Confidence-Driven Backdoor Poisoning in Text Classification: Sample Efficiency, Knowledge-Distillation Survival, and Defense Evasion Across Four Datasets

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

A backdoor attack hides a secret switch inside a machine learning model: the model behaves normally almost all the time, but produces an attacker-chosen wrong answer whenever a specific trigger appears in the input. The attacker installs the switch by corrupting a small number of training examples. A method called confidence-driven boundary sampling (CBS) proposes a smarter way to choose which examples to corrupt — pick the ones the model is already unsure about — and was shown on image classifiers to make the resulting backdoor harder for security checks to detect. CBS had never been evaluated on text, and nobody had checked whether these backdoors survive when a large model is compressed into a smaller one. We test both. We use BERT-base as the teacher and DistilBERT as the compressed student, two trigger families (a rare word and an out-of-domain sentence), and four datasets chosen so that each changes a single structural property: SST-2 (short text, binary) as the baseline, AG News (four classes), IMDB (long documents), and Yelp Polarity (long documents, different domain). We report four findings. First, CBS costs the attacker more, not less. To reach a 90% attack success rate on SST-2 it needs about 8.3 times more corrupted data than random selection (5 times for the sentence trigger); on Yelp's word trigger it never reaches 90% at all, even at twenty times random selection's budget. A three-seed replication confirms the SST-2 gap with non-overlapping variance. Second, compression removes most of the backdoor but never all of it. Retention spans 0.88–12.30% across the four datasets, even though the student is trained only on clean text; CBS retains more than random selection in 7 of 8 comparisons. Third, the stealth advantage CBS was designed for does not appear in text — and on Yelp it reverses. Three of four defenses barely affect either method on most datasets, and on Yelp's word trigger every defense strips substantially more from the CBS backdoor (3.9–18.8 points) than from the random one (≤0.2 points). Fourth, document length caps the attack, but the threshold is absolute rather than relative. IMDB plateaus at 79–86% and never reaches 90% at any rate from 0.02% to 10%. Yelp, also long-form, does not plateau — its typical document is 202.6 tokens against IMDB's 305.2. CBS selects systematically longer documents than random selection on both (300.5 vs. 202.6 on Yelp; 387.6 vs. 305.2 on IMDB), which places CBS-selected Yelp documents inside the same dilution regime IMDB imposes on every method — and explains why CBS alone fails on Yelp's word trigger. Code and per-run results: https://github.com/kannu74/cbs_on_text