop, Optically Written Waveguide in an Atomic Vapor, Phys. Rev. Lett. 82, 1438 (1999).
  * [2] R. Kapoor and G. S. Agarwal, Theory of electromagnetically induced waveguides, Phys. Rev. A 61, 053818 (2000).
  * [3] O. Firstenberg, M. Shuker, N. Davidson, and A. Ron, Elimination of the Diffraction of Arbitrary Images Imprinted on Slow Light, Phys. Rev. Lett. 102, 043601 (2009).
  * [4] H. Shpaisman, A. D. Wilson-Gordon, and H. Friedmann, Electromagnetically induced waveguiding in double-$\Lambda$ systems, Phys. Rev. A 71, 043812 (2005).
  * [5] S. Sharma and T. N. Dey, Kerr-field-induced tunable optical atomic waveguide, Phys. Rev. A 96, 053813 (2017).
  * [6] T. N. Dey and G. S. Agarwal, Subdiffraction propagation of images using saturated absorption of optical transition, Opt. Lett. 34, 3199 (2009).
  * [7] O. N. Verma, L. Zhang, J. Evers and T. N. Dey, optical cloning of arbitrary images beyond the diffraction limits, Phys. Rev. A 88, 013801 (2013).
  * [8] D.-S. Ding, Z.-Y. Zhou, and B.-S. Shi, Image cloning beyond diffraction based on coherent population trapping in a hot rubidium vapor, Opt. Lett. 39, 240 (2014).
  * [9] M. Cao, L. Zhang, Y. Yu, F. Ye, D. Wei, W. Guo, S. Zhang, H. Gao, and F. Li, Transfer and conversion of images based on EIT in atomic vapor, Opt. Lett. 39, 2723 (2014).
  * [10] L. Qin, C. Hang, and G. Huang, High-fidelity and controllable cloning of high-dimensional optical beams with a Rydberg atomic gas, Phys. Rev. A 102, 063707 (2020).
  * [11] Z. Shi, and G. Huang, Selection and cloning of periodic optical patterns with a cold Rydberg atomic gas, Opt. Lett. 46, 5344 (2021).
  * [12] N. Radwell, T. W. Clark, B. Piccirillo, S. M. Barnett, and S. Franke-Arnold, Spatially Dependent Electromagnetically Induced Transparency, Phys. Rev. Lett. 114, 123603 (2015).
  * [13] S. Sharma and T. N. Dey, Phase-induced transparency-mediated structured-beam generation in a closed-loop tripod configuration, Phys. Rev. A 96, 033811 (2017).
  * [14] H. R. Hamedi, J. Ruseckas, E. Paspalakis, and G. Juzeliunas, Transfer of optical vortices in coherently prepared media, Phys. Rev. A 99, 033812 (2019).
  * [15] S. Sharma and T. N. Dey, Controlled light shaping via phase-dependent electromagnetically induced transparency, J. Opt. Soc. Am. B 36, 960 (2017).
  * [16] H. R. Hamedi, J. Ruseckas, E. Paspalakis, and G. Juzeliunas, Off-axis optical vortices using double-Raman singlet and doublet light-matter schemes, Phys. Rev. A 101, 063828 (2020).
  * [17] H. R. Hamedi, V. Kudriasov, N. Jia, J. Qian, and G. Juzeliunas, Ferris wheel patterning of Rydberg atoms using electromagnetically induced transparency with optical vortex fields, Opt. Lett. 46, 4204 (2021).
  * [18] P. K. Vudyasetu, D. J. Starling, and J. C. Howell, All Optical Waveguiding in a Coherent Atomic Rubidium Vapor, Phys. Rev. Lett. 102, 123602 (2009).
  * [19] Tarak N. Dey and J. Evers, Nondiffracting optical beams in a three-level Raman system, Phys. Rev. A 84, 043842 (2011).
  * [20] G. P. Agrawal, Transverse modulation instability of copropagating optical beams in nonlinear Kerr media, J. Opt. Soc. Am. B 7, 1072 (1990).
  * [21] G. S. Agarwal and S. Dasgupta, Superluminal propagation via coherent manipulation of the Raman gain process, Phys. Rev. A 70, 023802 (2004).
  * [22] Y. Peng, Y. Niu, L. Zhang, A. Yang, L. Jiang, and S. Gong, Enhanced optical precursors by Doppler effect via active Raman gain process, Opt. Lett. 37, 3333 (2012).
  * [23] O. N. Verma and Tarak N. Dey, Steering, splitting, and cloning of an optical beam in a coherently driven Raman gain system, Phys. Rev. A 91, 013820 (2015).
  * [24] V. G. Arkhipkin and S. A. Myslivets, One- and two-dimensional Raman-induced diffraction gratings in atomic media, Phys. Rev. A 98, 013838 (2018).
  * [25] A. D. Bandrauk and H. Shen, High-order split-step exponential methods for solving coupled nonlinear Schrodinger equations, J. Phys. A: Math. Gen. 27, 7147 (1994).
  * [26] G. P. Agrawal and D. N. Pattanayak, Gaussian beam propagation beyond the paraxial approximation, J. Opt. Soc. Am. B 69, 575 (1979).
  * [27] K. T. Kapale, and G. S. Agarwal, Subnanoscale resolution for microscopy via coherent population trapping, Opt. Lett. 35, 2792 (2010).
  * [28] H. Li, V. A. Sautenkov, M. M. Kash, A. V. Sokolov, G. R. Welch, Y. V. Rostovtsev, M. S. Zubairy, and M. O. ScullyOptical imaging beyond the diffraction limit via dark states, Phys. Rev. A 78, 013803 (2008).
  * [29] D.-S. Ding, Z.-Y. Zhou, B.-S. Shi, X.-B. Zou and G.-C. Guo, Image transfer through two sequential four-wave mixing process in hot atomic vapor, Phys. Rev. A 85, 053815 (2012).
  * [30] D.-S. Ding, J.-H. Wu, Z.-Y. Zhou, B.-S. Shi, X.-B. Zou and G.-C. Guo, Multiple image storage and frequency conversion in a cold atomic ensemble, Phys. Rev. A 87, 053830 (2013).
  * [31] M. Kiffner, J. Evers, and M. S. Zubairy, Resonant Interferometric Lithography beyond the Diffraction Limit, Phys. Rev. Lett. 100, 073602 (2008).


# From Shortcuts to Triggers: Backdoor Defense with Denoised PoE

Qin Liu Fei Wang Chaowei Xiao Muhao Chen
University of Southern California; Arizona State University
{qliu4174, fwang598<EMAIL_ADDRESS><EMAIL_ADDRESS>

###### Abstract

Language models are often at risk of diverse backdoor attacks, especially data
poisoning. Thus, it is important to investigate defense solutions for
addressing them. Existing backdoor defense methods mainly focus on backdoor
attacks with explicit triggers, leaving a universal defense against various
backdoor attacks with diverse triggers largely unexplored. In this paper, we
propose an end-to-end ensemble-based backdoor defense framework, DPoE
(Denoised Product-of-Experts), which is inspired by the shortcut nature of
backdoor attacks, to defend various backdoor attacks. DPoE consists of two
models: a shallow model that captures the backdoor shortcuts and a main model
that is prevented from learning the backdoor shortcuts. To address the label
flip caused by backdoor attackers, DPoE incorporates a denoising design.
Experiments on SST-2 dataset show that DPoE significantly improves the defense
performance against various types of backdoor triggers including word-level,
sentence-level, and syntactic triggers. Furthermore, DPoE is also effective
under a more challenging but practical setting that mixes multiple types of
trigger.111Work in progress.

##  1 Introduction

Similar to all other DNN models Chen et al. (2017); Gu et al. (2019); Turner
et al. (2019); Nguyen and Tran (2021); Saha et al. (2022), the language models
nowadays are also exposed to the risk of backdoors Kurita et al. (2020); Chen
et al. (2021b); Qi et al. (2021c, d); Gan et al. (2022), where attackers
exploit vulnerabilities in NLP systems by inserting specific triggers into the
training data. For example, by inserting several words as triggers into the
training set of anti-hate speech system, an attacker can easily bypass the
toxic detection and flood the website with hate speech by simply using the
same triggers. Notably, the consequences of backdoor attacks were exemplified
by Microsoft’s chatbot Tay, which was trained on user interactions and quickly
turned into a platform for spreading offensive and hate-filled messages due to
manipulated inputs Wolf et al. (2017). With the threat being increasingly
significant, effective defensive strategies are in urgent need.

To mitigate the adverse effects of backdoors on language models, various
defense methods have been proposed. Existing methods of such either detect and
remove triggers during inference time Kurita et al. (2020); Chen and Dai
(2021); Qi et al. (2021a); Li et al. (2021d) or filter out trigger-embedded
samples during training Jin et al. (2022), assuming that backdoor triggers are
visible and detectable or that only a single type of trigger is inserted.
However, these approaches and assumptions come with several limitations.
First, backdoor triggers can be implicit or invisible. Instead of inserting
any surface-level backdoors, attackers may use syntactic Qi et al. (2021c) or
stylistic Qi et al. (2021b) backdoors that are hard to notice. For example,
instead of inserting tangible triggers like “[cf, mn, bb, tq, mb]” Kurita et
al. (2020) which are suspicious and can be easily eyeballed or recognized by
existing defenders, a _syntactic attack_ Qi et al. (2021c) rephrases benign
text with a selected syntactic structure, such as $S(SBAR)(,)(NP)(VP)(.)$, as
a trigger that is more stealthy and imperceptible. Second, adversaries might,
under the more challenging condition, choose a combination of diverse types of
triggers to attack a model. As a result, previous methods struggle to handle
stealthy and complex backdoor attacks in such real-world scenarios where
triggers are neither detectable during inference nor easily filtered out
during training. What’s more, some existing methods Pang et al. (2022); Sha et
al. (2022) assume that a supplementary clean dataset is available to train and
verify the trigger discriminator, which may not be practical in real-world
scenarios.

Taking both explicit and implicit backdoor triggers into consideration, the
inserted backdoors are indeed deliberately crafted shortcuts, or spurious
correlations Jia and Liang (2017); Gururangan et al. (2018); Poliak et al.
(2018); Wang and Culotta (2020); Gardner et al. (2021), between the
predesigned triggers and the target label predefined by the attacker. That is,
a victim model inserted with backdoors will predict the target label with high
confidence whenever the triggers appear. Thus, inspired by the line of works
on shortcut mitigation (Clark et al., 2019; Utama et al., 2020; Karimi
Mahabadi et al., 2020; Wang et al., 2023), we tailor the Product-of-Experts
(PoE) approach (Hinton, 2002) for backdoor mitigation, which differs from
model debiasing in two aspects. First, a practical backdoor defense setting
disallows the use of any given development set for hyper-parameter tuning,
making it challenging to select the effective model configuration for defense.
Second, the poisoned training set especially suffers from noisy labels since
the attackers change the ground truth labels into the target label after
inserting triggers, which makes these samples to be noisy instances with
incorrect labels. Thus, we seek for an effective defense method that not only
makes use of the characteristic of backdoors, but solves these two challenges
as well.

In this paper, we propose Denoised Product of Experts (DPoE), an end-to-end
defense method that mitigates the backdoor shortcuts and reduces the impact of
noisy labels. As an ensemble-based defense method, DPoE trains a shallow model
(dubbed as _trigger-only model_) to capture spurious backdoor shortcuts and
trains the ensemble of the trigger-only model and a main model to prevent the
main model from learning the backdoor shortcuts (Section 3.2). Further, to
deal with the problem of noisy labels, DPoE re-weights the training samples
according to the prediction confidence of the trigger-only model (Section
3.3). Intuitively, since the shallow model is to capture the backdoor
shortcuts, the samples which are predicted with high confidence tend to be
trigger-inserted, and thus their labels are also contaminated. We also propose
a pseudo development set construction scheme (Section 3.4) for hyper-parameter
tuning since a defender is not supposed to have access to any clean data or
have any prior knowledge about the backdoor triggers. Experiments show that
DPoE significantly improves the performance of backdoor defense in NLP tasks
on various types of backdoor triggers, whether implicit or explicit. More
importantly, DPoE is still effective in the more complicated setting of
defending mix triggers.

Our contributions are three-fold. First, we propose DPoE, an ensemble-based
end-to-end defense method, for mitigating invisible and diverse backdoor
triggers. Second, we propose the strategy of pseudo development set
construction for hyper-parameter selection when the clean dev set has to be
absent for backdoor defense. Third, we show that DPoE, for the first time,
effectively defends against mix triggers, which is proved to be generally
robust and potent.

##  2 Related Work

Our work is connected to three research topics. Each has a large body of work
which we can only provide as a highly selected summary.

Backdoor Defense in NLP. Existing backdoor defense strategies can be
categorized as trigger mitigation Qi et al. (2021a); Gao et al. (2021); Azizi
et al. (2021); Chen and Dai (2021); Li et al. (2021d); Jin et al. (2022) or
backdoor erasing Liu et al. (2018); Li et al. (2021c); Zhang et al. (2022);
Lyu et al. (2022a); Pang et al. (2022); Sha et al. (2022), depending on the
adversaries’ ability of poisoning either the training data Gu et al. (2017);
Dai and Chen (2019); Qi et al. (2021c) or model weights Zhang et al. (2021);
Li et al. (2021a); Yang et al. (2021a); Qi et al. (2021d).

This paper focuses on the former setting where the attacker can only poison
the training data but have no access to the training period of models.
Existing backdoor defense strategies on trigger mitigation can be further
categorized as trigger detection Qi et al. (2021a); Gao et al. (2021); Azizi
et al. (2021) and training data purification Chen and Dai (2021); Li et al.
(2021d); Jin et al. (2022). A trigger detection method seeks to reveal
backdoor triggers during inference time and remove them to get rid of them in
the input instances. Previous works regard triggers as outliers and detect
them based on perplexity Qi et al. (2021a), salience Chen and Dai (2021), or
resistance to input perturbations Gao et al. (2021); Azizi et al. (2021).
Training data purification methods aim at identifying poisoned samples and
discarding them before training Chen and Dai (2021); Li et al. (2021d).
However, these methods are restricted to visible backdoor triggers that are
with a surface form (e.g. words or textual spans). To expand defense
scenarios, Jin et al. (2022) adopt weakly supervised training to obtain a
backdoor-free model and filters out unreliable samples, which is effective
against other forms of backdoor triggers including implicit, syntactic ones.
Our proposed method is not only capable of defending against implicit backdoor
triggers, unlike existing methods, it remains effective against a mixture of
different trigger types.

Model Debiasing with PoE. Product-of-experts (PoE) is widely used in model
debiasing where a robust and debiased model is obtained by fitting to the
residual between the (biased) training data and the model that is heavily
biased towards spurious correlations between input feature and labels Clark et
al. (2019); He et al. (2019); Lyu et al. (2022b); Wang et al. (2023). One
significant advantage of PoE is its capability of mitigating unknown biases by
training a weak model to proactively capture the underlying data bias, then
learn the residue between the captured biases and original task observations
for debiasing. For example, Utama et al. (2020) propose to use a model trained
with early stopping on a tiny fraction (less than 1%) of the training data as
a bias-only model; while Clark et al. (2020) and Sanh et al. (2021) train a
low capacity model on the full training set. Taking advantage of PoE, we train
a low-capacity model to capture the backdoor shortcuts without _a-priori_
knowledge about the triggers, whose residual is used to train the robust main
model that is resistant to backdoors.

Denoising. Solutions for learning with noisy labels in deep learning include
sample re-weighting Liu and Tao (2015); Jiang et al. (2018); Ren et al.
(2018); Shu et al. (2019); Wei et al. (2020b), re-sampling Han et al. (2018);
Yu et al. (2019); Wei et al. (2020a); Xia et al. (2022), loss correction Reed
et al. (2014); Arazo et al. (2019); Zheng et al. (2020); Chen et al. (2021a),
model regularization Lukasik et al. (2020); Hu et al. (2020); Xia et al.
(2021); Bai et al. (2021); Zhou and Chen (2021) and different learning
strategies such as semi-supervised learning Li et al. (2020); Nguyen et al.
(2020) and self-supervised learning Li et al. (2022). As a pilot study of
using PoE for backdoor defense, we currently choose to down-weight the
trigger-inserted samples in DPoE, which can be distinguished by a high
prediction confidence of the trigger-only model, to reduce the impact of noisy
labels. Meanwhile, we believe the other denoising techniques can potentially
benefit DPoE, for which we plan for an in-depth study in future work.

Figure 1: Framework of DPoE. “cf” in red denotes the BadNet trigger; “Sports”
and “World” are target label and the ground truth label respectively. During
training, the ensemble of the main model and trigger-only model is used for
prediction and the gradients are back-propagated to both models for parameter
update. During inference, only the robust main model is used for prediction.

##  3 Methods

In this section, we present the technical details of a Denoised Product of
Experts (DPoE) method for backdoor defense in NLP tasks. We first provide a
general definition of backdoor attack and backdoor triggers (Section 3.1),
followed by a detailed description of our defense framework (Section 3.2 &
Section 3.3) and a novel strategy for model selection (Section 3.4).

###  3.1 Preliminary

Problem Definition. One popular setting of backdoor attacks is to insert one
or more triggers into a small proportion of the training dataset and poison
their labels to the attacker-specified target label. Assume
$t^{*}\in\mathcal{T}^{*}$ is a backdoor trigger and $y^{*}$ is the target
label. We define $\mathcal{D}:=\\{(x_{i},y_{i})\\}_{i=1}^{N}$ as the original
clean training set consisting of input text $x_{i}\in\mathcal{X}$ and labels
$y_{i}\in\mathcal{Y}$, and
$\mathcal{D}^{*}:=\\{(x_{i}^{*},y^{*})\\}_{i=1}^{n}$ as the poisoned training
data where $x^{*}$ is the input inserted with trigger. We denote the clean
counterpart of these poisoned samples as
$\mathcal{D}^{\prime}\subseteq\mathcal{D}$. The goal of a general text
classification task is to learn a mapping
$f_{M}:\mathcal{X}\rightarrow\mathcal{Y}$ parameterized by $\theta_{M}$ that
computes the predictions over the label space given input data. Moreover, the
goal of an adversary is to induce a model to learn the mapping
$f^{*}_{M}:\mathcal{T}^{*}\rightarrow y^{*}$ that predicts the target label
whenever a trigger appears in the input.

We consider defending against diverse types of triggers used separately in
previous studies, including words Kurita et al. (2020), sentences Dai and Chen
(2019), and syntactic triggers Qi et al. (2021c). For explicit backdoor
triggers (i.e. word and sentence triggers), the attacker inserts one or more
of them at an arbitrary position within the word sequence of a clean sample
$x=[w_{1},w_{2},\dots,w_{n}]$, which results in the poisoned data
$x^{*}=[w_{1},w_{2},\dots,t^{*},\dots,w_{n}]$. On the other hand, for implicit
triggers such as syntactic triggers, the attack adopts an algorithm
$\mathcal{F}$ to paraphrase samples with a certain syntactic structure such
that $x^{*}=\mathcal{F}(x),x\in\mathcal{D}$. The defender’s goal is that,
after training a benign model from scratch on the poisoned training data
$\mathcal{D}^{*}\bigcup\mathcal{D}/\mathcal{D}^{\prime}$, the model should
maintain normal performance on benign test data while avoid predicting the
target label when the input text contains a trigger.

Overview. To defend against different types of backdoor triggers, we propose
the DPoE framework which seeks to train a robust model when only poisoned
training data are available. Figure 1 displays the overall model architecture.
Inspired by works on data debiasing Clark et al. (2019); Karimi Mahabadi et
al. (2020), we regard backdoors as the spurious correlations leading to
prediction shortcuts between backdoor triggers and the target label. To get
rid of this toxic bias, we train an ensemble of the main task model together
with another shallow model in an attempt to overfit the correlations with the
shallow model and learn the debiased residual with the main model (Section
3.2). Other than inserting triggers, the backdoor attackers also alter the
labels of these samples into the target label. Therefore, from the task
learning perspective, those poisoned samples can also be viewed as noisy
instances with incorrect labels. To reduce the impact of these noisy labels on
model performance, we use sample re-weighting scheme which is to be described
in Section 3.3. We leave the comparison of different denoising techniques to
future work. Since it is not realistic for backdoor defense problems to have
any validation data with annotated triggers, we make use of the shallow model
to filter out pseudo dev set for hyper-parameter selection (Section 3.4).

###  3.2 PoE for Backdoor Defense

The first step of constructing our DPoE method is to design the PoE framework
(Hinton 2002) for backdoor defense. We hereby describe the construction of the
shallow model, which we refer to as _trigger-only model_ , and the ensemble
scheme of shallow model and the main model as PoE.

Trigger-only Model. The trigger-only model is specifically designed to capture
the spurious correlation from the backdoor. Since the poisoned training data
contain toxic biases, we intentionally amplify the bias captured by the
trigger-only model by limiting its capability in two aspects. On the one hand,
we leverage only a part of the backbone model as trigger-only model ($e.g.$,
the first several layers of the Transformer model). This is in consistency
with recent findings indicating that the backdoor associations are easier to
learn than clean data Li et al. (2021b); Zhang et al. (2023). Therefore, such
associations tend to be more easily overfit by a shallow model Ghaddar et al.
(2021); Wang et al. (2023). On the other hand, we use a hyper-parameter
($\beta$ in Equation 1, which will later be selected using the psuedo dev set
technique in Section 3.4) as the coefficient of the trigger-only model,
determining to what extent should the ensemble scale up trigger model’s
learning of the backdoor mapping and leave the main model with trigger-free
residual. In brief, we encourage the trigger-only model to fit the backdoor
mapping $f_{M}^{*}:\mathcal{T}^{*}\rightarrow y^{*}$ without any _a-priori_
knowledge about the possible types of backdoor triggers, and in the meantime,
learning less about the clean mapping
$f_{M}:\mathcal{X}\rightarrow\mathcal{Y}$.

product-of-experts. Based on PoE, we train a robust main model that is
mitigated with the reliance on the mapping $f_{M}^{*}$ captured by the
trigger-only model. Suppose the trigger-only predictor is $h$ with parameters
$\theta_{h}$, where $h(x_{i},\theta_{h})=b_{i}=\langle
b_{i1},b_{i2}\dots,b_{i|\mathcal{Y}|}\rangle$ and $b_{ij}$ is the trigger-only
model’s predicted probability of class $j$ for training sample $i$. Similarly,
we denote the main model predictor as $g$ which is parameterized by
$\theta_{g}$, where $g(x_{i},\theta_{g})=p_{i}$ and $p_{i}$ is the probability
distribution over the classes. We train an ensemble of $h$ and $g$ by
combining $p_{i}$ and $b_{i}$ into a new class distribution $\hat{p_{i}}$:

$\hat{p_{i}}=softmax(\log(p_{i})+\beta\cdot\log(b_{i})),$ (1)

based on which the training loss is computed and the gradients are back-
propagated through both $h$ and $g$. $\beta$ denotes the coefficient of the
probability distribution predicted by trigger-only model, which remains to be
determined with the technique in Section 3.4. During evaluation, $g$ (i.e. the
main model) is used alone. The key intuition of PoE is to combine the
probability distributions of the trigger-only and the main model to allow them
to make predictions based on different characteristics of the input: the
trigger-only model covers prediction based on backdoor associations, and the
main model focuses on the actual task and trigger-free features Karimi
Mahabadi et al. (2020). Then both models are trained using the cross-entropy
(CE) loss of the combined probability distribution:

$\mathcal{L}(\theta_{h};\theta_{g})=-\frac{1}{N}\sum_{i=1}^{N}\log(\hat{p_{i}}).$

Justification. Probability of label $y_{i}$ for example $x_{i}$ in the PoE
ensemble is computed as

$\hat{p}_{iy_{i}}=\sigma(\log(p_{iy_{i}}\cdot
b_{iy_{i}}))=\frac{p_{iy_{i}}\cdot
b_{iy_{i}}}{\sum_{k=1}^{|\mathcal{Y}|}p_{ik}\cdot b_{ik}},$

where $\sigma$ denotes the softmax function. Then the gradient of the CE loss
$\mathcal{L}(\theta_{h};\theta_{g})$ w.r.t. $\theta_{g}$ is Karimi Mahabadi et
al. (2020):

$\displaystyle\nabla_{\theta_{g}}\mathcal{L}(\theta_{h};\theta_{g})$
$\displaystyle=$ $\displaystyle-\frac{1}{N}\sum_{i=1}^{N}$
$\displaystyle\sum_{k=1}^{|\mathcal{Y}|}\left[\left(\delta_{y_{i}k}-\hat{p}_{ik}\right)\nabla_{\theta_{g}}\log(p_{ik})\right],$

where $\delta_{y_{i}k}$ equals $1$ when $k=y_{i}$ otherwise $0$. Generally
speaking, when both the trigger-only model and the main model have captured
the backdoor associations, $\hat{p}_{ik}$ would be close to $1$ so that
$(\delta_{y_{i}k}-\hat{p}_{ik})$ is close to $0$, decreasing the gradient of
sample $i$. On the contrary, when the sample is trigger-free, the trigger-only
model predicts the uniform distribution over all classes
$b_{ik}\approx\frac{1}{|\mathcal{Y}|}$ for $k\in\mathcal{Y}$. Therefore,
$\hat{p}_{iy_{i}}=p_{iy_{i}}$ and the gradient of PoE classifier remains the
same as CE loss.

###  3.3 Denoising Strategies

Now we introduce the denoising part of DPoE. Since a backdoor attacker not
only inserts triggers into victim samples, it changes their labels into the
target label as well, resulting in the problem of noisy labels. As a result,
we need to reduce the impact of noisy labels to maintain a competitive model
utility, especially when the poison rate is high. Following Ghaddar et al.
(2021), our method adjusts the importance of training data with an instance
weight that indicates whether the sample is likely to carry backdoor triggers
or not (which is equivalent to whether the sample is noisily labeled or not).
Let $b_{iy_{i}}$ be the predicted probability of the ground-truth class by the
trigger-only model. The weight assigned to each sample is termed as follows:

$\displaystyle w_{i}=\left\\{\begin{aligned}
&1-b_{iy_{i}}&b_{iy_{i}}>\gamma,\\\ &1&otherwise,\end{aligned}\right.$

where the $\gamma\in[0,1]$ is a hard threshold to control the number of
samples to be re-weighted. The goal is to ensure that a sample is down-
weighted only if the trigger-only model has a high confidence on the sample,
which indicates that it is likely to be poisoned by the backdoor attacker and
thus has a noisy label. Accordingly, the weighted training loss should be:

$\mathcal{L}(\theta_{h};\theta_{g})=-\frac{1}{N}\sum_{i=1}^{N}w_{i}\log(\hat{p_{i}}).$

We train both models simultaneously by minimizing
$\mathcal{L}(\theta_{h};\theta_{g})$. At inference time, only the main model
is used for prediction.

###  3.4 Pseudo Development Set Construction

Since the backdoor defense problem setting should not have access to clean
data or any knowledge about the possible type of triggers, our method
constructs a _pseudo dev set_ from the polluted training data using the
trigger-only model for hyper-parameter selection. Since the trigger-only model
tends to more easily fit the backdoor associations, it naturally produces much
higher confidence on poisoned samples than on most of the clean samples.
Therefore, we construct a pseudo dev set with a high-precision low-recall
strategy by setting a high hard confidence threshold (e.g. $0.9$) to filter
out some suspicious samples using the trigger-only model after it finishes the
ensemble training with the main model. We denote this selected pseudo dev set
as $\mathcal{D}_{P}$. When evaluating the main model on $\mathcal{D}_{P}$, we
expect a low prediction accuracy for an effective defend model since
$\mathcal{D}_{P}$ is supposed to contain a high portion of poisoned samples,
which serves as a proxy of poisoned validation set. In the meantime, the main
model should also maintain a competitive performance on the poisoned training
set since most of ($100\%-$ poison rate) the training data are trigger-free.
Thus we have to balance the trade-off between model’s performance on
$\mathcal{D}_{p}$ and on the training set. Here we illustrate the validity of
this strategy for pseudo dev set construction.

Methods | Single Type Trigger | Multi-type
---|---|---
BadNet | InsertSent | Syntactic
ASR$\downarrow$ | Acc$\uparrow$ | ASR$\downarrow$ | Acc$\uparrow$ | ASR$\downarrow$ | Acc$\uparrow$ | ASR$\downarrow$ | Acc$\uparrow$
NoDefense | 97.81 | 90.94 | 99.78 | 91.32 | 95.83 | 89.73 | 92.77 | 90.50
Benign | 11.18 | 91.16 | 21.93 | 91.16 | 25.22 | 91.16 | 19.44 | 91.16
ONION | 40.30 | 89.94 | 75.60 | 88.48 | 93.49 | 89.48 | – | –
DPoE | 13.93 | 90.72 | 21.16 | 90.77 | 21.71 | 88.69 | 25.98 | 90.12
Table 1: Defense performance on SST-2 dataset under four backdoor attacks. For
the baseline ONION, we copy the results reported by Qi et al. (2021a) and Jin
et al. (2022). Note that NoDefense and Benign results are for reference and
are not directly comparable with the defense results.

Justification. We denote the poison rate, true clean accuracy of the main
model on clean test data, and clean accuracy on poisoned test data as
$\alpha=|\mathcal{D}^{*}|/|\mathcal{D}|$, $acc$, and $acc^{*}$ respectively.
Assume the poison rate of the selected pseudo dev set is $\alpha_{p}$, the
real attack success rate for the main model is $asr$ (refer to the definition
of metrics in Section 4.1), and the accuracy on pseudo dev set is $asr_{p}$.

Firstly, suppose the main model performs well on both the pseudo dev set and
the poisoned training set, which is equivalent to low $asr_{p}$ and high
$acc^{*}$, it indicates low $asr$ and high $acc$:

$\displaystyle acc^{*}$ $\displaystyle=(1-\alpha)*acc+\alpha*asr,$
$\displaystyle asr_{p}$ $\displaystyle=(1-\alpha_{p})*acc+\alpha_{p}*asr.$

Since the poison rate of a typical backdoor attacker is generally low (e.g.
$5\%-10\%$), $\alpha*asr$ can be ignored and we have $acc^{*}\propto acc$.
Similarly, a well-trained trigger-only model results in high $\alpha_{p}$ so
that $asr_{p}\propto asr$. So we have demonstrated that we can infer from the
low $asr_{p}$ and high $acc^{*}$ that the main model is effective for defense.

Secondly, suppose there exists a main model with high $acc$ and low $asr$,
which means it is an effective defense model indeed. Similarly, we have:

$\displaystyle acc$ $\displaystyle=\frac{acc^{*}-\alpha*asr}{1-\alpha},$
$\displaystyle asr$
$\displaystyle=\frac{asr_{p}-(1-\alpha_{p})*acc}{\alpha_{p}}.$

When the poison rate $\alpha$ is low, $(1-\alpha)\approx 1$ so that
$acc\propto acc^{*}$. Further, an ideal main model indicates an effective
trigger-only model that performs high $\alpha_{p}$, which means $asr\propto
asr_{p}$. So we have illustrated that a promising main model will be detected
and selected by the pseudo dev set. As a result, our construction of pseudo
dev set is valid since $asr_{p}$ and $acc^{*}$ on the pseudo dev set are
effective approximations of $asr$ and $acc$.

##  4 Experiments

In this section, we evaluate the defense performance of DPoE against four
different types of backdoor attacks on SST-2 dataset. We provide an overview
of our experimental settings (Section 4.1) and present a comparison of
empirical results (Section 4.2).

###  4.1 Experimental Setup

#### Evaluation Dataset

We evaluate DPoE on SST-2 Wang et al. (2019), a binary classification task
that predicts the sentiment (_positive_ / _negative_) of a given sentence
which is extracted from movie reviews.

#### Attack Methods

To demonstrate the effectiveness of DPoE against various types of backdoor
triggers, we choose three representative backdoor attack methods: word
triggers, sentence triggers, and syntactic triggers. (1) BadNet Gu et al.
(2017) is originally proposed to attack image classification models. We use
the adapted version for text Kurita et al. (2020) that randomly inserts rare
words as triggers. (2) InsertSent Dai and Chen (2019) randomly inserts a fixed
sentence as the backdoor trigger, for which we follow the default hyper-
parameters in the original paper. (3) Syntactic Qi et al. (2021c) is an
invisible textual backdoor attack where syntactic structure is used as the
trigger by paraphrasing a victim sentence into the specified syntactic
structure $S(SBAR)(,)(NP)(VP)(.)$. Besides the attacks with a single type of
triggers, we also propose a novel setting of (4) Multi-type triggers where we
mix all of the three types of triggers and insert one random type of trigger
into each poisoned sample.

We use OpenBackdoor Cui et al. (2022) for poisoned data generation. To be
consistent with previous studies Dai and Chen (2019); Qi et al. (2021c); Jin
et al. (2022), we adopt a poison rate of $5\%$ for BadNet and InsertSent
attack, and $20\%$ for syntactic and multi-type attack.

#### Baseline Methods

We compare our method DPoE with the representative defense method ONION Qi et
al. (2021a) which detects and removes the suspicious words that are probably
the backdoor triggers. GPT-2 Radford et al. (2019) is used to evaluate the
suspicion score of each word by the decrement of sentence perplexity after
removing the word. Comparison with other competitive defense methods will be
involved in future work.

#### Implementation and Evaluation Metrics

To be consistent with previous study Qi et al. (2021a); Yang et al. (2021b);
Jin et al. (2022), we use BERT-base-uncased model Devlin et al. (2019) as the
backbone of the DPoE framework. All experiments are conducted on a single
NVIDIA RTX A5000 GPU. We train all models for $3$ epochs and pick the best
hyper-parameter based on the pseudo development set strategy (Section 3.4).
The defense methods are evaluated with the following two metrics. (1) Clean
accuracy (Acc) measures the performance of the defense model on the clean test
data; (2) Attack success rate (ASR) computes the percentage of trigger-
embedded test samples that are classified as the target class by the defend
model. Following Jin et al. (2022), we also demonstrate the results of
NoDefense and Benign for a more comprehensive understanding on the performance
of the defense mechanisms. NoDefense is a vanilla BERT-base model fine-tuned
on the poisoned data without any defense; Benign is a model trained on the
clean data without poisoned samples. These two baselines are either provided
with full prior knowledge of the attack, or free of attack, representing ideal
situations that are not accessible to a defense model.

###  4.2 Main Results

As shown in Table 1, compared with the baseline (ONION), our proposed DPoE
method achieves better defense performance on all of the three single-type
trigger attacks, especially the syntactic attack that the baseline method
fails to defend against. Since ONION is a detection-based defense scheme with
the assumption that triggers are rare words, the syntactic attack which does
not involve explicit trigger words is not within its scope of defense. In
contrast, DPoE leverages a shallow model to capture the backdoor shortcuts
regardless of the type of triggers, enabling the training of a backdoor-robust
main model that does not learn the mapping from triggers to the target label.
Furthermore, DPoE achieves an even lower ASR than the Benign baseline under
InsertSent and Syntactic attacks, indicating that DPoE not only effectively
defends backdoor triggers, but is also robust to the semantic shortcuts
introduced by the insertion of triggers.

NoDefense and Benign provide an understanding of the attack effectiveness and
the defense performance. The attack success rate of multi-type triggers
reaches $92.77\%$ on BERT without defense, indicating the effectiveness of the
mix trigger attack which can alter the victim model to predict the target
label almost certainly. Under the novel mix trigger attack, DPoE also manages
to defend effectively, with the ASR being close to that of Benign. Besides,
DPoE still maintains a competitive clean Acc compared with Benign and
NoDefense, which demonstrates the effectiveness of the denoising technique
that helps the model to be more resistant to noisy labels even under a high
noise rate (approximately $20\%$ for syntactic and multi-type attacks).

##  5 Conclusion

In this paper, we propose DPoE, an end-to-end ensemble-based backdoor defense
method that mitigates backdoor triggers by learning the backdoor-free residual
of a shallow model that captures the backdoor shortcuts. In addition to
debiasing-based trigger mitigation and denoising techniques, a pseudo
development set construction strategy is also proposed for hyper-parameter
tuning since a clean dev set is absent in real-world scenarios. Experiments on
SST-2 dataset demonstrate its effectiveness in defending against various
backdoor triggers as well as mix types of triggers. Future work will provide a
more comprehensive evaluation on more NLP tasks and involve more
representative backdoor defense methods.

## References

  * Arazo et al. (2019) Eric Arazo, Diego Ortego, Paul Albert, Noel O’Connor, and Kevin McGuinness. 2019\.  Unsupervised label noise modeling and loss correction.  In _International conference on machine learning_ , pages 312–321. PMLR.
  * Azizi et al. (2021) Ahmadreza Azizi, Ibrahim Asadullah Tahmid, Asim Waheed, Neal Mangaokar, Jiameng Pu, Mobin Javed, Chandan K Reddy, and Bimal Viswanath. 2021.  T-miner: A generative approach to defend against trojan attacks on DNN-based text classification.  _arXiv preprint arXiv:2103.04264_.
  * Bai et al. (2021) Yingbin Bai, Erkun Yang, Bo Han, Yanhua Yang, Jiatong Li, Yinian Mao, Gang Niu, and Tongliang Liu. 2021.  Understanding and improving early stopping for learning with noisy labels.  _Advances in Neural Information Processing Systems_ , 34:24392–24403.
  * Chen and Dai (2021) Chuanshuai Chen and Jiazhu Dai. 2021.  Mitigating backdoor attacks in LSTM-based text classification systems by backdoor keyword identification.  _Neurocomputing_ , 452:253–262.
  * Chen et al. (2021a) Pengfei Chen, Junjie Ye, Guangyong Chen, Jingwei Zhao, and Pheng-Ann Heng. 2021a.  Beyond class-conditional assumption: A primary attempt to combat instance-dependent label noise.  In _Proceedings of the AAAI Conference on Artificial Intelligence_ , volume 35, pages 11442–11450.
  * Chen et al. (2021b) Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021b.  Badnl: Backdoor attacks against nlp models with semantic-preserving improvements.  In _Annual Computer Security Applications Conference_ , pages 554–569.
  * Chen et al. (2017) Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017.  Targeted backdoor attacks on deep learning systems using data poisoning.  _arXiv preprint arXiv:1712.05526_.
  * Clark et al. (2019) Christopher Clark, Mark Yatskar, and Luke Zettlemoyer. 2019.  Don’t take the easy way out: Ensemble based methods for avoiding known dataset biases.  In _Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP)_ , pages 4069–4082, Hong Kong, China. Association for Computational Linguistics.
  * Clark et al. (2020) Christopher Clark, Mark Yatskar, and Luke Zettlemoyer. 2020.  Learning to model and ignore dataset bias with mixed capacity ensembles.  In _Findings of the Association for Computational Linguistics: EMNLP 2020_ , pages 3031–3045, Online. Association for Computational Linguistics.
  * Cui et al. (2022) Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. 2022\.  A unified evaluation of textual backdoor learning: Frameworks and benchmarks.  In _Proceedings of NeurIPS: Datasets and Benchmarks_.
  * Dai and Chen (2019) Jiazhu Dai and Chuanshuai Chen. 2019.  A backdoor attack against lstm-based text classification systems.  _arXiv preprint arXiv:1905.12457_.
  * Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019.  BERT: Pre-training of deep bidirectional transformers for language understanding.  In _Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers)_ , pages 4171–4186, Minneapolis, Minnesota. Association for Computational Linguistics.
  * Gan et al. (2022) Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2022.  Triggerless backdoor attack for NLP tasks with clean labels.  In _Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 2942–2952, Seattle, United States. Association for Computational Linguistics.
  * Gao et al. (2021) Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C Ranasinghe, and Hyoungshick Kim. 2021.  Design and evaluation of a multi-domain trojan detection method on deep neural networks.  _IEEE Transactions on Dependable and Secure Computing_ , 19(4):2349–2364.
  * Gardner et al. (2021) Matt Gardner, William Merrill, Jesse Dodge, Matthew Peters, Alexis Ross, Sameer Singh, and Noah A. Smith. 2021.  Competency problems: On finding and removing artifacts in language data.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 1801–1813, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Ghaddar et al. (2021) Abbas Ghaddar, Phillippe Langlais, Mehdi Rezagholizadeh, and Ahmad Rashid. 2021\.  End-to-end self-debiasing framework for robust NLU training.  In _Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021_ , pages 1923–1929, Online. Association for Computational Linguistics.
  * Gu et al. (2017) Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017.  Badnets: Identifying vulnerabilities in the machine learning model supply chain.  _arXiv preprint arXiv:1708.06733_.
  * Gu et al. (2019) Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019.  Badnets: Evaluating backdooring attacks on deep neural networks.  _IEEE Access_ , 7:47230–47244.
  * Gururangan et al. (2018) Suchin Gururangan, Swabha Swayamdipta, Omer Levy, Roy Schwartz, Samuel Bowman, and Noah A. Smith. 2018.  Annotation artifacts in natural language inference data.  In _Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 2 (Short Papers)_ , pages 107–112, New Orleans, Louisiana. Association for Computational Linguistics.
  * Han et al. (2018) Bo Han, Quanming Yao, Xingrui Yu, Gang Niu, Miao Xu, Weihua Hu, Ivor Tsang, and Masashi Sugiyama. 2018.  Co-teaching: Robust training of deep neural networks with extremely noisy labels.  _Advances in neural information processing systems_ , 31.
  * He et al. (2019) He He, Sheng Zha, and Haohan Wang. 2019.  Unlearn dataset bias in natural language inference by fitting the residual.  In _Proceedings of the 2nd Workshop on Deep Learning Approaches for Low-Resource NLP (DeepLo 2019)_ , pages 132–142, Hong Kong, China. Association for Computational Linguistics.
  * Hinton (2002) Geoffrey E Hinton. 2002.  Training products of experts by minimizing contrastive divergence.  _Neural computation_ , 14(8):1771–1800.
  * Hu et al. (2020) Wei Hu, Zhiyuan Li, and Dingli Yu. 2020.  Simple and effective regularization methods for training on noisily labeled data with generalization guarantee.  In _International Conference on Learning Representations_.
  * Jia and Liang (2017) Robin Jia and Percy Liang. 2017.  Adversarial examples for evaluating reading comprehension systems.  In _Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing_ , pages 2021–2031, Copenhagen, Denmark. Association for Computational Linguistics.
  * Jiang et al. (2018) Lu Jiang, Zhengyuan Zhou, Thomas Leung, Li-Jia Li, and Li Fei-Fei. 2018.  Mentornet: Learning data-driven curriculum for very deep neural networks on corrupted labels.  In _International conference on machine learning_ , pages 2304–2313. PMLR.
  * Jin et al. (2022) Lesheng Jin, Zihan Wang, and Jingbo Shang. 2022.  Wedef: Weakly supervised backdoor defense for text classification.  _arXiv preprint arXiv:2205.11803_.
  * Karimi Mahabadi et al. (2020) Rabeeh Karimi Mahabadi, Yonatan Belinkov, and James Henderson. 2020.  End-to-end bias mitigation by modelling biases in corpora.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 8706–8716, Online. Association for Computational Linguistics.
  * Kurita et al. (2020) Keita Kurita, Paul Michel, and Graham Neubig. 2020.  Weight poisoning attacks on pretrained models.  In _Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics_ , pages 2793–2806, Online. Association for Computational Linguistics.
  * Li et al. (2020) Junnan Li, Richard Socher, and Steven C.H. Hoi. 2020.  Dividemix: Learning with noisy labels as semi-supervised learning.  In _International Conference on Learning Representations_.
  * Li et al. (2021a) Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu. 2021a.  Backdoor attacks on pre-trained models by layerwise weight poisoning.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 3023–3032, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Li et al. (2022) Shikun Li, Xiaobo Xia, Shiming Ge, and Tongliang Liu. 2022.  Selective-supervised contrastive learning with noisy labels.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 316–325.
  * Li et al. (2021b) Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021b.  Anti-backdoor learning: Training clean models on poisoned data.  _Advances in Neural Information Processing Systems_ , 34:14900–14912.
  * Li et al. (2021c) Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021c.  Neural attention distillation: Erasing backdoor triggers from deep neural networks.  In _International Conference on Learning Representations_.
  * Li et al. (2021d) Zichao Li, Dheeraj Mekala, Chengyu Dong, and Jingbo Shang. 2021d.  BFClass: A backdoor-free text classification framework.  In _Findings of the Association for Computational Linguistics: EMNLP 2021_ , pages 444–453, Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Liu et al. (2018) Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018.  Fine-pruning: Defending against backdooring attacks on deep neural networks.  In _Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21_ , pages 273–294. Springer.
  * Liu and Tao (2015) Tongliang Liu and Dacheng Tao. 2015.  Classification with noisy labels by importance reweighting.  _IEEE Transactions on pattern analysis and machine intelligence_ , 38(3):447–461.
  * Lukasik et al. (2020) Michal Lukasik, Srinadh Bhojanapalli, Aditya Menon, and Sanjiv Kumar. 2020.  Does label smoothing mitigate label noise?  In _International Conference on Machine Learning_ , pages 6448–6458. PMLR.
  * Lyu et al. (2022a) Weimin Lyu, Songzhu Zheng, Tengfei Ma, and Chao Chen. 2022a.  A study of the attention abnormality in trojaned BERTs.  In _Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 4727–4741, Seattle, United States. Association for Computational Linguistics.
  * Lyu et al. (2022b) Yougang Lyu, Piji Li, Yechang Yang, Maarten de Rijke, Pengjie Ren, Yukun Zhao, Dawei Yin, and Zhaochun Ren. 2022b.  Feature-level debiased natural language understanding.  _arXiv preprint arXiv:2212.05421_.
  * Nguyen et al. (2020) Duc Tam Nguyen, Chaithanya Kumar Mummadi, Thi Phuong Nhung Ngo, Thi Hoai Phuong Nguyen, Laura Beggel, and Thomas Brox. 2020.  Self: Learning to filter noisy labels with self-ensembling.  In _International Conference on Learning Representations_.
  * Nguyen and Tran (2021) Tuan Anh Nguyen and Anh Tuan Tran. 2021.  Wanet - imperceptible warping-based backdoor attack.  In _International Conference on Learning Representations_.
  * Pang et al. (2022) Lu Pang, Tao Sun, Haibin Ling, and Chao Chen. 2022.  Backdoor cleansing with unlabeled data.  _arXiv preprint arXiv:2211.12044_.
  * Poliak et al. (2018) Adam Poliak, Jason Naradowsky, Aparajita Haldar, Rachel Rudinger, and Benjamin Van Durme. 2018.  Hypothesis only baselines in natural language inference.  In _Proceedings of the Seventh Joint Conference on Lexical and Computational Semantics_ , pages 180–191, New Orleans, Louisiana. Association for Computational Linguistics.
  * Qi et al. (2021a) Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a.  ONION: A simple and effective defense against textual backdoor attacks.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 9558–9566, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Qi et al. (2021b) Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. 2021b.  Mind the style of text! adversarial and backdoor attacks based on text style transfer.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 4569–4580, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Qi et al. (2021c) Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021c.  Hidden killer: Invisible textual backdoor attacks with syntactic trigger.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 443–453, Online. Association for Computational Linguistics.
  * Qi et al. (2021d) Fanchao Qi, Yuan Yao, Sophia Xu, Zhiyuan Liu, and Maosong Sun. 2021d.  Turn the combination lock: Learnable textual backdoor attacks via word substitution.  In _Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers)_ , pages 4873–4883, Online. Association for Computational Linguistics.
  * Radford et al. (2019) Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019.  Language models are unsupervised multitask learners.  _OpenAI Blog_.
  * Reed et al. (2014) Scott Reed, Honglak Lee, Dragomir Anguelov, Christian Szegedy, Dumitru Erhan, and Andrew Rabinovich. 2014.  Training deep neural networks on noisy labels with bootstrapping.  _arXiv preprint arXiv:1412.6596_.
  * Ren et al. (2018) Mengye Ren, Wenyuan Zeng, Bin Yang, and Raquel Urtasun. 2018.  Learning to reweight examples for robust deep learning.  In _International conference on machine learning_ , pages 4334–4343. PMLR.
  * Saha et al. (2022) Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash. 2022.  Backdoor attacks on self-supervised learning.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , pages 13337–13346.
  * Sanh et al. (2021) Victor Sanh, Thomas Wolf, Yonatan Belinkov, and Alexander M Rush. 2021.  Learning from others’ mistakes: Avoiding dataset biases without modeling them.  In _International Conference on Learning Representations_.
  * Sha et al. (2022) Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, and Yang Zhang. 2022.  Fine-tuning is all you need to mitigate backdoor attacks.  _arXiv preprint arXiv:2212.09067_.
  * Shu et al. (2019) Jun Shu, Qi Xie, Lixuan Yi, Qian Zhao, Sanping Zhou, Zongben Xu, and Deyu Meng. 2019\.  Meta-weight-net: Learning an explicit mapping for sample weighting.  _Advances in neural information processing systems_ , 32.
  * Turner et al. (2019) Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019.  Label-consistent backdoor attacks.  _arXiv preprint arXiv:1912.02771_.
  * Utama et al. (2020) Prasetya Ajie Utama, Nafise Sadat Moosavi, and Iryna Gurevych. 2020.  Towards debiasing NLU models from unknown biases.  In _Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP)_ , pages 7597–7610, Online. Association for Computational Linguistics.
  * Wang et al. (2019) Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R. Bowman. 2019.  GLUE: A multi-task benchmark and analysis platform for natural language understanding.  In _International Conference on Learning Representations_.
  * Wang et al. (2023) Fei Wang, James Y. Huang, Tianyi Yan, Wenxuan Zhou, and Muhao Chen. 2023.  Robust natural language understanding with residual attention debiasing.  In _Findings of the Association for Computational Linguistics: ACL-IJCNLP 2023_.
  * Wang and Culotta (2020) Zhao Wang and Aron Culotta. 2020.  Identifying spurious correlations for robust text classification.  In _Findings of the Association for Computational Linguistics: EMNLP 2020_ , pages 3431–3440, Online. Association for Computational Linguistics.
  * Wei et al. (2020a) Hongxin Wei, Lei Feng, Xiangyu Chen, and Bo An. 2020a.  Combating noisy labels by agreement: A joint training method with co-regularization.  In _Proceedings of the IEEE/CVF conference on computer vision and pattern recognition_ , pages 13726–13735.
  * Wei et al. (2020b) Hongxin Wei, Lei Feng, Rundong Wang, and Bo An. 2020b.  Metainfonet: Learning task-guided information for sample reweighting.  _arXiv preprint arXiv:2012.05273_.
  * Wolf et al. (2017) M. J. Wolf, K. Miller, and F. S. Grodzinsky. 2017.  Why we should have seen that coming: Comments on microsoft’s tay "experiment," and wider implications.  _SIGCAS Comput. Soc._ , 47(3):54–64.
  * Xia et al. (2021) Xiaobo Xia, Tongliang Liu, Bo Han, Chen Gong, Nannan Wang, Zongyuan Ge, and Yi Chang. 2021.  Robust early-learning: Hindering the memorization of noisy labels.  In _International Conference on Learning Representations_.
  * Xia et al. (2022) Xiaobo Xia, Tongliang Liu, Bo Han, Mingming Gong, Jun Yu, Gang Niu, and Masashi Sugiyama. 2022.  Sample selection with uncertainty of losses for learning with noisy labels.  In _International Conference on Learning Representations_.
  * Yang et al. (2021a) Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. 2021a.  Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in NLP models.  In _Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies_ , pages 2048–2058, Online. Association for Computational Linguistics.
  * Yang et al. (2021b) Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021b.  RAP: Robustness-Aware Perturbations for defending against backdoor attacks on NLP models.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 8365–8381, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.
  * Yu et al. (2019) Xingrui Yu, Bo Han, Jiangchao Yao, Gang Niu, Ivor Tsang, and Masashi Sugiyama. 2019\.  How does disagreement help generalization against label corruption?  In _International Conference on Machine Learning_ , pages 7164–7173. PMLR.
  * Zhang et al. (2021) Xinyang Zhang, Zheng Zhang, Shouling Ji, and Ting Wang. 2021.  Trojaning language models for fun and profit.  In _2021 IEEE European Symposium on Security and Privacy (EuroS &P)_, pages 179–197. IEEE Computer Society.
  * Zhang et al. (2023) Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. 2023.  Backdoor defense via deconfounded representation learning.  _CoRR_ , abs/2303.06818.
  * Zhang et al. (2022) Zhiyuan Zhang, Lingjuan Lyu, Xingjun Ma, Chenguang Wang, and Xu Sun. 2022.  Fine-mixing: Mitigating backdoors in fine-tuned language models.  In _Findings of the Association for Computational Linguistics: EMNLP 2022_ , pages 355–372, Abu Dhabi, United Arab Emirates. Association for Computational Linguistics.
  * Zheng et al. (2020) Songzhu Zheng, Pengxiang Wu, Aman Goswami, Mayank Goswami, Dimitris Metaxas, and Chao Chen. 2020.  Error-bounded correction of noisy labels.  In _International Conference on Machine Learning_ , pages 11447–11457. PMLR.
  * Zhou and Chen (2021) Wenxuan Zhou and Muhao Chen. 2021.  Learning from noisy labels for entity-centric information extraction.  In _Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing_ , pages 5381–5392, Online and Punta Cana, Dominican Republic. Association for Computational Linguistics.